{ "Event": { "published": true, "date": "2024-04-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-04-17", "timestamp": 1713398581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "068eb6aa-650d-4653-b477-97fa34576649", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c08dc3-fce4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713376699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376699, "uuid": "816c937d-4761-42c4-98b0-f15555366458", "comment": "Malware payload (Mirai)", "value": "99cc3f1e6eae3ea8c8ae4ceaa8111624", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376699, "uuid": "9d215c05-b9e6-48a0-aa30-19892b70cc67", "comment": "Malware payload (Mirai)", "value": "004cf3c4e9095559c4d83228cd84f31961fda814a0f531ca9e0cd1965faf0c81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376699, "uuid": "1e390924-1641-496c-b442-96c729635910", "comment": "Malware payload (Mirai)", "value": "d1218d751423600be4d2e72e8f4e0e9b88411e22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376699, "uuid": "0167a83e-5843-4f39-9c58-3536ecc3b991", "comment": "Malware payload (Mirai)", "value": "8c8cc4bee2b1d6268bc5b1339994ba8cb6a0332d42d4ad557713ef5f9ccf363937e1b62704e98e5db50bd4a772f43841", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376699, "uuid": "c2f76692-8255-4698-950a-14550c156948", "value": "T1C314D81AEFA10FBBD86BDD3702D8074139CC944722A57B363578D928F54B54B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376699, "uuid": "06138244-c5ef-48dd-9b35-95fb345294b3", "value": "3072:cyoAZDfkvljYKHCqaQ/DpYInh5H8WeYUVteJ6W2p:ZZDfc5ltYIh5H8hVteJz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713376699, "uuid": "7bc70246-1085-4294-b06d-9bf1317c8141", "value": 193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713376699, "uuid": "2800581d-7b8d-49f3-b2cf-0f8011b71215", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376699, "uuid": "8c3a7548-fd72-4243-a2c2-563cad325155", "value": "99cc3f1e6eae3ea8c8ae4ceaa8111624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d20dae2-fc68-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713323539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713323539, "uuid": "9937a6ba-2d98-44fe-a089-c0f441012d91", "comment": "Malware payload (AgentTesla)", "value": "2fcc530a5fc66fd49ff424b391fc8870", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713323539, "uuid": "c2cff806-0b21-4474-ab23-1c90540d0b4a", "comment": "Malware payload (AgentTesla)", "value": "006266f9eda6903e064e94e834d9513ad3a85c2d9964b50dd90d03e2b784ce2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713323539, "uuid": "9bdc37b5-a85f-4cb6-bdab-b1e587d36152", "comment": "Malware payload (AgentTesla)", "value": "27b20a90bd57aec3cf96612c309d50a7ed29165a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713323539, "uuid": "a24082f5-9ff7-4b92-8684-b7073b93b77c", "comment": "Malware payload (AgentTesla)", "value": "631a501917e5c85d610c760174262fffdbb8f185f6beddfbcb1057b0babd49c240041540783a152415c222d85110f2a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713323539, "uuid": "9c8e8bf1-1401-49ae-ae23-a5374d224a41", "value": "T15174225962CE2532FBBE6F38276B08050773B5D255F3CB1F9AAD10E20B97B814990B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713323539, "uuid": "1d6227c3-dac3-4fad-92e1-b73fbd069402", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713323539, "uuid": "b3a78612-c2ea-47e4-b7b4-489a410a08bd", "value": "6144:cQIqsryFc2ZF3GOO+Fg8aDeoY790Ckk5FX2A90Wlo0neOBh:cQcabrOPCVZ0k99ZzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713323539, "uuid": "68ca116b-0d25-45cd-93ce-e4253b3fa33e", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713323539, "uuid": "216e98d3-4532-4f1f-8304-1078403c78b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713323539, "uuid": "5666dc58-9d2b-448f-a253-3139aebc9626", "value": "remittance payment of invoice DMWW24009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e50d8f-fcd5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713370589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370589, "uuid": "67eb34ec-f73d-4bae-9b58-9eac052a474d", "comment": "Malware payload", "value": "15e567d8079e1f1cae7dd6f25ff52356", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370589, "uuid": "3d78fa15-c1a9-483b-9384-09dcd8c4c102", "comment": "Malware payload", "value": "0112ea3dd460b8776d52bcf9fad234ddbf19e4e2b6666b8560aa173764e14af7", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370589, "uuid": "b79fed3c-cb5c-464f-835a-6a5148523be0", "comment": "Malware payload", "value": "44560a566119dc913fb2e603c286030247d6a16d", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370589, "uuid": "a21ba3d8-d555-450c-9f8f-850698fbcb6f", "comment": "Malware payload", "value": "abf38ca1201b452df2bdbd47784f8f72752df7b66379a3c5ba5b9b9e946321446cf7ff32c34e34688e65378c1b663478", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370589, "uuid": "4cecfd56-757c-4a5b-99c0-d35b66bc7a78", "value": "T1B7D3129AF78F619CDCBCDBB0F184066BA8F840D0EA45406359025AD89B99D1EF4FDB09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370589, "uuid": "540352cb-a6a8-47fb-b239-b08e3bd142cd", "value": "3072:43R7WFWDx0DR9eM+M84CaLILmsWBrEik9RG+5gGrRXGJB:43R7WMxC3eM+M7CayHWBzc9xd2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713370589, "uuid": "dc796e61-e38b-4b37-abee-ffa4dd676a62", "value": 131819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713370589, "uuid": "ffd38136-1a5a-4226-a090-bbbf409f1186", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370589, "uuid": "1ab7bb8d-f7d2-4d2b-a761-6f7c7e53a8b8", "value": "12.99999.01228.319239810.XXXXX0037.000003.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d35fb19-fcda-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713372582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372582, "uuid": "eacefa1a-20fc-4f56-bed6-9c4443a5dead", "comment": "Malware payload", "value": "587dbc8371a8a8e2424eceec829b0763", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372582, "uuid": "5a4b80d5-ee5b-4e0b-a7cf-3adb2e012c24", "comment": "Malware payload", "value": "015a5025ba2d3a419165d506f399cef408fb611427debe725a76b44a482c7f24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372582, "uuid": "bf50d3df-0819-4370-9c54-57855cc90a13", "comment": "Malware payload", "value": "4d1afaa6bc5766650c1bdd1ed3169e948032c1ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372582, "uuid": "82e12d69-2bd1-48ee-bd3f-71ae38ccff31", "comment": "Malware payload", "value": "043a2a29820efa14705e262bdca3e7a30fd38d36ca4b86daaac2b4d42265dbd02906d34fa537b0977aa744cf5f165815", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713372582, "uuid": "c8d786bd-075f-4bff-ac5d-a6b65c05cf0b", "value": "T1E1953367C403F2C04B8298B74AD39929F493D4160FA1438E7D3EA5C764E701EABEED59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713372582, "uuid": "4462d64d-4768-4685-9a3f-2bebad8139ab", "value": "49152:AdoCxUiQ7gCnKqiv2my8mrvgYR7fzRs5mMu:qoMkvXO2mGrrntMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713372582, "uuid": "50129caa-0d9c-4503-9d19-b6ce77e011a2", "value": 1916080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713372582, "uuid": "f4fbe72a-07e7-48fe-a45e-1f0d4d6be327", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713372582, "uuid": "f8137f73-e883-47d0-8c4e-b56d30d00b53", "value": "aaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6feb7f13-fc93-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713342066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342066, "uuid": "65bf6911-d2ab-44dd-b18c-27af1d70354e", "comment": "Malware payload (Mirai)", "value": "78387215b89f73a31e3dd4b9281077b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342066, "uuid": "17792934-4c80-475a-a5aa-23738b032ca3", "comment": "Malware payload (Mirai)", "value": "036ed5c6f97127e48b6a31781c28ec3e64ec75b2bdc36cb18bb08efb2fef344f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342066, "uuid": "5b8b8968-4787-419a-9cdb-5bf58d3fa49a", "comment": "Malware payload (Mirai)", "value": "376f0d18f67b81e7ad9f372892e401a11af1c842", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342066, "uuid": "26471593-0738-4d59-b284-2f9b37b765c8", "comment": "Malware payload (Mirai)", "value": "20168b02f576f6cb4b14f4d5c9316d3e1857b9e1acd345994b34ec7bd693e647849e200325c7eb0a044af2e211d6935b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342066, "uuid": "a98fa055-b913-458b-8a80-01e567f4c43d", "value": "T16214E80AAB510FFBDC6FDE3702EA060535CC651722A82B763674D528F54A94F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342066, "uuid": "5789f6bd-22ff-49ad-939a-510a7b304280", "value": "1536:pawBEP/vGUQBiFUCW70cx7dCgSPF8fy3T3TnVIF3raKalJOwUfXZzZRgEYfenzHB:prlOUfnx7BS6ClwwUziuZZHmSHDyDde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713342066, "uuid": "d6ff38b9-bafa-4981-b8fe-a8704ad3f21b", "value": 207940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713342066, "uuid": "e8f07887-0db5-4cb9-b647-6020feb67732", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342066, "uuid": "99fe68cb-7856-4917-a401-65272564423d", "value": "78387215b89f73a31e3dd4b9281077b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11c41ae-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713388239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388239, "uuid": "545f3d49-7eb2-4803-956a-3643c2c304f1", "comment": "Malware payload (Mirai)", "value": "841053d589a65b8d45bc4a77e8ffcb6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388239, "uuid": "ee346349-3003-42d7-a3a2-ab704e87b0e2", "comment": "Malware payload (Mirai)", "value": "040f51898d55ee984fbb3bc4cb9b593a6f0926ebbf0aaaef5ebc3a86ff5b3ea5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388239, "uuid": "7f9fe6f0-78e0-463c-9a58-642994e7db80", "comment": "Malware payload (Mirai)", "value": "8b0d636a1f0003b0c624554376e65e32df460f2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388239, "uuid": "5ec53fa1-1283-41b1-8954-b5a4876c0a0d", "comment": "Malware payload (Mirai)", "value": "020bf5eebf2d1eed39ea712b4eda378759c9008e2cc1ab08c30b4dd24ba5bfdcd3406a63a5aae3033866255c2b3a53f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388239, "uuid": "6613d928-0389-46d1-8759-938e11dca3b1", "value": "T157832B91BD815623C6D012B7FB9E468D3B2A03E8D3EE72079D256F2137C781B0E67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388239, "uuid": "0dabc7cc-f7a3-486d-bd68-95154b6f09a5", "value": "1536:o6XBDiML7kl2WnyR16Qd9czmwXOjiq7dSYzGig9Sio:o6XBtlRP9cirpSYu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713388239, "uuid": "0d2b80a5-cced-4df9-9a6c-ac8db5051bc8", "value": 83548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713388239, "uuid": "d0418d48-45e3-48cc-b0bf-5d4715c84127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388239, "uuid": "5ab96d49-b126-44aa-aacb-512f3ac14cb4", "value": "841053d589a65b8d45bc4a77e8ffcb6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba850ed-fd12-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713396685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396685, "uuid": "8664385e-80bd-4c65-b3ed-439e5d4d5ddf", "comment": "Malware payload (Mirai)", "value": "eb31f243bbf2b2b961ecf15c631e9a78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396685, "uuid": "ac615873-86df-4bcf-aea1-c7789da37b6c", "comment": "Malware payload (Mirai)", "value": "04f2b04e179ede5422448fa38ecd25b65d9d717541bbf08ca0592b380cca2269", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396685, "uuid": "4eae3ae8-b046-4fb2-81e3-780e44b2a691", "comment": "Malware payload (Mirai)", "value": "363488dbda9d10d67384c82927a7ff68491b6c71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396685, "uuid": "e334be58-790a-4bd6-aec0-e42f619068ff", "comment": "Malware payload (Mirai)", "value": "86859a20cb003e45d28de9e07a2b3eee6fc2c64a6d3973fb8b1ff8151a501ed8b70897a7fd2f0433f8a45ae01e0e2154", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396685, "uuid": "06279eef-ff0e-4a17-b9bc-633d84f70fc4", "value": "T198F3843E7A21AB7EE268823107F69F70CF9529D327A09341E26CE7185E7124D1C9FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396685, "uuid": "62d47844-6c95-4a9f-a15f-bc876d9da739", "value": "3072:eQ8noPFwtGVaCbc0HaAsO4oUY9F98m8Hh8dA5Nu:F8p0l4oUY2m8Hh8dA5Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713396685, "uuid": "59e305aa-5376-4619-92a7-5295ce4d0b40", "value": 171148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713396685, "uuid": "3837d63a-a5f6-400f-924c-2c78d9c88878", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396685, "uuid": "9a01a6ba-ecec-4fed-93ea-f16af03e0f1e", "value": "eb31f243bbf2b2b961ecf15c631e9a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e8991e-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713388196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388196, "uuid": "a842a9a4-05ee-49d2-8f90-f128a7a11d2a", "comment": "Malware payload", "value": "3b75fbd96388d92a64dc14d9aeea8235", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388196, "uuid": "7bfa0912-f0ca-41e1-962b-3121167efe40", "comment": "Malware payload", "value": "0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388196, "uuid": "39c77c1b-5a07-4b55-bc01-06c804260cbb", "comment": "Malware payload", "value": "5e8ac216d79c651babaff716638433e0ec1e3b36", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388196, "uuid": "da94ccb0-79ac-47ab-805b-24bb74e89c65", "comment": "Malware payload", "value": "9ba09b98a413c34200a53dba6a92f73c17fc7394701420f462733eebd78a2fbb80b36a30a421d9cb2eeddee3d0e735af", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388196, "uuid": "1eafa7ee-744b-4706-89de-c508ff8480a2", "value": "T1BCF73332FCA8291BC0101BBB687A1BCB555EBFE1373BD6C71B6CE3945224E4918592CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388196, "uuid": "57290d2c-9395-4145-aced-0b2e9cd61577", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388196, "uuid": "6c21a5aa-c07b-446f-8aaa-9d4bc657452f", "value": "1572864:U45L3pDgGUo6tl3M4nqp9rLqDND6+wO+OfbQHe2G2hCN/h:7Dgx3Zq/rLfRO+HeXKCNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713388196, "uuid": "72cf58c8-7e3c-45bb-a8bb-e0f44353c237", "value": 73077368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713388196, "uuid": "773bb059-a08b-405a-ae5c-41785efb309c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388196, "uuid": "1d1eb283-05c0-4ed9-b554-9dedd407fd34", "value": "EpsilonFruit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c212ae7-fc84-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713335483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335483, "uuid": "056feb95-ff64-4b07-a523-aa3f51ee83ef", "comment": "Malware payload (AgentTesla)", "value": "44a29fe67790393da2d2bdd6041d1b8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335483, "uuid": "f31faf7d-21e0-432d-86af-0736c4d3d36a", "comment": "Malware payload (AgentTesla)", "value": "06c2b1ff831a7ef951d16f8d66b3aeb8cf0e34ea7cf10cc97fafca3954d3941a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335483, "uuid": "05a700ee-197a-4474-bb1d-8865c1d90668", "comment": "Malware payload (AgentTesla)", "value": "3012409a7272c6885fb1206f5e3fccac5427d43c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335483, "uuid": "bd314f32-58d0-4f9d-8e96-caf90b07a7c9", "comment": "Malware payload (AgentTesla)", "value": "135cde0742732f59c62fdfe16689f0ad56e9c6415e65b1d64f616a117c49ac702cf3a9950089471703d253e6b3fef7dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335483, "uuid": "498bb502-e9cd-4683-b7a4-e6cfd59cba05", "value": "T182358C3263918326FFAB9D73DB5DB20D56BD6D250123852FD29C2F78A9F01B1122D263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335483, "uuid": "2e961e44-cde1-471a-a4b8-c51a8cc6cb62", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335483, "uuid": "39e12c3d-c104-4913-b87d-58b0e5a49408", "value": "24576:9AHnh+eWsN3skA4RV1Hom2KXMmHaMNj+LXwCh5:ch+ZkldoPK8YaMkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713335483, "uuid": "0e8c88b7-885e-4868-8d7c-d124fc4a2a88", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713335483, "uuid": "981239b7-8e88-4cc2-82f0-b75655d2587c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335483, "uuid": "04c2ba69-6fbe-4cab-9ee8-d5964c1a0829", "value": "DEQ_7893901209-30903476200_____________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6146af78-fcc9-11ee-a120-42010a9c002e", "comment": "Malware payload (Heodo)", "timestamp": 1713365234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365234, "uuid": "7516476f-8e8e-421f-9a49-fd5b811e8bd2", "comment": "Malware payload (Heodo)", "value": "d174e68fe3458262e53dee5036eeb15e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SSLoad", "colour": "#9E91F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365234, "uuid": "6f9b6840-b5a2-41a2-8b9c-c280cef53f58", "comment": "Malware payload (Heodo)", "value": "092962bc268390debf17cd148d03147cdf919e442e61c92de01eac3bdb34b1c1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SSLoad", "colour": "#9E91F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365234, "uuid": "f546912c-fdaf-4e1b-91aa-f46b9c20ae06", "comment": "Malware payload (Heodo)", "value": "9629e313a6299e600ff2c6086a24e3ad6ff6ba59", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SSLoad", "colour": "#9E91F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365234, "uuid": "2e91f222-a9a8-4adc-a921-fcc629ea93e4", "comment": "Malware payload (Heodo)", "value": "b5144269db385d4b07682beff784efeee0f2177502e7766846a2bea70c8b9a86126d8d2daf0d9e1d19bfd1fc2ed03f20", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SSLoad", "colour": "#9E91F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365234, "uuid": "0408e43c-ebd5-4d95-85f3-478c8795043c", "value": "T1A1156B60FE4511661E83679F9C6216D2FD2CC21193022228E99E439D1F875ECD3BDBAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365234, "uuid": "373a2ce7-2296-4122-88ba-5eb93305a53d", "value": "12288:r0PIO52rUkKgsPBQtW9iAm4pc6bD4QscB4gefCsDIP4lU:r3OdkFsmt0iAHNbMQsq4golEOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713365234, "uuid": "b7a19e71-7754-4861-a1ff-ba919c664307", "value": 883252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713365234, "uuid": "fc5b6c59-2594-40f8-98ed-a06c1c29f314", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365234, "uuid": "4b34048a-e696-4341-ae5c-9f1957b7e5b6", "value": "Doc_m42_81h118103-88o62135w8623-1999q9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10536956-fc93-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713341905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713341905, "uuid": "2f646622-9056-484d-b593-886ced5dddd1", "comment": "Malware payload (AgentTesla)", "value": "b36132fd51ddea2d05fee2310701e685", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713341905, "uuid": "854e4d2a-77f5-4776-9c14-9a83c787a8e2", "comment": "Malware payload (AgentTesla)", "value": "095641daafc4aa5269753ed2d9d1beb96f6fb7b6ee6300abf0d9d25bc62c53ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713341905, "uuid": "3e8356eb-0b09-4603-a214-dcd0d78264fe", "comment": "Malware payload (AgentTesla)", "value": "a902f152500e5e7e81895406a2a2d9a7e9f9bba9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713341905, "uuid": "f96635d9-f7a2-46da-b4ea-6d1ddd7ccbaf", "comment": "Malware payload (AgentTesla)", "value": "7fdddc9a2591ad16eb7aed1ac97e8505cc8b5bcf087862942fd2f23e1ecfff41f4b65a237a5c40a8168fd226bf6dd367", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713341905, "uuid": "8d38591d-68ee-400e-910e-efeda596d508", "value": "T15AD4231ACAF996ED3C4C7141E793FFE30E1D844AB7AE05662E54CAB30E5837A8D20651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713341905, "uuid": "46560aeb-d967-4227-99aa-c341b9ed65f9", "value": "12288:fgYzgT1xRKC31/hpd55pHHQ5lcLCT9BbnGd8ZBQ/rXpmGg+xt:YYcTb8SNhpd55F4WA9gau/rU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713341905, "uuid": "78b3f4ff-1e82-4dee-9d85-074049cc2ba2", "value": 618930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713341905, "uuid": "16462e37-fb25-4254-bc4a-80598b666252", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713341905, "uuid": "236450e7-696f-44ff-9d39-20a00e4c31b5", "value": "SHIPPING ORDER.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9605cce5-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361457, "uuid": "b8cb2613-8628-4fb4-b523-1add3aaeb15f", "comment": "Malware payload", "value": "9a2b260674850bb6ae635c590d417231", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361457, "uuid": "0e426adb-9664-4acb-9f44-c5ea10d23e81", "comment": "Malware payload", "value": "0bcb1b1228c5041a7e9577dfa868d11005cdbaef29239eb0b19e1147e7622fec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361457, "uuid": "652023ae-a3fe-4f93-a44a-9c9aee48252a", "comment": "Malware payload", "value": "78b42782544e969e1d2227b14b2834b2ca184a01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361457, "uuid": "fa3797ab-5cd3-4fc0-9a02-93edf011735d", "comment": "Malware payload", "value": "a30fefbf16a2ed846b2a34d1e7f65d57b6dbaea05a41098c7cfb1c4417feedc1b1b059389f1bf36cee53b7748e2a668c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361457, "uuid": "50c47199-3b6c-4b25-a1c8-af071bca31b3", "value": "T1E056E604BDC46BB6C82C8B7584E6CA9223B06D144AF15A271664FED9BC762787F47CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361457, "uuid": "4aba0c05-a661-453b-bb31-251818764b37", "value": "49152:+RxVVRFMTw1upkYzfgh7rxQ2USaU85Jbq1rQcR6VYv0VF1:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361457, "uuid": "869cd426-a2b4-4b2c-b061-c31d04090b16", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361457, "uuid": "31671616-a97d-46d3-8695-ac4994b60afc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361457, "uuid": "70222487-deb8-4b1e-bd9a-6bdad9c50689", "value": "SecuriteInfo.com.ELF.Kaiji-P.1244.10082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc7f5c3-fca2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713348716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713348716, "uuid": "11a6200b-1aa2-4d28-8ee1-1e1c6d81d4e5", "comment": "Malware payload (AgentTesla)", "value": "ab23315a2a64dc4f3b705f9a73a5b730", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713348716, "uuid": "75ad3b2e-acb2-4df1-816d-3e32abb702d2", "comment": "Malware payload (AgentTesla)", "value": "0cdb3ae7d110a3e4118af8ad502151685e3e212bd6124b52ddfa21c1f128f5e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713348716, "uuid": "4c691bb1-e821-4dac-8e69-7455660ed299", "comment": "Malware payload (AgentTesla)", "value": "d4fabcc55c6206d0fac66c5d58f44f949df1186f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713348716, "uuid": "aaf98781-22da-49cb-abcd-c515cb69447b", "comment": "Malware payload (AgentTesla)", "value": "9424c8f59eca4c9d88b16c359be8560ea009436230022087f754e77f9b199fde8583e0a045a0adc585ac39c4aa1097f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713348716, "uuid": "f5ef02f0-1fbc-4eeb-977f-5a098517d397", "value": "T1EBE4231651B6A727E97CAFF000B28D6313F16655352AEB182EC231ED287CF14E976E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713348716, "uuid": "1163b6c1-5705-4a56-9f20-f8a8efcf1c05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713348716, "uuid": "e5f16ba1-9e89-410c-939d-3d8b3c14057b", "value": "12288:OPw+eppcCOgBrepOGAl/kAfCWlNAlSfwlTJCbEuU222cWjoI:FZXrD5lfBNAlQEub2rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713348716, "uuid": "1d72cb8e-f394-46ec-b595-8555fa335495", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713348716, "uuid": "0b87224c-b743-4e70-84d4-a7f73e6d473f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713348716, "uuid": "77963191-92f7-4bf7-8f9c-51f81b67973f", "value": "signed documents and BOL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24dd846a-fc9b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713345376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345376, "uuid": "9591b6be-c0e0-4093-afdb-cafa5a292d18", "comment": "Malware payload", "value": "f85bc7324738a98dc88411b591fe3aca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345376, "uuid": "f9e4b5fa-7c04-4986-a914-c3249cfacd87", "comment": "Malware payload", "value": "0d7f14e13b7e5b03592ef2ed52ab20adadfaa5a67bfb1195c4f2b3749cf717f9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345376, "uuid": "fbeacc3c-d093-40f8-8031-c87c04362984", "comment": "Malware payload", "value": "2afff49eae1d967b352a5010abdc6a175366be0d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345376, "uuid": "7e2bb0f4-f036-4531-a6d3-d72c82cad489", "comment": "Malware payload", "value": "9bdda0e6997c134cf015ed6fa10654e72dd34b9cd1f0b3ef2b12f00643abcad1f8fb43191a0ae1c9e364e2fc78bc5a09", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345376, "uuid": "51e037ab-0ff7-4fcd-98ce-bc8a49681d49", "value": "T152B2D051F2EE8CEE6B5927FC60B7CC84C9A10F41B966C2E9EAE041564A18170F1F44DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345376, "uuid": "84ee9d42-bc6d-4a72-a120-1cad80990d00", "value": "384:neE11Yi8JKtB7TfD3L16hJVM0lKsuRfDVAMhQGy7tdVuPu9zPIVyRHt:zY6fDohJe5hDhQGy7b0IbIVyRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345376, "uuid": "8a6ec1e2-ebc3-4154-acbf-6f3f64d1425f", "value": 24170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345376, "uuid": "3d7828ac-5844-4c41-a081-759a7f81f497", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345376, "uuid": "96682254-ea5f-43b4-a8df-f5bd23e7e466", "value": "FRS2904.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2fe5d2-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387881, "uuid": "4af967ef-fcab-42db-885a-9d11d4c911d6", "comment": "Malware payload (Mirai)", "value": "7b844888f864698c835723076d6731a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387881, "uuid": "97b9eb91-ca2f-437d-8303-ee73cb2b3eef", "comment": "Malware payload (Mirai)", "value": "0e7aa35748eebf6df567c22f7dc492bfbd4b84f4666e63f90979ea18aa41894c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387881, "uuid": "8d5b98c9-1853-4261-9ba1-e9eaf40170bb", "comment": "Malware payload (Mirai)", "value": "8216c1d44e0cfb92f20158e144c56b405a2bf27c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387881, "uuid": "eb955672-0fb4-46e0-9e4c-171bb577d690", "comment": "Malware payload (Mirai)", "value": "1e3714a2f08920b4a977b1ed381f566f406cfeecc5b8e9355507b4103840d5b96675a78b2b85c2f2ee8b1f76b0b7be97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387881, "uuid": "be9d9e3b-661d-459f-8b14-cebc51145ee8", "value": "T1FD4319C1F58B44FAD05B093081A7FB3FDE31D5A84270D76EEFD99A36DA635038612A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387881, "uuid": "0409d49a-cabb-4b3a-a4bf-41467f08338f", "value": "1536:0RgWI56uIi0hTtcTNcTyV0ULBvdDLTjOWmCAM3e0/vHj67FQQR:0Rgd56ViLTNcTyV1LBvdDLTzl1O0/PjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387881, "uuid": "d0d3c1e3-66c6-4ca0-9297-b96885a45e99", "value": 58704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387881, "uuid": "71182cbb-28ba-490a-9367-767c84d5d8f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387881, "uuid": "bdb4e725-030f-4023-a06a-75b4e2181064", "value": "7b844888f864698c835723076d6731a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae44a1b-fcc7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713364364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713364364, "uuid": "984d03f0-5dc7-448f-93d1-31d1fd74d966", "comment": "Malware payload", "value": "bb683a0e1b197cab5dce152e9355983f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713364364, "uuid": "fbfb763f-4ca4-4110-9634-148f0acc3d5b", "comment": "Malware payload", "value": "0eab45741c6d3abdb145b7c928d045dc77cf3def915d017abc388c2c38da8137", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713364364, "uuid": "bcc84731-3a7b-4cbc-8bfc-505f949cb354", "comment": "Malware payload", "value": "48dab24779ecf13e3c130107e950514e46046c11", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713364364, "uuid": "01cc7c40-9ef0-4d87-be39-e77486fb29f5", "comment": "Malware payload", "value": "e22af53d63db7a876ad4cfd665e1d0627215920fe07dd576c710584e3a19c7a3d3b68571d324cf613547db05e45e8368", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713364364, "uuid": "130160cf-010b-435b-acf9-f659ab5a2966", "value": "T1BCC422763ECDE8016CFB98EFA6323BB4C935F5414A673E061A28B04F193A56EC21457D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713364364, "uuid": "b035293f-247f-4452-9aa5-ce6de0b4f7c0", "value": "12288:1IAODfjgJ4h1dPjcXUk+MifcXUk+MiQWHOOkxogMm+JJgiXSV3VNycXUk+Mid:KvY4h7P4XUQXUUWHOOkdMm+JJgioVNPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713364364, "uuid": "fca93453-4800-43db-a356-2d48e58b2e81", "value": 571629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713364364, "uuid": "8c48d517-af64-4197-a354-116c3c5e02d0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713364364, "uuid": "4e197e5e-7ebd-4df9-a84a-3c4bb71a6f65", "value": "DETAILS.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ee3bc4-fca7-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713350803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350803, "uuid": "99d7ddd3-cccf-4935-9429-b0b5ce5c5569", "comment": "Malware payload (AgentTesla)", "value": "c3ad91b24f16f7ba7fddaec1487663f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350803, "uuid": "46f97081-f85d-4ba2-a9ef-124b8e65377d", "comment": "Malware payload (AgentTesla)", "value": "0eeab2461adc66bc084a301a740856db149d2473c89243e7d66a13798fb63542", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350803, "uuid": "520e576b-3657-4fce-a785-401495f5f0f2", "comment": "Malware payload (AgentTesla)", "value": "a4961aa8874a7f5586c9800f49563b245f976a91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350803, "uuid": "117fdcf3-8b8e-4143-9134-8333a1d7eead", "comment": "Malware payload (AgentTesla)", "value": "179856988f308e201aae732fc6ee5b8bbde850cc8bfeb79caa1d0f3c4cddf51795898f0894de97ce8674a86a82e3b3c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350803, "uuid": "e66e0e30-d54c-4b27-9966-ac2a51717399", "value": "T1A73429F0CFCA26398F4B2EDAAD65445289F88195021228BDE6D907EDB243D1CD3FED54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350803, "uuid": "cf33ff00-2da6-46fd-b2e9-3c7918729903", "value": "6144:XKEeg2kae621pGqbWt0JPvk+r+usYBbnPZnqtFVyNLFViFHV/O3CL9v1EyFLK:XWqv6uVKnLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713350803, "uuid": "23f94ce7-b5ea-4fea-a646-96c19469be94", "value": 234572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713350803, "uuid": "c81d4a45-d105-4f9e-a8ea-28441afe0217", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350803, "uuid": "301127c1-827c-4abd-a76c-5e482eea56bc", "value": "draft bl_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48477481-fcbb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713359179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359179, "uuid": "58a757ca-8b42-4ad7-ac68-77606fda4244", "comment": "Malware payload", "value": "eb6522f2ebf46af4c18aa6abb40090ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359179, "uuid": "e6602af1-91c3-47ba-a4ab-39a257346a94", "comment": "Malware payload", "value": "0ff02d4a400853d0569a43b93c05fcce01438ae71978eed25fd011e328a00a4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359179, "uuid": "2c4227bc-ab15-4670-8b3d-b2b6033e26f8", "comment": "Malware payload", "value": "8f971c4c740a779e83d34c74b46090746c573854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359179, "uuid": "223842a7-723e-40ef-93f5-612ff29ce771", "comment": "Malware payload", "value": "f86a5d125cd6823f89d5a19926621118ccd8716f03c1949eaecc7eac30e79b2f67b6988834931ea9220c7703d8ab094f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359179, "uuid": "da70d67e-03d4-4fd5-8564-4818eec1cd32", "value": "T153351212BEC294B3D57329316A796721BD3CB9300FA58ADFA3D4096DDE216C0D7317A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359179, "uuid": "87a06012-44a1-497a-b47f-f49c3fe1c145", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359179, "uuid": "56c90434-0549-49f2-a376-8e243280ada1", "value": "24576:NTbBv5rUanaBFbilTlMx7qBIMl1HA5YJeUIrVBl:HBj4kMx7qBIMltA5YwUyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359179, "uuid": "6617ea4c-2edf-4e8b-82c5-90cc2e3df808", "value": 1131196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359179, "uuid": "c93f1a40-d374-4edb-9db9-f7670a09035c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359179, "uuid": "8ba0b5a8-dd85-4566-9863-2e40f4579508", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0e8035-fc9e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713346834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346834, "uuid": "90cc5788-87e3-4b77-8b2f-ca84d3e3d314", "comment": "Malware payload", "value": "71e46efe9932b83b397b44052513fb49", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346834, "uuid": "b1c14960-1ff1-44b2-8bf7-9bfc83fe7aa7", "comment": "Malware payload", "value": "11c20fabf677cd77e8a354b520f6ffca09cac37ce15c9932550e749e49efe08a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346834, "uuid": "6ac5a3b7-4f44-4e02-858a-e1331d75cff8", "comment": "Malware payload", "value": "741af3b8c31095a0cc2c39c41e62279684913205", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346834, "uuid": "7e66a1dd-2359-4384-9690-e72617df0e8b", "comment": "Malware payload", "value": "03a33ae58d74a1f1cc9b1e68e3d4635d1fc304d689df9e71ac73bed186cf8ec6789faa4f6cc98c2c0fb4c8e2e3a2e1e7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346834, "uuid": "48ccb445-3ef7-492c-a5f0-37761773e992", "value": "T11471DD5013C90AD784A78D4AC9A8851AB9FC0298597938F86F3770DFE7935ACC803E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346834, "uuid": "61e4f501-11db-4275-bbfe-982fa9ce6b9a", "value": "96:Zx2A0d5a9zHPwo0uP6SXjr4XtgPmon38JV7ZVhvoXS966hYxcdF4AlM5NQYE2Pl+:3L6jThc/pkmZAXpA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713346834, "uuid": "a6ac6221-df12-41a9-9f46-39d307134e06", "value": 3646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713346834, "uuid": "2a08791a-ef3c-4ae7-979d-4b0bea547888", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346834, "uuid": "e87f36ba-589a-4101-b353-95ca733392a6", "value": "aaa.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcb71b5-fcbc-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713359618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359618, "uuid": "a8d52b0b-2203-4195-9e1f-caa4d7c1f7bd", "comment": "Malware payload (AgentTesla)", "value": "10ec143257b9b723ee3718db0c749836", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359618, "uuid": "33b342f5-462a-4f4a-aa99-87a4fac96aab", "comment": "Malware payload (AgentTesla)", "value": "12d4a1c97873ee94b9b371666debc07aea1fd56d8afda6d023d2426bc54f6e34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359618, "uuid": "51f2f994-148f-4a4c-94e9-e8cfe3312c2c", "comment": "Malware payload (AgentTesla)", "value": "3fce2ab4b6244c1cf66aaaaef1927a6b474bc355", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359618, "uuid": "53ffe5cf-bf97-4df0-9e2a-3621d4735eb7", "comment": "Malware payload (AgentTesla)", "value": "85ce4b941f25f83b721813ac90357980b7f1665df3babf36f192a597d368de819708f70fd4a1faf3ace19f12017c3ed5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359618, "uuid": "5ea3c747-e361-4067-833f-b2d13fecb605", "value": "T1B9B52309B7EADB47D96DA374E09A0500C7F8B2E57A1DEB4E5E40E0F77807760991A20B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359618, "uuid": "9354f991-d3e4-4a2e-80d2-d862b983e79e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359618, "uuid": "29d24b0a-b880-4a02-a3b4-b5cae6a6fa68", "value": "49152:Q9OOQwfC4BQ1ePfQ7xOMM+OZm3TTqy+c+xyb6jZcJLJHs/ovJVw:GQaCgQ1eXrfZKTTuc+x06ORW/ovJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359618, "uuid": "a65b85ce-9268-4371-9378-371a99f4abf8", "value": 2484736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359618, "uuid": "72ed5a17-b560-4286-8fc1-a0f1c48f31cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359618, "uuid": "bde2c351-ac57-4c36-85fb-6d8b9ae78488", "value": "dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e33263b-fc67-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713323246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713323246, "uuid": "f873653b-3b33-4940-afb4-447c4cf5803e", "comment": "Malware payload (RemcosRAT)", "value": "035964f345b26ce3a0f888ee34ba45df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remcos RAT", "colour": "#075AD7", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713323246, "uuid": "978fbed7-d1f0-4694-9b95-08340a348a47", "comment": "Malware payload (RemcosRAT)", "value": "13d86de442fd832c83a9fcdd7e3b25729818cc4d6fc395d015a34d07d8a461f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remcos RAT", "colour": "#075AD7", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713323246, "uuid": "9b6d68ad-aadb-4d62-a369-51fffb725891", "comment": "Malware payload (RemcosRAT)", "value": "9640bfe76150bfb961de7f14d63f7e35a5ad51b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remcos RAT", "colour": "#075AD7", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713323246, "uuid": "9d1fb441-d3cc-4ff6-9287-2c9011e3d5f5", "comment": "Malware payload (RemcosRAT)", "value": "533263fdac4cbd9f3ba8e325cdd46d9affe22a7a8acfb9cc6ab403b4713f3a18d92ae5a651024247e7cc402730ba09cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Remcos RAT", "colour": "#075AD7", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713323246, "uuid": "89938929-7efb-4eb4-97c9-a3e89b2b4476", "value": "T1C093D813FA4AD0B2E42591F146426F32CEBCBC3636496173D38FCA419D79892D416EBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713323246, "uuid": "52ff391c-4d16-4f62-9eb9-03fa0d5467fd", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713323246, "uuid": "0d57e574-ed8d-4484-9a6e-a055621fc803", "value": "1536:IhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6vry:OhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713323246, "uuid": "0330281e-4adf-4e36-bd71-360b09e3e1da", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713323246, "uuid": "af354955-6ad6-4c5a-ba4d-949e404a8df9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713323246, "uuid": "085b7c1f-ee7f-43fb-b9d1-a94210010842", "value": "bUAZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3daa4b69-fca7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713350571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350571, "uuid": "7b91aad8-0e2b-4182-84eb-968e74a766ec", "comment": "Malware payload", "value": "6576400ce7323b036fca9f3d1d4a9179", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350571, "uuid": "28dbbead-c859-450e-a0e0-a11d80957795", "comment": "Malware payload", "value": "13f387282cc76fdbf5f037d2dfaccb040190d5cf3a0d44a4010d37c6a9048406", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350571, "uuid": "c2012283-bcba-4cba-b0a8-6a85b34b3afb", "comment": "Malware payload", "value": "1b4c586651380d137c73b1bb5049685623040758", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350571, "uuid": "6a461849-5383-4ed7-b7d2-5b8e22940ced", "comment": "Malware payload", "value": "3cec33fc23ed380563740a4480b69aacfba2c498e1309eb7e0aca5482bc5365d23642108c61a6e47fb28e7e18da97182", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350571, "uuid": "38529b3a-6c28-4cfe-83b1-1c42f770de9b", "value": "T12F159E0273D1C062FF9B92334B5AF6515BBC69260123E62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350571, "uuid": "1c3a2533-71d4-4552-9071-595deec8630d", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350571, "uuid": "ea6f1554-0ff5-4748-991f-07a89c32b7cc", "value": "12288:uqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTP:uqDEvCTbMWu7rQYlBQcBiT6rprG8asP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713350571, "uuid": "25b93b83-7bbd-453c-b48c-6e6199203062", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713350571, "uuid": "6e60e34f-8038-4148-a4ac-65ddd4d5fa3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350571, "uuid": "d2430825-7e3d-4fe3-ad04-d237b381963f", "value": "6576400ce7323b036fca9f3d1d4a9179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f770ab47-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713388249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388249, "uuid": "85d65940-5d2c-4a84-b47b-26b598221a73", "comment": "Malware payload (Mirai)", "value": "28b05f9283819c954ddaadd1105f7dab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388249, "uuid": "7ff1d77c-3b6f-4553-b813-b94cb54c30b1", "comment": "Malware payload (Mirai)", "value": "14b09fb51305b056b24300482dcca479ac19f36d6a5a519ba994c0ec692822d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388249, "uuid": "40d7745b-83e3-48a4-905d-4ac7fdfd2b3f", "comment": "Malware payload (Mirai)", "value": "f3ebcecb0ada3ff4ea311aae953e56fdac485683", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388249, "uuid": "e0a120b2-751c-4999-ad72-ee2086cf80cc", "comment": "Malware payload (Mirai)", "value": "627fbc2f66e2393dbb44ab39141092ed3e0cb9de88a378c1e147741f47491f6dc3d70c799cf74589fbee8c5aada894d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388249, "uuid": "4cb07851-5270-4846-9c0e-ddcae811bb61", "value": "T115433991FC829623C5C412BBF66E468D3B3153E8E2DE72139E226F2177D681B0D67E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388249, "uuid": "f6e0a4c9-2f6d-4a7c-8172-4395c274b222", "value": "1536:W0KxqIhS6sggMUJzkIAiF8EsITRPZkxa:W0KxqI5XLk82TR68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713388249, "uuid": "d8425485-fd32-428c-a4c0-161204a42356", "value": 60352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713388249, "uuid": "9b110c07-4345-4c0f-bdee-5f49c725f68f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388249, "uuid": "850373a7-a68d-4657-a437-c0cec7291273", "value": "28b05f9283819c954ddaadd1105f7dab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fde679c-fd01-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713389284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713389284, "uuid": "2c1ad9aa-10d0-4d70-a284-94733ef9d266", "comment": "Malware payload", "value": "98fa9d5bea93312c32be83bf43d6a47b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713389284, "uuid": "3c061c88-bf58-4a6e-bfb0-86f26a150cf8", "comment": "Malware payload", "value": "14d6115881dcd0df5a9fddef6e72547b797b004261602b1a618d610fc04de40a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713389284, "uuid": "86c482ff-fd5c-4980-8edd-a8712183e1e9", "comment": "Malware payload", "value": "bbb33093f8475548308840af9aaf839f02668deb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713389284, "uuid": "149c20e3-1aae-478f-884d-9b6333a28bc1", "comment": "Malware payload", "value": "be15e21bd201c6811ad69a0d0d01c2fe2a0727edc7f91bd8eb9132622f5720ddcf2707227a591722b4d192e62a7631e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713389284, "uuid": "743e5210-5801-431b-b462-918dcd9cc51b", "value": "T16064F21171C1C872C9B32D360530EAF58B3DF8340F64999B6368597A4F746C38A7AA6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713389284, "uuid": "413e8975-4919-4ddc-96c2-1879ef56b5bf", "value": "b09f4628c9b8d8436d8b37442f32d236", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713389284, "uuid": "ba49f2f4-fd66-496e-9b56-6c7b00d65a40", "value": "6144:zkNn/RgaOf1N/fcxtR7SWfFqbiJbYSkeB+/oh950QTuvp3:zkNn/g0tROAFquFFAOJTup3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713389284, "uuid": "85dc20e1-f8b5-40cc-a2b3-e53ea6e3d076", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713389284, "uuid": "1124358f-24b8-463a-b8d8-2f713e215d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713389284, "uuid": "30689634-64da-42f5-9b1a-5756b98adced", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.9.27772.28937", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ff4b3d-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361479, "uuid": "dae42ad4-c3b1-43b3-b3cf-a7f7d5561111", "comment": "Malware payload", "value": "daa6d026b1ed22d16db3ef2536a5a58c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361479, "uuid": "f76cf6f7-0317-411e-a957-ce58a6117488", "comment": "Malware payload", "value": "15b43d0780c55ab711ba39b56324c9182a6b18c453d0444267657c61e157703e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361479, "uuid": "b5462000-02a5-4f0f-a7a2-ef2a0c473c42", "comment": "Malware payload", "value": "9b63e760f490d7f2308b2aa0f1a82e79e8662907", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361479, "uuid": "e496f4fc-21d4-409e-8cfa-53eafb714f72", "comment": "Malware payload", "value": "74f256e3bcaff70c500517a9a1b528d2924805938345559c9feffd87b8ee9784feff17027daf774f37f17074b79026a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361479, "uuid": "8444e4ac-8cac-4b6d-8316-3a8893ddcaac", "value": "T15E362A57B8D28A42C0E4367ABCBDC1C432675EB99B9B12675D04FE3D3ABE1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361479, "uuid": "e75574ff-c3b7-4eed-9022-428d42f816cf", "value": "98304:8cSBHdgN2a7JP97kJru8cYWPAXqwu+60:8cS03Yu+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361479, "uuid": "593550d4-cc57-4677-a50e-bc653e8ded81", "value": 5308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361479, "uuid": "3e98fb29-a0fe-4fb2-a4e8-4864b394ae4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361479, "uuid": "0716a629-23ba-4133-910b-d516689b9426", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.24461.21195.15576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9713ab7b-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713353728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353728, "uuid": "6a81889a-20a2-4cfa-8267-2eac446cadfd", "comment": "Malware payload (AsyncRAT)", "value": "a7d63348cfe9b0dc9d3aaec28c76c8f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353728, "uuid": "deb988fc-bef3-434d-b3b4-9ca1f7d560c0", "comment": "Malware payload (AsyncRAT)", "value": "16686f1e7563cc54a0d047a1033456f84d918f6f93f0bbca7cb440925f1eeb54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353728, "uuid": "8414406d-79aa-460f-97f8-94c72b59fb26", "comment": "Malware payload (AsyncRAT)", "value": "1b993f554960286e90cfd7cedf4c457e1c46ff80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353728, "uuid": "7b20019e-2e8b-4905-a06a-f25239549740", "comment": "Malware payload (AsyncRAT)", "value": "b133b4135a699d948754d1a919764e8e5eb13daaab440399e3212580f04d0f015466a6ca9348b38111fcec294508d8b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353728, "uuid": "3bf871a8-8279-4be6-9b72-4cd59e701d59", "value": "T1087349013BD98D35F2AE4BB9ACF2510546F5E6972016CA5E3CC400DE5B67BC68A036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353728, "uuid": "9d30eeb4-7e6f-4076-bca9-46ee44f75a13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353728, "uuid": "1a458d18-3c57-483a-ac19-4f2d0f53c332", "value": "1536:XXkUaUdXCfRPMRkGWsrT/NGH1ba/KOjybwokzkHLVclN:XUUTNWPMRkGUH1baP+tkWBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353728, "uuid": "526d3a61-5ee0-4212-80d1-39f7a943b675", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353728, "uuid": "ed7e8548-e081-46d8-b048-01538ba9b17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353728, "uuid": "d402d00a-0dd9-4437-8f93-92dcef3528d1", "value": "a7d63348cfe9b0dc9d3aaec28c76c8f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783aebf1-fce3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713376439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376439, "uuid": "6fe7df39-c882-44d1-b370-fa444e301f47", "comment": "Malware payload (Mirai)", "value": "ddaafbae4ef3fd5544163cfe881b2b04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376439, "uuid": "90b22105-3fc3-489d-8a11-9f78864c0ebf", "comment": "Malware payload (Mirai)", "value": "17b16e2cf10a095b439fc4c27f124ba6eacd4b86bfaed176d1d727bcbcfed1f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376439, "uuid": "360a861c-9d95-45d3-ba7d-222dc714da43", "comment": "Malware payload (Mirai)", "value": "41021b07649cd3bbd997314ced8556a3be56c19a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376439, "uuid": "87246aa3-7c99-41d2-8323-eb7ccb7f0e93", "comment": "Malware payload (Mirai)", "value": "1318c3f5ab02c239360f72abbbc1f2bf8a658acce926f756ccc6fbf72fb0b508074f60459dfb20611d63d80e2d4bf398", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376439, "uuid": "cfff47f5-f8d2-438b-a90c-29f5f2a62a34", "value": "T1E614A71E6E228F7DF669873047B74E209B5922D617E1D680E2ACC5105F2439E681FFBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376439, "uuid": "e9094400-4688-47eb-ab88-04e754c6d18e", "value": "3072:sseHi0ePtYmWNg3DEiu0R0sjAym3N6aDB:sseHiLXM53NHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713376439, "uuid": "84b4646f-8db8-4180-833e-e0aa4e5140ac", "value": 193792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713376439, "uuid": "f1f12b42-8028-4d00-a46c-69f28677c872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376439, "uuid": "52dcb6f8-035e-4789-8a48-0374df0040ce", "value": "ddaafbae4ef3fd5544163cfe881b2b04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f20e467-fc84-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713335622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335622, "uuid": "ff4f504f-9c5c-441c-90ec-6bb886b06d5b", "comment": "Malware payload (AgentTesla)", "value": "b5006f1dac678c6e6a2c698704e49ad4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335622, "uuid": "7df1a7aa-39d7-438e-ac95-072531dcc77b", "comment": "Malware payload (AgentTesla)", "value": "17ffcd130215ae5b3f8ba4f4aa5577abdf7c44a0c2e70619c35e42bafbbb3a82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335622, "uuid": "eda8e8a2-51e4-4fcf-be4e-2efddb2b0ec4", "comment": "Malware payload (AgentTesla)", "value": "2ad2b936da60e85c1dc26b6281ad8380393b0fcb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335622, "uuid": "450dac09-b1ec-4247-b73d-e87d07761b73", "comment": "Malware payload (AgentTesla)", "value": "1c1cd3f00ff83081f1f9c37abfdf728652629987ea5612d21f4a427c89dc845f2582f8aa3b5de58b4c75cbe682a3f24b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335622, "uuid": "f8b4e39b-99bb-4304-922d-bd364df61bf5", "value": "T1D0E4121CEFB8AE1BC2D857B9F5722924433789498017FB0F1FE954D90E62B82D45AC87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335622, "uuid": "000cefe9-115c-4bc8-b7cf-66d05772615c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335622, "uuid": "d6fdb5d5-72b3-4167-bd0d-b334ea2b1837", "value": "12288:G/fWTAkMq3EAppRG1/D02YbItl1rr6NPcCCZ7VB2iGI881CEt2UXS+ucb:UmAAEQg3v6NPm7VEIlp2Ui+ucb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713335622, "uuid": "8e0224cd-b8c8-4e04-9727-5bbe152d71e2", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713335622, "uuid": "d680284a-8fde-4350-815a-79f515623bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335622, "uuid": "33f1576a-8806-4e7a-84c9-4665bc1acc65", "value": "tmjGCGOEGMinVPD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085535ae-fc6c-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713325142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713325142, "uuid": "b7e3a05f-c038-49e1-9601-a5eb4a315133", "comment": "Malware payload (DCRat)", "value": "9c31acafcb357ff41c9bc9be104397c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713325142, "uuid": "e41253f5-d415-4ce6-b17d-a18bea802ed0", "comment": "Malware payload (DCRat)", "value": "182a6cf870ad9d09e72bc36669dbd55306e964c11b7c63ebccd5406ae8e8556d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713325142, "uuid": "b67ae5f8-177f-4d11-be2e-79727c059c66", "comment": "Malware payload (DCRat)", "value": "8be5933f6f72c0d4723ac3ff5501cbd17bf499c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713325142, "uuid": "b27f10da-e92b-41cd-90f4-4f16a408ca43", "comment": "Malware payload (DCRat)", "value": "8d7b1e8e58ccdd52799a20349cf677ff941872eb1dfba7d3bf19b7a612a1d0b1858571e8a9ab3c462de83ea52eab6350", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713325142, "uuid": "1ba2c15e-ff27-476a-a6ba-3a743fba3a81", "value": "T1ED16F11B6A815E77C3640B718A57403D66A4D7753A62EF1B360F6097A903BF0CB322B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713325142, "uuid": "0bf125f6-4dc6-4378-82c4-c516202ee297", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713325142, "uuid": "3627e1e5-f071-44de-8f36-a6838e61f4e5", "value": "98304:ypDF7RaItzPWlbVMQDWFdCEbqNixjnCc630pW0EpmEOQL6r1:IDF7RaItzckCVixT9pSmEO06r1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713325142, "uuid": "030e3b13-88ea-4648-845c-3ec6a5bd5c02", "value": 4172107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713325142, "uuid": "fd6c7916-8b9b-4104-b62d-78811bebb85d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713325142, "uuid": "9e9cb995-2027-40a5-82fe-641639160b2c", "value": "9c31acafcb357ff41c9bc9be104397c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b859a964-fcb7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713357649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357649, "uuid": "6dd77c40-38a4-45e1-9616-3530d90a473e", "comment": "Malware payload", "value": "8488d00594b75e85e7a82f5969b650c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357649, "uuid": "9d90a91e-920c-4efd-b2cf-5c0a6daa815b", "comment": "Malware payload", "value": "18abdc686109206856db83540eec9fc42ca839529a32e274dd8858d068b4da5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357649, "uuid": "d122f42e-0819-4599-805f-ce805dd16df5", "comment": "Malware payload", "value": "70a13ed6b2ef53cb7ba0e2d4d6018400594f3000", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357649, "uuid": "ffebac6c-d316-46d2-99eb-34e507e0494b", "comment": "Malware payload", "value": "0b0f3d540f7dd4cc325e6f4ca4c2f3dc18bc44d25e10b3cab290acfa39e804a47effe25ffc9bde07f4398acc31b4d2a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357649, "uuid": "1ee06105-71f1-4cb1-8665-bc380f169e64", "value": "T1DAF5810BA6F8C118F5B2A630DAB582F615777E40E738D58F528F3C5D3579A30AA20763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357649, "uuid": "51d262e3-2bb4-495d-a091-3c7c19c31948", "value": "0c124e8ac1245068488198549d484b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357649, "uuid": "cdff5bad-14a8-428c-b04f-cd54155d3a50", "value": "49152:u3/0e6aTrHGw0g83XXoTg18CuDHwb0X3nOM+Fh8hc:ze6hgdHQS+Ma8hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713357649, "uuid": "8e7f7ead-dc2c-4eb9-9423-3a0759fa48b3", "value": 3467391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713357649, "uuid": "042b2ea7-dec7-4e94-b6cf-21042f603cc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357649, "uuid": "6571a332-093c-460f-a156-8d2e17480f8f", "value": "SecuriteInfo.com.FileRepMalware.1008.15763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea4c3a1-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361472, "uuid": "3a55cf2b-ed6e-487a-982e-a3346fe53b75", "comment": "Malware payload", "value": "eef9e9754fa04ef1cca5bf358c03aa5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361472, "uuid": "a595a1fa-8c20-4e0e-bf18-89929665391d", "comment": "Malware payload", "value": "19bd36ca997b9913498cebfb9188f3b8ce0fa5647695f7a1dec62f1f7098f1c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361472, "uuid": "57dc461a-025a-4862-b512-b076077034b0", "comment": "Malware payload", "value": "b9339cb65c4d3add5fc35451962f268f8db4eebc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361472, "uuid": "b449f0d6-8201-484b-94a8-6765ab2c5b4f", "comment": "Malware payload", "value": "94a32f4de3cfdebc75fbaee9ade3ff9c6556871877a4a5aa0643795df4dbf83ef36d7932fe1191ed3f19d8f0f31be8fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361472, "uuid": "3befb20d-78be-4d40-bfa7-12fb9606ace5", "value": "T1EE560902AEC26F66C5CC037485FE979672507E085B951B2313A8EBA8397773DEF4684C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361472, "uuid": "350ba754-baf4-4805-8522-5c8836851ba6", "value": "98304:Z9mVusEEQ4kVIb0IamIIkmrIGDeII8jOSPoo:bu8VIb0IamIIkmrIGDeII8Hoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361472, "uuid": "e47e5d14-9738-422f-a85e-47db7488659d", "value": 5963776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361472, "uuid": "8c7c3876-89dc-4397-8a31-b5bbcf297490", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361472, "uuid": "3e39789c-932b-4bf1-9eee-dd3bf9329299", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.24480.23321.14619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1612e3af-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387871, "uuid": "3b4198b5-36f7-4c0e-ac2f-4586c2e5daee", "comment": "Malware payload (Mirai)", "value": "0da42df48a7be5bf214fecc9a1fbeb51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387871, "uuid": "299b81c7-9770-43ee-91fa-f1c1359fa3a2", "comment": "Malware payload (Mirai)", "value": "1a839b2b4269727dbe79fdabab344b96396a03a94404ff9f94d40b8673db396e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387871, "uuid": "cfd1cea2-ee78-44fe-83bb-7d01e662676f", "comment": "Malware payload (Mirai)", "value": "24c740cf9b659f260059090ff401c223936aaff4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387871, "uuid": "04184ab7-5e58-41c3-841c-19f329b785e4", "comment": "Malware payload (Mirai)", "value": "b9c27caae1ad1aaaccfd5e44a7a2dff73afd914aee47872dd9a87f4d1e75e0e667a68632d3159f65d8f32c0081836123", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387871, "uuid": "954655d1-f8f5-4c0e-918b-c505d1e4ae60", "value": "T19573D70E7E228FBDF655C23547B78D15A75833C622E1D682E26CC7111E6028E645FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387871, "uuid": "97bed556-8f5d-4c4d-bf20-c35de532e1b7", "value": "1536:eFtVcVjvV+Wz6TQSPMU3CLdLiO9nGFSBZgFWkeFWA4s:ecVjvV+WzeQSHCLdLiO9nGFSBZgFLA4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387871, "uuid": "0db63e56-9822-4f80-906a-aceed6be4c96", "value": 77448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387871, "uuid": "a38d028a-cdda-486e-8605-a34afeb9a126", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387871, "uuid": "ee0b1206-47e2-4ff1-bbf1-e9387d338a05", "value": "0da42df48a7be5bf214fecc9a1fbeb51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa450358-fcd5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713370510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370510, "uuid": "b9f58816-6bbc-4a77-9520-10933146e554", "comment": "Malware payload", "value": "177a73014d3c3455d71d645c1bf32a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharpilRAT", "colour": "#8FDB36", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370510, "uuid": "7f6510f4-48c9-42de-bd6f-93a3c7b6b2a3", "comment": "Malware payload", "value": "1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharpilRAT", "colour": "#8FDB36", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370510, "uuid": "29b5cc66-6c83-482f-97c1-0f2643877ca2", "comment": "Malware payload", "value": "84e6709bb58fd671bbd8b37df897d1e60d570aec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharpilRAT", "colour": "#8FDB36", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370510, "uuid": "d41d830c-a7ab-483e-9067-601df4cd950c", "comment": "Malware payload", "value": "f8ef6dc3c9cf327ae160b98a066dfd671b4a83eff746403336105fdfa4efd9db3763ef0aaf65bb5321638e5c4a6f2ae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SharpilRAT", "colour": "#8FDB36", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370510, "uuid": "fb96ac76-74d7-441c-a061-e0402b2a95d3", "value": "T144D2090237EC4229F5FE5EBDD87E0160827576476531DE8C2CE920CE4566BA46BC3FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370510, "uuid": "bd59f666-e1d2-4343-8a72-97a3bca5d0f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370510, "uuid": "c20bd938-f74c-4325-8bb0-d79bb2bac092", "value": "384:W5fEsTNGE5hqRl+IUU7t1LTzVndRt2Jab8J0wQZP7WIkdeIQVO0a0RPBhbAv5so0:oxa9JTBdRPbxlqsPL5+4HMvF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713370510, "uuid": "daed6c97-f7e3-499c-bb1a-598ef7aea67e", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713370510, "uuid": "4a9aca3a-85f3-4f6b-8226-254231d3967f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370510, "uuid": "4e08fd7c-1f70-471e-8758-c128e7c268bb", "value": "SHARPIL RAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5380e050-fc84-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713335576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335576, "uuid": "93e0eb8d-d4b0-4248-8157-27bdae464168", "comment": "Malware payload (Formbook)", "value": "bc4a2654f02581650b480ea7a7a71636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335576, "uuid": "f2a91176-10ee-444d-8a54-2737e8c434c0", "comment": "Malware payload (Formbook)", "value": "1ae50c991cca2f66d01362a83c1e26d3c6f114e5d5db884a0061d8dba81092f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335576, "uuid": "d9ee6035-35b6-4284-a3d3-45793e0ce2db", "comment": "Malware payload (Formbook)", "value": "5f0f9290d5f6dd8d40ee3fb385eb4e5c92dacd78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335576, "uuid": "6d925515-91af-4c53-bd3e-72cb6e15866e", "comment": "Malware payload (Formbook)", "value": "c8f96fb7c95297a1aa4aa718439ca1bcc401a4c9f50be3ec70a346e8e6beb9d57037a0eb96bacf8aa2a99e34784d010e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335576, "uuid": "293a3c96-9757-4f7e-a88d-5b88ef19ff4a", "value": "T1C235BF0273C19062FFAB95334F9AF6115BBC6A260123E51F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335576, "uuid": "139e0f12-efcc-4781-96bd-6d830094e691", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335576, "uuid": "d2da493b-dad2-4205-b4be-1b4816a61195", "value": "24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8a3vyGrX:ZTvC/MTQYxsWR7a3vyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713335576, "uuid": "ed947420-a5c9-422b-9975-e6ac2bbf6bb7", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713335576, "uuid": "9baff05a-521b-4cd0-843b-3285f5e6d9d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335576, "uuid": "31e73aa9-4774-424c-816f-e8985ab10127", "value": "justificante - 2024-04-16T133815.900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f27ad57-fc96-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713343192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343192, "uuid": "f635d9f3-d542-4214-abca-89789742e644", "comment": "Malware payload (AgentTesla)", "value": "97074aee274ee163b4c2be47a499f254", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343192, "uuid": "43db61f1-9313-401d-bf91-e828debf7632", "comment": "Malware payload (AgentTesla)", "value": "1ae8a3ae1d718efbce087f5070991594b0ceb6e3ba53f154742aebc1577adaae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343192, "uuid": "23b66139-250a-43ae-ac5f-ae2110df9388", "comment": "Malware payload (AgentTesla)", "value": "23f468f1d926d6d11ae2730e4cfeb8ddd2fe9df5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343192, "uuid": "34c6e2ea-71f7-4e74-a040-52c700d40695", "comment": "Malware payload (AgentTesla)", "value": "0b5d4f2e0e3f4c34fa1d0df030c2884d6639757736d790e7d05c68c10e74c1ab824cabd468fe8a9b70d5356564e6d2eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343192, "uuid": "7aba7c7d-a80f-4908-81e6-cf00534f5d91", "value": "T15AE423B74096839C51E67C1FE8343FBDC2AD6E8DC9FC971086B767909602A21B573A13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343192, "uuid": "5554a19f-e036-4cdd-9164-edd1873aecc0", "value": "6144:WgoW2/U63e3X0fcIf6NlXFh2ctQWkdxrOYX+gA5q2ao2ngAaP7zo9+V4lpjRlbm5:PcVcIU2eQbe3PBezXyTIkPsnYyhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713343192, "uuid": "1074912b-3760-420e-a1e2-66e3f0c0b9cc", "value": 697827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713343192, "uuid": "12acfebd-83bf-4e54-97d9-818fa3f3fbcc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343192, "uuid": "c051312f-ac99-446c-a6c7-ca144bf7b5d1", "value": "ReInquiry Lenght Error.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e42aa35-fcbc-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713359646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359646, "uuid": "57fc71f8-9623-4dda-8ce1-14fc2a4e0379", "comment": "Malware payload (GuLoader)", "value": "a1369541890d9ce089123c0c9dcadd2a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359646, "uuid": "2bf0e59e-5e82-4c9c-818a-e1eeea028fb2", "comment": "Malware payload (GuLoader)", "value": "1c3db7d3d072707e609209a6e1bf54b830a0db37145d088a28894c0458564595", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359646, "uuid": "b8d6e280-77a6-4f2d-8245-9659c08be2bf", "comment": "Malware payload (GuLoader)", "value": "b0fe01cb16cebb85a997d84240dc60a3e7a0beb9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359646, "uuid": "97b92b3a-f9b7-4096-b8a5-6b7dbf6ad19d", "comment": "Malware payload (GuLoader)", "value": "03a93ffcdd07542625430d2736521094049ec9b461c1cb8b21600162549b996af3a03ce2319b94b92d95f6eab2399da3", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359646, "uuid": "ac2be9f3-2f2e-4699-ba9d-fe72d3dbd107", "value": "T1B4443AA0CE892238CE071BFAFC550561C9FD8169462610BDFACD275D6343A6CE3FE619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359646, "uuid": "e4c1dab9-7f29-4713-8880-2113d6a5835d", "value": "6144:GrR8ccABOwbDA2zJETxVu1vH/rsqfXB2moC:Ocyoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359646, "uuid": "198dda87-c428-4a78-9f38-0dd5c8a2bfac", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359646, "uuid": "e2e91ce5-a338-4ddc-91ca-361329588add", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359646, "uuid": "88b73070-6100-4fd0-9880-cc49444a41ac", "value": "Carlispa_Ordine_00401702400417.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfcc434-fd11-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713396340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396340, "uuid": "c721c308-6829-4cf8-9240-78b6a3d3da51", "comment": "Malware payload (Mirai)", "value": "750981f0c5439cb0d07a766ac7073a71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396340, "uuid": "b4f032f3-11f6-4154-9c8e-0ba81b428d49", "comment": "Malware payload (Mirai)", "value": "1c949eb8ef7d074f0dd5fcb3806c5ae4c3150c8fef5910dec67a12e04de964b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396340, "uuid": "a241b9b8-de76-488f-8973-d8f237d518a5", "comment": "Malware payload (Mirai)", "value": "a7ba66e7c908d84a3b9b44b91e3af33042832a64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396340, "uuid": "825d36c1-7746-4686-adc5-770076a2397a", "comment": "Malware payload (Mirai)", "value": "eaf2491960b3ffeaec2c2b9e91d66ca0a79024efcf12e9dcc46470695688d8641caea1460cf8bc9929013e83fa47a539", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396340, "uuid": "c554f281-fdc3-4237-8e66-b2dac14f9504", "value": "T166C3087394649EB2C041A9F125FA8D710F236D930B6B0A94623D77F04A7F5CEB48AF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396340, "uuid": "0af4cfc9-2027-4493-81cb-98b8183997d9", "value": "3072:X0Y1SpZ1XznZ4NrxXGIa5hBvmrLzZYerNu:X0gSpolahJmrLzZYerNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713396340, "uuid": "7e455951-df79-440c-982f-65aa6074beb2", "value": 122392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713396340, "uuid": "89a38364-5790-4ed7-b80b-8398c719a42f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396340, "uuid": "6bf9b368-eb72-4421-80e0-71f09c9f11c0", "value": "750981f0c5439cb0d07a766ac7073a71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1fafec7-fca7-11ee-a120-42010a9c002e", "comment": "Malware payload (AZORult)", "timestamp": 1713350740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350740, "uuid": "f8f0a8b8-3d64-4739-9d69-11fe25b8d997", "comment": "Malware payload (AZORult)", "value": "ab92ac92a5660397fd2bb0bf54e405e7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350740, "uuid": "98809562-7d1d-40c7-9b29-e617c1b9557c", "comment": "Malware payload (AZORult)", "value": "1d04af45a5f23bbffbe5fa0af2683234c2f70c234baf75cdf53f232523490b2b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350740, "uuid": "6499402b-a87d-41a0-b19c-85b8fc26aab0", "comment": "Malware payload (AZORult)", "value": "71696c57e08d2611547820602f466088d7999119", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350740, "uuid": "2be395a6-ac5e-4e54-a586-6ffeddc36996", "comment": "Malware payload (AZORult)", "value": "61e8eb24fccd2b16238ab0f2b9bfeacf4a1e56ee8490fcc96f3147e1da1773a368964de6ec1d8176425538f5cbc17183", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350740, "uuid": "b8a7f5eb-fa72-4860-b1d8-05d31d21cc11", "value": "T1C9C41287F022679EF8BE83BB79C6091657F161661843E7040DB13FD4BE65B805BC8A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350740, "uuid": "9040246e-c4fd-4679-bf02-5f786eeb13a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350740, "uuid": "91df6b80-b02d-425b-b267-6400345dc160", "value": "12288:vlOATP7Umq9adG75huKA6QMy1dHswGSoKluxdXXxd1672cWjoIC:sAD7Lq97ju96VUHT0KluxBD4rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713350740, "uuid": "a6ccc3f6-eac7-4d3c-8f57-0cc66e3be4b0", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713350740, "uuid": "fa1ebcba-f0c1-4e78-a3fd-49c3079031c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350740, "uuid": "e0fee37a-b35d-47eb-8108-fb151b972c71", "value": "PO#KOG21-PILOT18-WLM20 and PO#MIC06-M IN F 06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb75f22-fcd5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713370622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370622, "uuid": "db8e9aea-50a3-40be-837a-9044e8c4f780", "comment": "Malware payload", "value": "5de91467a03140948dcbca0b627f42d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370622, "uuid": "d1bd2a35-c39d-46f6-a206-969f55a8b603", "comment": "Malware payload", "value": "1d6f76acecff63fb373b5774a3cb34b87266a4a4bbb8e3a0757d107187d280ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370622, "uuid": "37cfa6fd-7a9d-4638-ab1d-b34c8920c043", "comment": "Malware payload", "value": "b6766dffb5257f0007fcca00f14ff932bd60ef69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370622, "uuid": "07b95d05-038c-4859-8f85-72294044012c", "comment": "Malware payload", "value": "2066769a4088f4c4278add8ad294a5c1a4712b3bf49f3dd891916ca3ae524da97764024857beec0387c52b1c678121a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370622, "uuid": "54762eb9-f310-46d3-9546-c2bf011daa48", "value": "T1F7E36B47B3F50177E0A7823488935655D7F278411B209BAF03A4835A6F737D9AE3AB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370622, "uuid": "20bb0dc3-662f-49df-847b-0b6e5763296e", "value": "f36567aa27bb971fb945309de8037ee5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370622, "uuid": "612499e7-cf45-4440-8826-4f22f8b344a0", "value": "3072:w3/HUI6sNus15py8qLlCat4HVOtzNNG0vBxN049K7lH:w3H6sNuUzy8qLJ4VqNm49Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713370622, "uuid": "2862547f-8628-48c5-89fe-deb9c3197e29", "value": 148824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713370622, "uuid": "72ac2be2-1396-4117-b6a7-2ca9e3a1529f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370622, "uuid": "83aae309-5488-42c3-beb6-3827798ff1d5", "value": "mimeTools.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a924fc08-fcb4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713356335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713356335, "uuid": "ed3b1da7-7718-4d95-ad4b-b6d9b48b7028", "comment": "Malware payload (AgentTesla)", "value": "614a012c8c69e306fdb79a9425db0947", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713356335, "uuid": "73d95ca9-3268-4680-85be-15931f146f86", "comment": "Malware payload (AgentTesla)", "value": "1f50d3df24794f2bd24ef1c3d5ae6d9aa149aba042733dc03b78ad32a266579e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713356335, "uuid": "a606d9b3-3ad5-41e3-b3bc-885f1467ed52", "comment": "Malware payload (AgentTesla)", "value": "5d177417714e21338e3b5ce5c05acb3e3ce1646b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713356335, "uuid": "074d06a6-0d64-4e5b-9a9e-591d19432452", "comment": "Malware payload (AgentTesla)", "value": "e64264730844e6067ec1538dbb5d9bc1759e37f1856593cfc354d699156de469a49c5f80a2967fa267915d5b311d66e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713356335, "uuid": "db65da9c-6c92-423e-9a7f-754f203b92b5", "value": "T1094302EA33271999DE6DEEF8E01B205388A41BD43C45CE21FB5DD4FD4CD2A6E5301A68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713356335, "uuid": "4e6528e7-8a43-4ef6-9c30-a5949f451edb", "value": "1536:PlCAEXBSr7SqA+wjsI6rkVjykl+CIyJzUN:PxFO4NIVjyBgUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713356335, "uuid": "0cd3dd6d-22f1-4044-ac92-3edb0a4fab71", "value": 60152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713356335, "uuid": "816739cf-ba2e-4f9f-8529-6484adf6307b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713356335, "uuid": "a6996ea7-3534-4f60-bf79-2118ab6dd292", "value": "614a012c8c69e306fdb79a9425db0947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efb3d88-fc4d-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713312026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713312026, "uuid": "a13c00ea-5db3-4857-9737-9499297321db", "comment": "Malware payload (DCRat)", "value": "49267a1e4c9cbb955209690e1d82d1d1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713312026, "uuid": "f4170bcd-a44a-4734-9740-aabd02499e30", "comment": "Malware payload (DCRat)", "value": "1fbcb895a6e34fb2a307c0c9896b7922ea723e5eea183fa319c0142c5a761fdf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713312026, "uuid": "1f240756-4d56-4ccc-a315-6b0c13a84ec9", "comment": "Malware payload (DCRat)", "value": "47fb7d48398a2049f84c4a68c96ea5ac27513cbe", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713312026, "uuid": "009576f4-49ef-44ab-8d7d-255a7e6f7c22", "comment": "Malware payload (DCRat)", "value": "2997b033704946b2b3d8c8a364e60057a1a3aa7e2f050f6bbac687e538aad6c410a3f7d3570f2e85d2979a335e8d2ae1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713312026, "uuid": "aae38177-cb02-4cb9-b7f6-53d773515ea3", "value": "T1694531342EEA502AF173AF7D8AE47596DA5EBBA33707985D00B103C60723A42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713312026, "uuid": "16951901-6bdc-4c2b-a8c3-9cea45bda344", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713312026, "uuid": "ddf90962-1273-48a4-964a-bfa47b5fa5dd", "value": "24576:1R28aergLxCcjZGKCKFuTBHNWdd2HAxWnUDTJ/yS3Rh:7JaDKf4p4UD1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713312026, "uuid": "afd65905-b49d-4a04-98c6-51db82ce22ea", "value": 1261056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713312026, "uuid": "f2cefe26-f916-4def-941a-3decc1277772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713312026, "uuid": "e1953994-ab62-4894-9da4-7059e42cc2f5", "value": "49267a1e4c9cbb955209690e1d82d1d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6759ff2-fc64-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713322078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713322078, "uuid": "2577e1a8-b2f5-4ea7-9123-efb175196fac", "comment": "Malware payload", "value": "7f4b9d9122a6706404ccfb99742c6dbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713322078, "uuid": "275644cc-3fc7-46ec-8161-13ab63a7f302", "comment": "Malware payload", "value": "1fbd03ff0cd123658ad3c1d5b40e291b815b0b940e163ee6b31b2fce2a44d34b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713322078, "uuid": "17cd38f6-bb08-4e3c-8150-c2c44cd5cbde", "comment": "Malware payload", "value": "d8c35d50e6b8736f3ea3d058c5d99263cf8e528f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713322078, "uuid": "535bc75d-406b-4242-bc34-c9479435f41e", "comment": "Malware payload", "value": "058946076e89d4a1d9f5ef856e1997c73b831dd2a99befa4525d8996917c4866dbe0ef2c518987504ba03fd1837fed2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713322078, "uuid": "6ae40eed-aa9f-469f-ad76-545241836b4e", "value": "T15B052308FA485727FAE286701C30769EB9FE1D76B744EF8B03B62B1D38935CC948A515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713322078, "uuid": "734cff0a-53d8-4191-8bf1-e6cf44dc9d1d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713322078, "uuid": "7e9f7ab5-6311-4f83-8181-7a87da94acff", "value": "24576:RbZgC38RIRjCEK8RmqAgUDdCTsa6bSxNCLBnlW:JZZsRIFdtVpdUZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713322078, "uuid": "165b12ac-4cdf-4f55-bf47-5ba37041ff67", "value": 859696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713322078, "uuid": "c666e2f2-53c5-45e4-89d3-578a22bce2db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713322078, "uuid": "8773eb1d-f4e1-4e6c-a9ef-0b3df48f81e8", "value": "7f4b9d9122a6706404ccfb99742c6dbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa1160f-fc9f-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713347139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713347139, "uuid": "cca7e679-5a6c-4bed-89e7-61187433c97d", "comment": "Malware payload (Stealc)", "value": "797a233c96daa9c86d9035ec023258f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713347139, "uuid": "9a4685e2-ffcd-4d94-abf0-8adf869030f6", "comment": "Malware payload (Stealc)", "value": "1fc72c18b636e240637025cb7bf63a10c06d748f0638d17b3746d6ec3ffeac23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713347139, "uuid": "4bb82f2e-d5de-41ab-a5df-b356e494f268", "comment": "Malware payload (Stealc)", "value": "dc7004f0a25abbb8d3e1cb32ca4e4cc743655c7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713347139, "uuid": "30692052-9c9f-48bf-b216-e1e641d200bb", "comment": "Malware payload (Stealc)", "value": "53bdd35298b2e59e177cb94eb709712fb54e1894d97456e6f8217cc5280add648b1ea371206696148bcdcf3402f596cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713347139, "uuid": "7a3ae478-233a-4c18-97dc-810e99e667e1", "value": "T16D647C0272D0A872F53347724F69D6E4763EFD618F556F6B23486E2F09B00A1E622772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713347139, "uuid": "ec000b62-e6f8-4240-b271-f6ac7a0c8f00", "value": "17ccf166284947c6d6cbcd86ca514021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713347139, "uuid": "9b42728c-9cc0-46cc-82ad-b32c850856bf", "value": "3072:MmhodyTiEb28g2o3pTg/P9LQK5+XPbbKw1XXN8HSKCmnTTpv07A+3ov96RWUrqbI:eydi82g3RQK56ThXN8TO41+wFEIaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713347139, "uuid": "02d5e9d1-4609-4939-ab5f-c6a966d074e7", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713347139, "uuid": "320c5bff-32fa-4df9-b74c-b95635abbbab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713347139, "uuid": "1b1aee7f-f53f-4819-88a3-de8818ca313d", "value": "797a233c96daa9c86d9035ec023258f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e67441-fc9d-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713346213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346213, "uuid": "686a962b-a76d-4213-b186-a77bf15347ea", "comment": "Malware payload (AgentTesla)", "value": "c264c1d828113996566a08e0a536b8d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346213, "uuid": "dcbc7d2d-f9c8-4694-b570-a7b790aff0c8", "comment": "Malware payload (AgentTesla)", "value": "20524ab9c6ee331864f6451f2b8f24d7fd321f5ba656ea4079deacdd51702891", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346213, "uuid": "bc69436a-4b5b-44b1-abb6-89a62b6c6730", "comment": "Malware payload (AgentTesla)", "value": "b000e2099458692fcfc34e71a681c5f841a73ed9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346213, "uuid": "d4e66f84-3c92-450e-bc34-cf6a501422dc", "comment": "Malware payload (AgentTesla)", "value": "f6cffabe442c685de2c2b8696c84e5e4925d5e29b7eab042dda49de72aaa8590d9a83d52f9c0fdd0fa789ed740afe305", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346213, "uuid": "4bedb009-0978-4e68-8b29-12528281dad3", "value": "T18CE423422279E727E42CABF1C11248127776E32B1660EBAC1DC16AFA657CF00D1F761B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346213, "uuid": "d7208be7-e922-4732-bb48-dbeb333c48c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346213, "uuid": "85232ffd-9533-402f-a64a-b1abd578bee1", "value": "12288:ryrvmwjcq1Ux8AqR3FC3iRLCCle5UjhjDdV++are20ZUrB92cWjoI:e+JQUx8AqR3FCSEojg0ZUF9rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713346213, "uuid": "ca5d8c69-33be-408b-a1fe-eaff540e0405", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713346213, "uuid": "574fba73-a76a-44e2-bd93-92a613e36320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346213, "uuid": "1ebc0fc0-de24-4e33-9a02-814c841d0547", "value": "P..O PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e9a213-fd13-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713397073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713397073, "uuid": "c24264e0-d460-4bed-b70f-e0d07fba38ce", "comment": "Malware payload", "value": "80c97cfbc49ce4c6f39493ab42edb7aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713397073, "uuid": "81185923-394b-403d-9324-e033f1a0287b", "comment": "Malware payload", "value": "232be72fe20e9d89ac11dddc9ff262fe283044e37ad9abd2a076b784a8e8fa4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713397073, "uuid": "9e24206d-6edb-4fc6-b3fe-17e63846949d", "comment": "Malware payload", "value": "8974e0027f4002b916d771c7a440a207e7c9c102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713397073, "uuid": "4fc241b4-4d8c-4e0e-a45c-16749784f9ae", "comment": "Malware payload", "value": "46f80811e20c2e0a474f0275da6e876d21aeb83dab85ea2ac816ef0fc5ad12d2bde6ffed9ae52e3ef8eff626a18e27a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713397073, "uuid": "cb32f134-9fa8-406d-9fcd-49ff402d8c69", "value": "T10F322C04EFEC4627E5A7137CC99752C11B3DBA7B6603FB1FAA8C60961C8138456937B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713397073, "uuid": "c914096a-574e-4869-9ba7-983bcec34e6d", "value": "192:s9G4Jor9ckjb6BmdOsIJqQmhZ6R5V8mfLmRWWbnC3LgzgF1X:p5r9ckjOSOsIgv6R/oFYgzgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713397073, "uuid": "8d28a477-5e06-45f2-89f5-8f6df2d6de7b", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713397073, "uuid": "bec8d591-87ab-459a-a9b7-3e3d603d691a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713397073, "uuid": "7fc0bfbc-c30d-441e-bad8-ac560db3b034", "value": "SecuriteInfo.com.Win64.PWSX-gen.24833.2705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e920f09-fca8-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713350976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350976, "uuid": "3c83a7b7-ae1b-46bc-be89-a723e2747f59", "comment": "Malware payload (Mirai)", "value": "533f3582d72f9e2e50ca7d54855a9472", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350976, "uuid": "9efc7eaa-d0fe-4e96-a42d-80f4210f2e0d", "comment": "Malware payload (Mirai)", "value": "2634832054feaa61ffea29d1c2327d17f06e54551eafe772c68141fe4e80fc3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350976, "uuid": "503cbde6-bb44-45b6-b984-6bd9627db470", "comment": "Malware payload (Mirai)", "value": "1ff738aacbea28b2869e82b000ca6f224c3b4156", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350976, "uuid": "0a6828aa-4a4e-4ddf-8d60-5ec473fa2018", "comment": "Malware payload (Mirai)", "value": "1920879a6d9b9d8109f996e0b550987fb3979bc9aaabe5e62d23ba380684e4ba04363569067c81b36c08628944cb962b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350976, "uuid": "ff66b8f8-ab6a-4d56-a9c6-82f96d46f23b", "value": "T1A5042A45EA404B13C0D627B5FADF42453333AB9497EB73069528ABF43F8679E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350976, "uuid": "f4936789-2074-436e-b453-9d1f519fc5be", "value": "3072:jr/dsfezlTERakAajYFyisk5ybXCUBpI4/hJjogM/RIyOGd:jr/vlT89AajYFybkAZB+4/XMgM/RIyOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713350976, "uuid": "5635e230-b623-4ef9-a0cb-9bd32df0e338", "value": 179813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713350976, "uuid": "64f60cdb-f27e-4f9d-b7a0-4089cfd44d0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350976, "uuid": "efdd7ced-c88c-421e-aa2c-2b3726f99275", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5771ea-fce4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713376720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376720, "uuid": "d6fec05a-bc5a-4abc-b7d1-e7fdd38b5a84", "comment": "Malware payload (Mirai)", "value": "0411f871bf21b6ade17ba08587cb34eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376720, "uuid": "7c8377de-eaca-46c9-9f9f-6ee3eeb4c7ed", "comment": "Malware payload (Mirai)", "value": "26962129678fbfb93f2941314caeb842e24ff9f28d182e2cbb5669c535de5a0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376720, "uuid": "a7593d40-b7af-4e41-8f86-d089770d6e6b", "comment": "Malware payload (Mirai)", "value": "b0e8c42c309eb506422bf3c8bafff33c8a25c1e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376720, "uuid": "78bf0614-d78f-4adc-836b-b4a2f75be89d", "comment": "Malware payload (Mirai)", "value": "ac3414135911646569f82cf60ac1771e2a279ea52e96f799291dec602f4c03450b4a5cc358a7f4c36e2048aa08afbf9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376720, "uuid": "5002cc7e-ad99-463f-80d7-33c7bc827ecd", "value": "T18FE3182277B60A27C0E4A579B1F75733B2B947CA14ACC60B3EA10D8D6FA95503117BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376720, "uuid": "84daf8bf-7c22-4052-a223-1f5aa2b965c8", "value": "1536:GbrvO3QIAKZvZJOEPKyVfEaTcERF/29g8ytzTsTH+wbRXLstYmw8yqGyocjzybVO:V9xzXGuVwz+ezmwrc3ywvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713376720, "uuid": "3cda11bc-13f0-4983-b6db-818e455c1edf", "value": 152520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713376720, "uuid": "fd2ee0a1-0a47-4df5-8b1a-78718bf0a559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376720, "uuid": "85eeb983-0438-4445-9781-514c0869a89e", "value": "0411f871bf21b6ade17ba08587cb34eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800a55ce-fc96-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713343381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343381, "uuid": "9caf4648-d6af-4b96-8970-8cc68e421c95", "comment": "Malware payload", "value": "2bebf05a9607f038f5407248fb075cd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kapeka", "colour": "#D2EB38", "exportable": true, "hide_tag": false }, { "name": "KnuckleTouch", "colour": "#2565EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343381, "uuid": "e0689d4f-1474-4f82-b070-66a6771c7f67", "comment": "Malware payload", "value": "272cfaebf22e0f6a34c0a93b7c9c5b67c725947ba0f17e60ed67dbf6e1602043", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kapeka", "colour": "#D2EB38", "exportable": true, "hide_tag": false }, { "name": "KnuckleTouch", "colour": "#2565EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343381, "uuid": "42da8e86-48d6-4353-b007-473163203630", "comment": "Malware payload", "value": "97e0e161d673925e42cdf04763e7eaa53035338b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kapeka", "colour": "#D2EB38", "exportable": true, "hide_tag": false }, { "name": "KnuckleTouch", "colour": "#2565EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343381, "uuid": "e351cbfd-baec-41f6-a548-313141074af3", "comment": "Malware payload", "value": "030f469682fedeeb5756a0ddcb7099ef999380c8912af42d410cacadfbab2a709d9e452847d4f3fef6bd376e3022c782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kapeka", "colour": "#D2EB38", "exportable": true, "hide_tag": false }, { "name": "KnuckleTouch", "colour": "#2565EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343381, "uuid": "0410ff6e-4462-4c25-845c-0c067d53f0ad", "value": "T167F34A1136EA01B8E13BD27DCBD66A1FE5F774911321A9DF129007A60F276E1E939338", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343381, "uuid": "69153f1b-7c47-477d-ab16-7791c37e51d0", "value": "46527d695d46dffa239ac10f96a234a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343381, "uuid": "911258af-c297-41ea-a293-c9384fb597c0", "value": "3072:QTjEKhix6W/osphXpzzLCZTXJy4Sky8g/TcI/BhQGv1eAgo:RKhix6KogzsT5Uky8gthQYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713343381, "uuid": "625f472e-e016-4fb8-9dc5-5793d743f9a8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713343381, "uuid": "460778af-f261-43c9-927b-0f2d3977e6e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343381, "uuid": "e9f4cf81-7739-42f9-bd05-a6a2940d4d3c", "value": "wslsrv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50db01d-fc72-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1713328062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713328062, "uuid": "1269c6b2-7f2e-4084-b6a7-5f7a100a5d51", "comment": "Malware payload (Amadey)", "value": "11dcd8e017b0e067e922cfb6507a8dde", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713328062, "uuid": "290ba0ac-51a6-47e8-988e-e35889de3d2d", "comment": "Malware payload (Amadey)", "value": "2809ff11620a7793560052c4a9c7f2b520b608f3d32c7722133cbeb60e5e9d70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713328062, "uuid": "c5d2011a-0d28-4afe-8c12-661306f9ccbd", "comment": "Malware payload (Amadey)", "value": "80c4e499c9666401a0f9099482c7fa9debe006d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713328062, "uuid": "85579099-6bcf-43ff-8aa5-a42b898c3619", "comment": "Malware payload (Amadey)", "value": "7c6a4591419b27930a9ae778823adf4763570c3ec2d5586ab0f430f1c32a726885e69d1c86a5200af5ddb6f196e6d8a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713328062, "uuid": "f7123c46-6abe-413b-8339-2a4913b9a1ad", "value": "T19894F121FE90C7F5F52385307D29DEF09AEEB9AE5560914337D5525E0E3C380AA6A332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713328062, "uuid": "31f1977e-aeb5-4a2e-aab9-1677263b05ee", "value": "9d610f0fc62075f620c7e94e08d0d24d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713328062, "uuid": "104a355d-77b5-42b7-a272-67e0ac27340f", "value": "6144:CD9LLLaXO4MxL2D1i3VZUk2IzXd4wFNOC0JaNv8S3+FMgSx3U:CDRnsMSB+3U3IztPjzkS3Bpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713328062, "uuid": "49d89514-ee21-472b-aaf2-d5a9040779ab", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713328062, "uuid": "4ad20922-9252-442b-a63b-449054ba530c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713328062, "uuid": "8f924eb8-557e-41db-802c-83a977b0d4b1", "value": "11dcd8e017b0e067e922cfb6507a8dde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb8465a-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387886, "uuid": "3735aba8-f810-4b01-9faf-676f60dbb43a", "comment": "Malware payload (Mirai)", "value": "d4054f34cd68bfdeaed597ebe9eb226b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387886, "uuid": "c7ec38ea-6617-4bf0-8955-4d15a6a9fb93", "comment": "Malware payload (Mirai)", "value": "28139b1c3cb363b5d592878c641c5e0b3978239a0fab0106b780bd8b9250a2a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387886, "uuid": "ce7a3368-324c-4978-8534-d29aa96da8bf", "comment": "Malware payload (Mirai)", "value": "a5537bc9b2ffb0c1da02cd6db15ddeea2bf3b42b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387886, "uuid": "47e1154d-44a7-4232-abc1-048305d93b9c", "comment": "Malware payload (Mirai)", "value": "a3f88f89f61d52378a2fa7fee1a14894d459d8bdfe6ff13b87753e58251a0c179add3e3fc8c0e6e1d3614c0c6b505bbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387886, "uuid": "3c238d5c-0f64-4a97-af9d-76f53ed560f0", "value": "T152534B9AF901DE7CF80BD2BA44574D0DB970A3D142830B3523ABFEA76D721A51D22F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387886, "uuid": "98679076-4dce-4ac2-9479-d77e4351acf1", "value": "1536:CHj/RpEawVW5f852EO/9Ll8eejXLd6jn5WC6:aj/RqW5um9B8tmn5WC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387886, "uuid": "63031b95-57f5-4ed6-b30b-401813e2e94c", "value": 64216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387886, "uuid": "4758782e-2cb2-4e18-ba2c-ed53f5654a6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387886, "uuid": "089ae2c4-8f01-4476-8c54-936fbec62edc", "value": "d4054f34cd68bfdeaed597ebe9eb226b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf343ae7-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713353795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353795, "uuid": "d10aba25-5ae8-4426-847c-b50063ffe8b4", "comment": "Malware payload", "value": "093f63c9f7105d808f93d7cd6e8128b8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353795, "uuid": "aeedafb7-9741-4110-bab2-6666259becfc", "comment": "Malware payload", "value": "287d2151e65819a0888677c23d5b097a7539fa85bece9261c93b82b9afca901f", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353795, "uuid": "d4403500-a92b-4777-8dd4-cfe84d8c5548", "comment": "Malware payload", "value": "13156861cc744f1075ad7ce956ec5d2608537828", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353795, "uuid": "138879cd-9e18-4afc-a600-0b061b9f40ba", "comment": "Malware payload", "value": "1e856f817b82c301ec8064d03f1b16830c706f6f979cdab3b2a3109097205f51ca14b1e505ebf867d876debd0b163cf5", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353795, "uuid": "8052a359-af62-49fa-b604-6fa24aa46582", "value": "T103D4239AE10205124909FCD1EFF05BD68EAE5A85FC308FFD11B9420AD58B39F9CAD365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353795, "uuid": "987e3bab-171f-449c-be3d-b21940a2d5c7", "value": "12288:UovhC9E9fLtINnmiygHxdwi2m5Z8xRb2phh6xXkaiL3SPEEXqenuAmAhr3:3vGGK1miygjwWevah2XVi7k/6Qu7sr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353795, "uuid": "4ea1e17a-ca28-4287-a7b1-0ba7d3db9662", "value": 647020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353795, "uuid": "eee73bd0-9c20-4edc-a9db-d610932e03ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353795, "uuid": "c11ab7f4-5f35-4c7c-9a8e-004bdf9cd758", "value": "SOA MARCH 2024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83cbf7ed-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361427, "uuid": "c0556820-2275-483d-9c83-9d80f18f44b4", "comment": "Malware payload", "value": "97af9c9e2532264ee07655d2959abb49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361427, "uuid": "cf6edd50-c6bf-4133-b534-5419e150088b", "comment": "Malware payload", "value": "2a129f10f4f94fd605f4afb51f30880f94956c4efa213fe71033afec922efc0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361427, "uuid": "84a15dfd-25f4-47b9-8b2d-327c0528295e", "comment": "Malware payload", "value": "c76c9bbd99a1d7c2cf7bda0e28cf3440610dfb8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361427, "uuid": "23d318fe-bbc5-4034-ae74-7de86428dca1", "comment": "Malware payload", "value": "23e5262d47012162f7b0c376e093074c3bf95fbbc9c559f7ed17fb646d5654a0f704e75f8061e7f5d22ae8debbd2004f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361427, "uuid": "9f35916b-a49b-4848-a652-43758c27db3a", "value": "T137365C80BB0CD139EA5B0A724C738F2063617E46C1E4866B771AF76F05B16E65A0FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361427, "uuid": "7dd7a0ad-44ea-4447-b717-823e0f296e59", "value": "49152:UbfIMWeDTyKn8Nrwtt56e3JLxKYzYR2iLHwOng/KosjiwoNS5bfkf325NV:MgMWeDTyK86t53txKSi21S73kf327", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361427, "uuid": "eeea70e7-56dc-46d7-b641-3525ad8cc454", "value": 5111808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361427, "uuid": "ec2c99e4-f6a5-434d-8e17-fbf9d56973b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361427, "uuid": "a320c7ce-3eb4-442d-a3d4-7842e7949d60", "value": "SecuriteInfo.com.Linux.Kaiji.128.29313.12693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3b653e-fc84-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713335674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335674, "uuid": "ae13d5db-16f0-462e-8609-929590d1c530", "comment": "Malware payload (AgentTesla)", "value": "bbc13924be0c7a3ba79084d630234692", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335674, "uuid": "545d6085-64e0-47f3-998b-08d9cf4d69ec", "comment": "Malware payload (AgentTesla)", "value": "2a1ab3dd3ed3b1bf3d4430f92e5872599c64e5ca5db73d9e8449be9df5953470", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335674, "uuid": "a354ad2e-bac7-4372-bbee-29f63ccae3c0", "comment": "Malware payload (AgentTesla)", "value": "c94f800d87ee60f2c48e7023504d8859dcaa19b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335674, "uuid": "7daf9e39-5ad7-4230-b99f-063a43258f10", "comment": "Malware payload (AgentTesla)", "value": "5e3a3ed4c2e88dbb10d220fde89ee2ced276fbc4dba5acdabd105c696f5d39a7bbe0b3007142c4bc5512468a2c233e88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335674, "uuid": "94067821-6242-4490-882d-f75ec51a442d", "value": "T166358C3263918335FFAB9E73DB5DB20D56BC6D250123842FD29C2F79A9F01B1126D262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335674, "uuid": "a9ce70d7-a760-48f1-813e-97f0eed1d7c2", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335674, "uuid": "e24a4f80-ec31-43a3-8ca0-81cab2d7fa03", "value": "24576:YAHnh+eWsN3skA4RV1Hom2KXMmHaTFQhMhv5:fh+ZkldoPK8YaTSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713335674, "uuid": "5d7104f5-2d98-46db-9f25-4158084c4957", "value": 1059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713335674, "uuid": "3da4c556-cf6e-453e-9949-8ebef25d5a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335674, "uuid": "0df18465-172f-4aa3-9a83-57b635dee268", "value": "SCU_9028892992899029_789290929209922________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0210f5e-fc9b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713345636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345636, "uuid": "3e636f76-9700-4593-9f5b-3bb60311dea2", "comment": "Malware payload (AgentTesla)", "value": "c842755f7c51b41e32e0dd5aaa578119", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345636, "uuid": "1a17f6a8-806a-4d42-bbd9-b6a3ed588cbe", "comment": "Malware payload (AgentTesla)", "value": "2c39a56bdcc932765bdc682d8e5adc7988bd1dc35c115c941fb1eee8e58cc8b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345636, "uuid": "16ac411c-e920-4d1e-9f2a-7d1ec22eee03", "comment": "Malware payload (AgentTesla)", "value": "7d1199b2755de7d0869f0e2533fdbeb7aaea821b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345636, "uuid": "ca7ab2e7-e3b1-4828-bfc7-336272021039", "comment": "Malware payload (AgentTesla)", "value": "1c60dea847e9e1d34a8345142f842f042bb64170811fe872da7f6be4054bf17be1e83b9dea359a4d76e3556daa05a1d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345636, "uuid": "c1e8f7bf-4fa6-43bf-ab6e-aa30471ee895", "value": "T182C501806B908C37F0BE1BF184AD107153A5FC912AEADB49D94C34DA2B3136E15FE65B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345636, "uuid": "2e8f39e0-e721-42c2-9549-68e131bb2323", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345636, "uuid": "187c65ab-5e06-4e6b-acf9-8c7d39856440", "value": "49152:8RDazLpWBi96WRvAuqzLwgkgkOicJwt4EdtCaCIvnmkEP5MKG5SrZS3MB7:ZLkBiEmvF0LwxywbwIfuG5Sw3MB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345636, "uuid": "883f95e5-a081-4ea4-ac84-ea03de5e5373", "value": 2648224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345636, "uuid": "17a456ca-b3be-4347-a19a-bf90a81d90cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345636, "uuid": "21b8df0d-d8ec-49ae-9c6f-447e72e4cf20", "value": "copy#20005716.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88193229-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361434, "uuid": "9741c59c-d500-44a0-967c-129284614103", "comment": "Malware payload", "value": "1d280870775b8d7b6d71e70a16141c11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361434, "uuid": "ea5f7b66-f57e-4ef5-8b09-80b5b125d648", "comment": "Malware payload", "value": "2db8254c5e74a366907f23f3e302b80ecf822cb95d0483083433fa852c330511", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361434, "uuid": "59978a3c-68d4-4df1-956c-34cd22e87242", "comment": "Malware payload", "value": "e444a61be7e029958babaa73c693a9eb1400f096", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361434, "uuid": "e25a2868-0cc6-4002-bd17-ce58f2e0b23e", "comment": "Malware payload", "value": "5bc0f91b0f574c79cc169269626260d42e719ce9b9caffb8a1f188d29b362c54a4044621535897b97227b6c9719f77aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361434, "uuid": "39d56a61-3a24-4593-a92f-3acc7633e74f", "value": "T19D560902EEC26E66C5CC037485FE979672507E085B951B2313A8EBA8397773DEF4684C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361434, "uuid": "d4eee2a2-87b6-421e-9246-8189c8b32be9", "value": "98304:Z9mVusEEQ4kVIb0IamIIkmrIGDeII8jOSPoo:bu8VIb0IamIIkmrIGDeII8Hoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361434, "uuid": "dd32f9f7-9ef3-448a-8142-0296159c49fe", "value": 5963776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361434, "uuid": "28539312-5d1e-4836-9c38-2b114984896e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361434, "uuid": "3bbe7462-6a87-4707-81ff-19a9c7f2f317", "value": "SecuriteInfo.com.Heur.18726.24750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cf01c2-fcf2-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1713382799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713382799, "uuid": "9509422a-d0ad-4871-8f3c-afeb511d9456", "comment": "Malware payload (LummaStealer)", "value": "415ff87e3c12c6f153a70608a31783a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713382799, "uuid": "0dae71dc-6fd9-4c4b-bc9b-5a6d5740d3b4", "comment": "Malware payload (LummaStealer)", "value": "2df0dc539c55d311dbfbe90542fb69feaa3542b6df9849cad3f056606e2c3599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713382799, "uuid": "a1edfc86-001e-4fc7-a1e6-19b148f13f05", "comment": "Malware payload (LummaStealer)", "value": "1bf6fca09a3252f2bf1a758425820f460cec83ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713382799, "uuid": "4241747a-8450-4b05-a8e6-7f8ac0b3165d", "comment": "Malware payload (LummaStealer)", "value": "081362dfbf339b4e3b1efa6faf714d601cd16fc85b570720397525fc14b01b34afe2d2130eb1ba020471c5b5653e07e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713382799, "uuid": "48804a99-b9e5-4a4a-b622-c6229dbfbd91", "value": "T14784BE2272E0A871F57347325E6DD6A4653EFD608F5A5B7B33486E1F04B20A0E632772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713382799, "uuid": "13d83ec3-1c8b-4d28-88aa-af4e177e7e23", "value": "f7e025a73ffe1b8974f1e3a5c63f95ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713382799, "uuid": "47d69eba-5db9-445b-8d87-640467f34106", "value": "6144:cN3p9fBPl+VqAuUY6s5+IDpEBhknm8DYulcyNi:KXJPlxAuU/s5TWcmzyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713382799, "uuid": "2d7a433a-18c2-44d1-9e97-83f8a622af12", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713382799, "uuid": "b24f5e5e-0c47-4f88-ad35-f0d4e4ddcd8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713382799, "uuid": "9cc7da76-ddfd-4619-8e19-f2b12549c2b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcdcab9-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713388233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388233, "uuid": "7ee02490-8065-4a0d-b522-704f72a6b4b8", "comment": "Malware payload (Mirai)", "value": "25a8e0bc115a9b1ba4d74452f93bb857", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388233, "uuid": "dc9a377c-b468-45f2-a8d9-1e0e258f41fd", "comment": "Malware payload (Mirai)", "value": "2ea2936a42d2190ba30887cac3878f3ed3070cd773e42ca778e3d1350c4e1f6f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388233, "uuid": "5bd89add-eb2b-42ed-95cc-6921daf181e3", "comment": "Malware payload (Mirai)", "value": "a0adc732551954f9c763b2c91c5c0d8d16e1af2e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388233, "uuid": "f10125a1-bafa-439a-befe-48118d4d5ea4", "comment": "Malware payload (Mirai)", "value": "fd68de4eec2fd8ad4c66547f8f7ee06475fab8c19e6025bee354988a4f3e2c3daedbe77bba3dbbd6ef32b5a2f1d51179", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388233, "uuid": "9e5479a6-fbb5-4a4d-a1b7-fa3487d5204d", "value": "T129632957B98580BCC19BC178172FBA37EA73B5FD0364B22913E0E9363D55E610E298C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388233, "uuid": "27feeacf-50cc-4af1-82e5-a161e26357a4", "value": "1536:/1wuRt0n27SAqOjONWQ8WEUK1N6t4Ev0ZzgrtHe5QXt4dD:NwuRt0nkSAq0i8WEUJtd0ZQtHe5Q94dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713388233, "uuid": "5393088c-df24-40bf-96aa-9b753471403b", "value": 67456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713388233, "uuid": "8bdf2e62-42e0-4442-8f8e-a34859681b05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388233, "uuid": "ce5190e0-e1d2-415d-a029-6fe2028653c9", "value": "25a8e0bc115a9b1ba4d74452f93bb857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410449ad-fcbb-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713359167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359167, "uuid": "1678bea5-708f-49fc-86f7-d8fcdd2fb62f", "comment": "Malware payload (AgentTesla)", "value": "e8cf42736f27344d295f0154e8f51097", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359167, "uuid": "c425ca50-2611-455d-9bd7-dac860030cc4", "comment": "Malware payload (AgentTesla)", "value": "2ecbed1e01a6404917129a03e0820fbae016372fadda8c057603a78a55fecd4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359167, "uuid": "8db119d2-93b2-4550-9db2-dd390e635daf", "comment": "Malware payload (AgentTesla)", "value": "162fc94fff43fb35b2612ce4ecfdf1cc1c7a68a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359167, "uuid": "40d13306-8baf-45c7-9926-3bacac17de4b", "comment": "Malware payload (AgentTesla)", "value": "28c0b4e1bd519f918acfb7cf2a8ecfb9e47ad2defd7f8627a0286f71bff9ecceb0a73095d0f05b56d2d16bf4e90d1e1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359167, "uuid": "ffb540a8-2836-40a0-b38f-88e31056cc1b", "value": "T1D1F422497E18AA37CC79A5FA11A15E200277F1482A25EF8F7FD6F54A27E2F009582743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359167, "uuid": "b52acd0a-f7cf-493d-8692-489b54ae651d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359167, "uuid": "df8fd912-43e5-465a-a9a1-a1174bc888f9", "value": "12288:NGL21IL4BoL2cWjoIRWXcM6CtXx+KWjd1rYQILW4760PVQBmA8URQbXj3kZ3JPAN:sL21ILeoLrARfCJ3WJ1rYHW47ZVQ38XT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359167, "uuid": "cc8bc18d-2e01-4c45-becf-bbdae53e5fbb", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359167, "uuid": "8ad3aede-661a-486f-875c-480001bbe4e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359167, "uuid": "082a531f-0e74-4f97-b9f3-1e9d6c0212ca", "value": "DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824be5c1-fd13-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713397072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713397072, "uuid": "67a279bc-fe6f-47e9-a664-5ba4b65fc2a4", "comment": "Malware payload", "value": "42dc58fbc7050c3e083ac79205a0aa75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713397072, "uuid": "44a78870-5fee-4bb9-83d8-d8246c49810d", "comment": "Malware payload", "value": "30af845f8599e256ce230a25bc8772b8da7c7ba019254de3534d0da70a9e9cc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713397072, "uuid": "7e67d93a-bf73-4a71-a86e-e755d2c14851", "comment": "Malware payload", "value": "65835ac4cc779cd165e8f5be406aaf7ca1e0124f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713397072, "uuid": "0963ad83-474d-42f3-a2ce-141e2a8fa9ea", "comment": "Malware payload", "value": "ab8af94ec624d6cc3dea5c200cae1549185df3a1261f36bdbfb8809da97fb17f81fba75c1c985cba0876c3a1efc24840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713397072, "uuid": "d349b646-dc47-486d-9817-614496f60575", "value": "T17F347357EEC2B016DD3298BD95594B34B144EC3BB9E02313BEE4F21D5A3AA01DC472A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713397072, "uuid": "cf49a67e-6675-41e8-8613-049e0d2fdf2b", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713397072, "uuid": "c9d8dbd5-e857-4c05-a54a-752eab21daa1", "value": "3072:LdwWsF1XDWLAlcYZM4n99drfQfnhfzMVklgQhS:LPs/fJj2hfzMVkl3hS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713397072, "uuid": "e00189d8-43d2-4bb4-bedd-f09371f00e68", "value": 233515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713397072, "uuid": "97d047b8-987c-45ba-9e13-c6e65b5708e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713397072, "uuid": "d655c1a0-4a1a-4df4-ab66-bf220c66e1f8", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1343277.7061.14046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7577d112-fc93-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713342075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342075, "uuid": "04e129c5-e650-4eac-b6db-92a4df2ccf9c", "comment": "Malware payload (Mirai)", "value": "7c2941c0c37bcc4888829774f8013d1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342075, "uuid": "748939f8-83a5-4f6e-a53b-bed14be738c7", "comment": "Malware payload (Mirai)", "value": "32d2216770e86b62849e428886fb0d595773db1fad94c0b61ad503069722f882", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342075, "uuid": "99454499-a86f-4e4e-8c2f-7a0cd2a10c58", "comment": "Malware payload (Mirai)", "value": "1ff9a145afe2d7a7b3dcdaf3cce6d4f327693b62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342075, "uuid": "06ae692d-784b-49f4-adba-7cf19d649501", "comment": "Malware payload (Mirai)", "value": "d63edda457870439c1bdc39d471f7abfc828f7f4adcdc3fd3b9b57a66257053c04cea140a4a6b7e03ead51a7d5f37ec0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342075, "uuid": "318ec493-caa3-4b4b-aebe-e7fe3dcb61e5", "value": "T1A5F31A46F8819B15D5D211BAFF0E528E33131B78E3EE72039D246F347B8A96B0E7A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342075, "uuid": "8a6c58e0-ea32-4550-b55d-9d76af72f86a", "value": "3072:+6BILYbu5qy8UyblhTfhrddWanKjZQye/C3kpezRkrG:+awYH7hDTfJd8anUbeaKezRaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713342075, "uuid": "1424deda-0b47-4f6d-8da1-8809800c3b5a", "value": 165148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713342075, "uuid": "365c90ad-c7e2-4a61-ac95-904adb9956eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342075, "uuid": "685ededc-ef09-4fff-badf-4dbedd60a487", "value": "7c2941c0c37bcc4888829774f8013d1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c2ce50-fcaf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713354024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354024, "uuid": "d5bb47bf-464b-4ea0-82b8-124585b060ff", "comment": "Malware payload", "value": "f245adaa6fa80e2648079db126b939b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354024, "uuid": "0237c2a8-f523-4fa5-a37d-8b1790467820", "comment": "Malware payload", "value": "33b445e3bf83406a4d3a8a5baab639a3b4e42e62e540a18f8d9bd9f0951ca087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354024, "uuid": "312d243e-f7ce-4bec-a38a-fab4433fb74e", "comment": "Malware payload", "value": "c33d15fca07df687b477699511bf0b784e371104", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354024, "uuid": "5d06ac4b-8937-4d3b-b361-30a39b59063b", "comment": "Malware payload", "value": "59f8234daa97271ee4a33f5a4ee65aeb49ac29365d696f605fe8f56ec40a3f1c929fab727810af80ab3eff47566ab656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354024, "uuid": "f9d31059-89f1-4bfd-8c3a-8a202f350844", "value": "T1AC349398E185C8A6D5130172CA2AF5F02A2BEE19D4F5441F709AFE3838F3756A0B7C57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354024, "uuid": "3cea3c2a-50ec-44b5-8ef9-63f3b5504fe0", "value": "3072:zjcSaDLd0EMKSKgKV668ao1S5NNQB5vI+qT75MbAgw9YPiLiHz2BJTRlcSsjVl4f:tjZVreMPs+uwR1lE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713354024, "uuid": "7706e014-3cf5-4bc8-8948-789c05eb1caa", "value": 244692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713354024, "uuid": "98e32670-9f4e-41df-9474-9bbbebbb10d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354024, "uuid": "d828dcaf-0903-4bf3-b647-1ccfc4e0b627", "value": "SecuriteInfo.com.W32.Kazy.CX.gen.Eldorado.21196.30271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4dbd39-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713367992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367992, "uuid": "2c3b3ac5-ee49-447b-9eb3-3b912e70d881", "comment": "Malware payload", "value": "e6843c4e61f6c00279ce14dd50cba292", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367992, "uuid": "917eae57-3c88-42ed-b052-093b484042b2", "comment": "Malware payload", "value": "341f381aab7c0fe31a88963ea0076155d7a9b5de82e6a2636a82a0497ebf49e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367992, "uuid": "be1015c3-23ce-458b-b52d-e7baf3230415", "comment": "Malware payload", "value": "7e5716b11d19ae7a8c2cf6996f8e36f9401a013e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367992, "uuid": "63fe3de5-6e22-4acd-a793-aaf0b1343949", "comment": "Malware payload", "value": "6a3e0a6ba8949ba04fc47efda73f559109886331fd38a7017a9183a805e810c2c91d171944b6af1ca568ab057d2798a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367992, "uuid": "327d3755-fe10-41cb-8f2f-a5ec444833ec", "value": "T19EE3F96F7B0807E3C48749B12D7BA3F04BE9AEB201E611C1E55ABE405B725B52527FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367992, "uuid": "b65dcc7b-d8bc-44e2-a01b-c63fc76be4e1", "value": "3072:siH07euH+MzbzbqtTetJ8add9QzhsCuc6Z6bUKQiVhgBJk:dH4eueMHsetJ8addQTuLZ6bUKQiVhgBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367992, "uuid": "26877307-c185-4787-b553-516f1890fab9", "value": 149772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367992, "uuid": "8f26ba49-0cf2-4399-a9d9-04ad6a7b11ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367992, "uuid": "754ecdcc-17be-43f2-b52a-cf7b227b3d6b", "value": "e6843c4e61f6c00279ce14dd50cba292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bd9534-fcbd-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713360136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360136, "uuid": "b049962c-e17a-4e20-b8be-234900755021", "comment": "Malware payload", "value": "2e88b6bf7b8f382aeb22ca973f7942cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360136, "uuid": "5b0e1e90-a6a6-478c-b845-1b98094baa13", "comment": "Malware payload", "value": "34975ef04e77cc6db686cffdfefd60c2679774850547bc15b4ad45de4ff3a0c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360136, "uuid": "0d7fb7d1-04da-4ed4-9484-884896a3c658", "comment": "Malware payload", "value": "b7ce993bbb93e2308084ec970c8ebe17e24880ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360136, "uuid": "3380f3a6-0f93-461f-beec-d82d2f09dcf7", "comment": "Malware payload", "value": "36aa19833b6f614d3c85ad9c650827c80ba8013ad66dc782d2cf775d003c4717b7c943c4e4e581440974e8e42321a2ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360136, "uuid": "3321b81a-9bb3-4a5b-96ce-10808166b42a", "value": "T164C4E0256B5A8843F2DD14F087A7E37477369D982E0B8252A6F1FE2B356C3C19D3D242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360136, "uuid": "31e30033-75d7-4765-b632-5e0e65de1544", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360136, "uuid": "f2e9d974-b90f-4f15-b7c7-458c9f559eb1", "value": "12288:r9HJ/kCOaZR6VxuqPLI3GhB3IvwSz40IJhS:r9HJ/kCOygPZPFrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713360136, "uuid": "be7574af-1747-494a-ae11-1d188685a9dc", "value": 587080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713360136, "uuid": "65c7278e-dc75-4c5e-9be1-8a65aebf60e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360136, "uuid": "6afebab9-9a2b-40a6-b3dd-f02a95274c42", "value": "S\u00d6ZLE\u015eME DEV8759 - pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708617cb-fcbc-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713359676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359676, "uuid": "662fe869-262d-448c-82d5-23b461d24497", "comment": "Malware payload (Formbook)", "value": "d877a3569cda0a06b9b655a53982bd5f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359676, "uuid": "6a82efc2-683d-4215-88b2-a8093d465fc6", "comment": "Malware payload (Formbook)", "value": "34e00860b4b4b01acbcce4a9772ad22279691f072973bca3ecfd99172f54c30d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359676, "uuid": "b36a3f67-579b-4883-90f9-541368b076ff", "comment": "Malware payload (Formbook)", "value": "40f87fd20bd881bc540e0b1568c0f14b834ce53d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359676, "uuid": "2d4921b6-26d0-43f8-83c4-042ba9e2e992", "comment": "Malware payload (Formbook)", "value": "2d4d0e176b2253b32333af2e29693527e068dc02e61e46ad8991d1f94e63300a5979f8d43a608c21acf6bb46f9ca3314", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359676, "uuid": "42fa7bf8-09f7-40e3-bb35-b0c9c006266d", "value": "T104818E4FF912CAF6BFB071161332BC974E04D9348A652B2C02CA9E95F72BB5046A5EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359676, "uuid": "cedb2144-9897-40ee-a68e-9f7ae6c71da9", "value": "96:ZSki4JjKuf1sDLIl8Lhwr6Lghta+GqS9tkd1cl40:Ji488iit/hG+dOlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359676, "uuid": "0865bf71-e99a-4cd3-a705-6b14f5b9a95d", "value": 4049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359676, "uuid": "b8f91b60-2ef3-4543-963a-ad153e96bb51", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359676, "uuid": "6f9fc873-5bf1-4831-80c7-5f85b1116217", "value": "PURCHASEXORDERXLISTSXGREENXVALLYXCORP.UU", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdecf1fa-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713367966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367966, "uuid": "8f92a45c-381f-45dc-9efe-a47369094fba", "comment": "Malware payload (Mirai)", "value": "262516dbf0b074bc3ef07ca51912c7b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367966, "uuid": "78f7a333-ffca-4953-be8a-7097da96f82a", "comment": "Malware payload (Mirai)", "value": "364cdb20c0956f47f040ed70edb65c64a62180777581a8cd7d48d0739ffc38da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367966, "uuid": "10ce766b-5b34-460e-802b-a292e2618d06", "comment": "Malware payload (Mirai)", "value": "bcac5fae944af223e970cdd487a96b051452d621", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367966, "uuid": "41bf0eb8-b008-4f16-9db7-71ad5fb2dd43", "comment": "Malware payload (Mirai)", "value": "c58f13df857bf5164fc79a5c8506536d42f6b52760e2f5c817e9536860d0accef8ac42df9c48bc6edf926580461ed717", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367966, "uuid": "bb91ef8d-01ed-4547-8d1a-a4912f9dbcad", "value": "T1B4434B5172280B17D0932A70353F5FD09BBEFAC021E0F686B99F9B968935D334546E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367966, "uuid": "768eda2f-39e5-42da-af55-3679983c0041", "value": "768:DaVVRLWYgnvRYDCi1jAZZkX9oXOqmPdjdFiT+eN4H9qKnZY10Udv:0VUv8CiNY6CTH4dVna10Av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367966, "uuid": "e3f68c68-db5e-4bcb-a9da-6cbf0d005fb0", "value": 55908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367966, "uuid": "8b1cfb6b-f4ab-4bd3-b1a0-904f2e383f5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367966, "uuid": "f1937488-b48a-41bf-9093-de0ba8fae5d0", "value": "262516dbf0b074bc3ef07ca51912c7b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81683108-fcbc-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713359705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359705, "uuid": "25292491-6214-4c59-ad24-8322e400d656", "comment": "Malware payload (Formbook)", "value": "ece692c29ece53684ca7d942c937fb77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359705, "uuid": "6426bb5b-c688-476a-8723-6370f68aecb0", "comment": "Malware payload (Formbook)", "value": "365b52f01e2dbfe1a1aa18fa38866bca685510b0efadf0e42aebfd1caa7cc2c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359705, "uuid": "85ac996a-d6e3-46eb-add4-a200c12ebcc4", "comment": "Malware payload (Formbook)", "value": "1d620ce5fc13339592cd213878b4c16d2e90612b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359705, "uuid": "76f7e74c-8296-40c6-a546-c2e1a6a11fba", "comment": "Malware payload (Formbook)", "value": "58a392620cbf2130cb7a1ee691982e68ad3b846003efcb62987c3b142a3538b9e3a7254d7daa111aa5d13bc37344be95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359705, "uuid": "e98b2ceb-eca0-4967-8c66-c97b39f44b4b", "value": "T1E305012133B8CE27C6AF427BA43835200FB8DD63544BF75A1E98B4DE5D77B801A21796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359705, "uuid": "dfbb99c1-0690-44a3-98b9-a6669a89156f", "value": "24576:pcb3DTfOBAd183Oc4MDLpJlkmJisXSIdwz:pQ3nQW83Oc/L5kmiUSws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359705, "uuid": "d865b2fe-e4ea-400a-b0d3-cd5f707e45a5", "value": 839916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359705, "uuid": "37b5019a-a331-418b-a7c4-e4458ed64d4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359705, "uuid": "c0ea3940-1fdd-46b2-b3a6-c16d1e2062a3", "value": "QUOTATION-#170424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81034e84-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713353691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353691, "uuid": "f25814e5-7b24-47cd-877c-d3a54ebe4559", "comment": "Malware payload", "value": "a2eea60f1991928460eca53fb86f127b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353691, "uuid": "dd4ce36e-976b-46cd-985e-1183545c3af9", "comment": "Malware payload", "value": "373c2274f9add075ba56475a4ac45a313b118fbf88c2025923870c25e794a1a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353691, "uuid": "d5e2f658-54a2-47d8-b3e3-4d76e6b047e5", "comment": "Malware payload", "value": "b5d31c9b199a9754a3ee7d7b9d35f8a98ed3b340", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353691, "uuid": "f8ae918a-9618-43a5-9aec-2a490f7a40eb", "comment": "Malware payload", "value": "9675a39414774c13f8787b0c96e423695a89cda4d48fab8c378c6cb6f33ca5b43a2446654bdee734ab5a7cdd3d2b2dde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353691, "uuid": "997d9b82-a705-4652-b357-f38f5128e5bf", "value": "T1C323E74C57AC8923E6AF5ABD9832425387B3F2669532E38F08CCD4E9379338558053A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353691, "uuid": "ca869750-b856-4123-8cf5-88ca0471bf03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353691, "uuid": "86b28955-7370-4c61-ba64-ffa69e4c273b", "value": "768:fdhO/poiiUcjlJIni2gH9Xqk5nWEZ5SbTDajuI7CPW5G:Vw+jjgniLH9XqcnW85SbTuuIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353691, "uuid": "3a18d3ea-3b2a-4a93-95a2-3843f1e40653", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353691, "uuid": "1422418f-39fc-4fdc-8774-6f194471d6d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353691, "uuid": "8c475ea3-064e-4fec-aaec-02273f97ad9e", "value": "a2eea60f1991928460eca53fb86f127b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5c8db9-fcc1-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713361659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361659, "uuid": "c0499c82-401d-4f69-b403-78b1d2507cb1", "comment": "Malware payload (RiseProStealer)", "value": "622836a63efb05e7ae4067cb283a3189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361659, "uuid": "0be5bca1-d61f-41a9-af3e-1e34e8c209fe", "comment": "Malware payload (RiseProStealer)", "value": "37e389db3f9b285e00e11260c0c3656e026f0627bfbbe42b3e9e07f8899f5838", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361659, "uuid": "87d6292e-b0d4-4e92-963d-1d3f33523dd3", "comment": "Malware payload (RiseProStealer)", "value": "fd9b8ed403cdc57734964d16b3c603b73ffd755c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361659, "uuid": "8b11a15a-424d-4ece-b479-96ba0866b3cc", "comment": "Malware payload (RiseProStealer)", "value": "19ebcb1fb2d8b7582ca076f6f92d447943483f75de3871fc248f38975b249310afd596a4175853de31e0ac9bb527369d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361659, "uuid": "e592f29a-2a9d-4e27-8394-f4d1cfb2f45c", "value": "T1A0150102B6D0B872F573473A5D6DC6A0763EFDA14E166B5B2F485E3F04740A0D622FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361659, "uuid": "8cb247b9-444d-41c1-9e98-bff7039a638c", "value": "17ccf166284947c6d6cbcd86ca514021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361659, "uuid": "14ec9e00-3e7e-41e8-838e-09202baaf1d6", "value": "24576:sdZwl68DbMAX0rApfkYck0ZlxLTT+paFlbj31zdKbw:YZwltMAkQ8ZDTTnFlb9dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361659, "uuid": "78dca42c-db2b-4660-9a56-cc90c3f0019a", "value": 959488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361659, "uuid": "61a48cfe-c1a0-4e0a-93f2-c84d823929d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361659, "uuid": "f9184bae-1107-4a1f-b284-f3edfea2c05d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031f6539-fc6d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713325562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713325562, "uuid": "5372b485-ded8-49ff-836b-f67a45ac611c", "comment": "Malware payload", "value": "39962b4f6063dd77e976efadeb2e89d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713325562, "uuid": "fedf3825-e98e-4130-a89d-515a4a40d9a1", "comment": "Malware payload", "value": "382310c26cf1269c851408058cf921e3d8b1e27a6e0fc95a5b9da6da624052b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713325562, "uuid": "8c3e1937-29ca-46d4-8a70-1b1b77abd6e1", "comment": "Malware payload", "value": "8852e5ea61e1d8d927bef788d0885741f50bf414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713325562, "uuid": "18cf94a2-ae1b-498c-9db7-d193839fbc80", "comment": "Malware payload", "value": "ce9c8f87b9b9eab617e76b5ea82d3febbf33616dc89b47e6d3a08bdfc67828ca64494ff787ce8562cb7a2a0f5810eb7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713325562, "uuid": "cb26fce1-631e-4a45-b3a5-fb0b5d4d8484", "value": "T1D29633817E11864DEA3959711DCB978C8BEB82E1D16D1397F7DC0E0CAAB930DB116C8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713325562, "uuid": "bab078eb-d7db-4fad-8617-39fbd1425437", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713325562, "uuid": "bc808d44-763f-49e3-a0fc-985f88ae0cb0", "value": "196608:qmEOLu6pgtrILBxH97osvoly0+tsUSqBbTgV/uFNCoPbCIQsT+9r6qUXxXlSNg1v:gOi++47/QImrqBTUHoDClNOx1GsQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713325562, "uuid": "d80d1ea7-8b6a-4088-aaad-fd8e0d09815e", "value": 9347200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713325562, "uuid": "1b36266a-cdc0-4d66-95c0-ad2d0cbf4223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713325562, "uuid": "3645e405-7fcc-4e5c-89e9-96fec4e24c07", "value": "SecuriteInfo.com.Heur.29658.32746", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d012f420-fc5b-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1713318175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713318175, "uuid": "58f3c598-e246-4a68-a461-069ee2ab0cba", "comment": "Malware payload (Rhadamanthys)", "value": "e720940033d0a875c83f019ee7418487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713318175, "uuid": "497827a4-f132-44ff-ba3d-7cbbc88c9a24", "comment": "Malware payload (Rhadamanthys)", "value": "391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713318175, "uuid": "6d19e2ac-e528-4ac6-9ea7-b4895f0006a4", "comment": "Malware payload (Rhadamanthys)", "value": "872728a8b723b37735a5eaeb35516f747b6b4f17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713318175, "uuid": "fb0daf25-b997-4e51-9767-edf9ee323b37", "comment": "Malware payload (Rhadamanthys)", "value": "bccdb6237943a1cf9b9d1f7dc94b5ed44f42b91eb493bf1b908171ce9de19225818eca8f83d893fe9e0c9e0f029817ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713318175, "uuid": "2adf3daa-c3f1-4f35-8f7b-f4003474607b", "value": "T1CD8423CE5E714B21C92ADEB75F2290BA23ECDA35D4814D8D62426F65571FB2E00F36C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713318175, "uuid": "27d303ce-3f2c-459e-832b-09cb6fc8837e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713318175, "uuid": "8a56c970-feea-466c-bde7-203b74aafc03", "value": "6144:wORjQKzqpAnLBZzxKnCoPoMiqbk9MKbzZJR7oM79fI7L+ZQe0cczk:7YSnFLKnCoXiqbkusj9jC+QPccY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713318175, "uuid": "71af525f-6eae-42ad-8590-9bb44c4e7c27", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713318175, "uuid": "a50533d6-2951-4ccf-b959-dcfd69164398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713318175, "uuid": "164397cb-a49e-40b0-af80-eb7316b0d9e6", "value": "391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870f9984-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361432, "uuid": "9fb77fda-bed5-4dc8-b90c-bb2e96704d64", "comment": "Malware payload", "value": "dd34186278f3e6477ae906b9e7f8d744", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361432, "uuid": "63330a54-897c-4d95-a7d3-58073f4965c2", "comment": "Malware payload", "value": "3936778a15adee92bd18a953d54d651dcaf3338acd2111c4fcbffc4fee6efc26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361432, "uuid": "4cef603c-7469-470b-9ab9-82bd2cfa498a", "comment": "Malware payload", "value": "db8da33e042487c183e657ad579bc038402b8862", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361432, "uuid": "28de2458-7730-4877-9db0-5c5a05f2e260", "comment": "Malware payload", "value": "1e01c9cde737a0a2eee7785ccab423d40a045fa317e6a3170579a2c35d311fcd303d131c252948b229a1cef7b1b27feb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361432, "uuid": "1ea28ef3-1640-4720-9704-b313abe944c3", "value": "T182361A57B8D28A42C0E4367AACBDC1C433671EB99B9B12675D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361432, "uuid": "1baab21c-8f25-46cc-91e8-2a9ce44f7f01", "value": "49152:PJzG9XxZPF773LVPN9GnMbaVZGNJru8cYWPAXq7nLYvVyrzmpxUIU1F1:hzG9Xn53LtN9pbu0Jru8cYWPAXq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361432, "uuid": "771c65a0-715b-4ca0-b637-4529a0261a4e", "value": 5308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361432, "uuid": "55421ff0-34fe-4abb-b26a-dbfdb3d6b0bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361432, "uuid": "c5ca8e0b-87b4-4e53-89c9-eeb95b37e527", "value": "SecuriteInfo.com.ELF.Agent-BSR.23757.4302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb180d2-fcc9-11ee-a120-42010a9c002e", "comment": "Malware payload (Heodo)", "timestamp": 1713365257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365257, "uuid": "acf3c2ef-db0b-4663-81bf-f34ba836af6f", "comment": "Malware payload (Heodo)", "value": "b28a478eb5b99efcdc7caf428bffb89a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "SSLoad", "colour": "#9E91F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365257, "uuid": "b7d1a929-0858-4e80-a49e-9b2c1d6a981c", "comment": "Malware payload (Heodo)", "value": "3bca1dcaef4430272b9029c9a4bc8be0d45ecff66e8de8679ed30d8afab00f6f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "SSLoad", "colour": "#9E91F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365257, "uuid": "48e24f4f-4dca-4114-a085-3280976cade0", "comment": "Malware payload (Heodo)", "value": "d394c7b8fe15753bfbff79fb4f648f6f8bae70f9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "SSLoad", "colour": "#9E91F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365257, "uuid": "ded6bb69-bdc7-4a3b-9313-c730a9ef92ce", "comment": "Malware payload (Heodo)", "value": "ddd2eba63c6b4eb006438ae7069034f8975485ca5bc4046758f8a5b1fdd1fe6dc83bc13a02b51b34ec09a6c7cc3fe754", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "SSLoad", "colour": "#9E91F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365257, "uuid": "2e64435a-6f5d-40bb-a8ff-78fa48370429", "value": "T1C325BF12A3D2863AD27631395F2ED2683C3A3C4136D5D4895FF5DCEE2E3AA802977147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365257, "uuid": "12950777-bdd2-43fc-a5b3-b99702ff5c78", "value": "404aab8a3289df7506dd21ed0180c412", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365257, "uuid": "2b6a689d-b21a-42fc-8d51-6fa3fb2001b6", "value": "24576:rs6ZRS5J3ifJvlxfcdaeti7w+0bf0XznPMvPD:Yni8dK9CEMXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713365257, "uuid": "df838dd1-c1da-4cf6-b713-14a9740263f8", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713365257, "uuid": "415970b2-8ed7-4982-b67c-c8b6d7c157cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365257, "uuid": "5f7bdd23-e518-4ef7-a1b9-50fe9df2b6cd", "value": "forcedelctl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b533c0e-fcd7-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713371130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371130, "uuid": "0b765af8-4e03-471a-ae6b-7666950a05f1", "comment": "Malware payload (DCRat)", "value": "8ea200d639611b48b5eec7973c69ed3c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371130, "uuid": "065849bc-4e6a-4b6f-91fa-6e376f962f3b", "comment": "Malware payload (DCRat)", "value": "3bcaee9fbb27f5b111fc1bab7ddf995662d0f1bd7251f788cf61e470a663bc21", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371130, "uuid": "af62c553-dbc0-45c7-93a2-d8260abb5815", "comment": "Malware payload (DCRat)", "value": "a1013b8ee4115f2cba29787eded20e5e6079b3c0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371130, "uuid": "7c29f31b-2c40-4131-b0e4-52420b925005", "comment": "Malware payload (DCRat)", "value": "884d97d5283cd1da85c0a9cf2698e6488e0172426df96eb10cc10d15d77a16a40983f38be3ef503a75c71fa3aa27e6ab", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371130, "uuid": "244ec53e-d242-422d-9cb4-c339d7ebda1c", "value": "T1ED758D0795924F3BC2605B319597003E9695CB327A72FB1A361F20E26D03BB5CBB21A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371130, "uuid": "dc30b430-673e-44ce-9f07-6652b62c5c6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371130, "uuid": "bb546a2c-0430-4ffe-a497-15eaf8c85888", "value": "24576:PD9R6DRIuUt0HfUXl+L83+uNhK5ewp6Y9Ly2KUVvqBML1dSk/uyEklP8/0:PDilCH3RNhqewp/92zUMBMOSIkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713371130, "uuid": "42b5dc29-0636-437d-9457-157fb361c3d8", "value": 1648128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713371130, "uuid": "8fbec543-f5f1-45b4-be5f-33f163cd5a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371130, "uuid": "ba9bd9a6-b745-4a71-bab0-e9353376d32e", "value": "8EA200D639611B48B5EEC7973C69ED3C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a6c8e8-fcbd-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713360141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360141, "uuid": "9bc7fa40-199d-4dac-a098-21ebb081681b", "comment": "Malware payload", "value": "f339be5cdcbf98a474c396e205e391c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360141, "uuid": "24eb4246-372b-4ef2-9900-a697cf08c6f5", "comment": "Malware payload", "value": "3e96fc69700f0fc226f918017198eb381496e281ab2bff04f2c9ae1303be7307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360141, "uuid": "8b2947dc-0926-47ce-9277-92132eb33633", "comment": "Malware payload", "value": "7d6c9c3f17c048d99690722b961169814ed6af26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360141, "uuid": "a230c7a2-277a-44ba-b05c-8eaa8e675a8d", "comment": "Malware payload", "value": "d5f5d63e976ea17c771735e4f672d6ca2bec5027860c76cca722f892ee0a7282d2e8b2500fdb85f0b58d4c7dfaa94698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360141, "uuid": "2fe5777d-ae4a-44a8-bd4e-4577c130002b", "value": "T1BCC4F1662B9A8843F2D905F087A3E37473369D942E1B8652A6F1FF1B786C3D14D3D242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360141, "uuid": "53b06029-0497-43ad-a761-07b02f6f7e2e", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360141, "uuid": "54a4c258-ee25-4e57-af5f-2059ca048c58", "value": "6144:9DSoIyuQUcJBm8gOl1GNtJdz5bT+IubMnyJh3OMsmWKz7Sx2YXIcgpBithte+5j0:B9HJBl1W/dl4MyX+j/r2WI7iLteO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713360141, "uuid": "5949d489-b2d7-4fac-b29d-cbf39a20b98b", "value": 566624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713360141, "uuid": "385e3147-669e-479e-9607-3f8e5ad0f6ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360141, "uuid": "556d01a1-7aa0-4609-b634-c776b1748da3", "value": "\u03a3\u03a5\u039c\u0392\u039f\u039b\u0391\u0399\u039f DEV8759-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8854585f-fc71-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713327504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713327504, "uuid": "3ce1f864-facb-43c7-a40f-98080395f440", "comment": "Malware payload (AgentTesla)", "value": "0c9618708ec0e75d83db35183198208d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713327504, "uuid": "31386c6f-7e90-4e2d-940b-2a90a4c90223", "comment": "Malware payload (AgentTesla)", "value": "3ea5fdf1bf1d8ef3f91cfea53101058524ca73287a6695993b6fce1fd9ad7c84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713327504, "uuid": "fb77f283-1fc4-49ff-8f5c-e887c70b2939", "comment": "Malware payload (AgentTesla)", "value": "a443677c61a9b734aaf4f63c52699a497ca65026", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713327504, "uuid": "a6658fab-cbd4-4ea4-abf9-60ee887787ad", "comment": "Malware payload (AgentTesla)", "value": "40e71878d2eb83f38e8b8d7776ea48ffdb37fae2eb6c239d103ff1f366ed86e0992b896c18323fd51d872c0294566043", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713327504, "uuid": "a43abe3b-d2b6-4848-aedd-2c2eddbe0def", "value": "T171F42396FA9C372BC5AADAF31221A63007F6A1451630DBCF0DC2E6E92BE77407151727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713327504, "uuid": "f35331b6-3962-41ab-a749-1ed1bf4d15c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713327504, "uuid": "917e8350-4a2b-4bd3-81ab-c8c2969d133f", "value": "12288:8GL21ILNYV12cWjoIXW/eJhuRPyZSXKkHUBO2vyUhED3lI5jCTG1Z6q:FL21IL6V1rAXWmJhi6ZS7+ylDVM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713327504, "uuid": "f12abe6f-f22c-452e-a8a4-19f3f7212bca", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713327504, "uuid": "ea1ede2b-7c85-4c15-8112-e4be457ddce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713327504, "uuid": "720a0645-9ce4-4545-80e0-adec7bc9e2ca", "value": "Quotation 0048484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db3ff22-fd06-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713391481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713391481, "uuid": "839551be-f9ef-4f30-9960-fa9937681119", "comment": "Malware payload (AsyncRAT)", "value": "ec705251e4fe1bbe9d290ab47ccb81f6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713391481, "uuid": "763edc39-3efb-45f2-ad3d-ee15a9e1e277", "comment": "Malware payload (AsyncRAT)", "value": "3f6e19f45a68036b285b23d99d2f5e5c36588806443d7f48fd9732805a303735", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713391481, "uuid": "944ad261-0953-4983-aca2-6fe5db6a5deb", "comment": "Malware payload (AsyncRAT)", "value": "6f44897ea0d5262af07060dc62eef2b587824739", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713391481, "uuid": "f7111c03-3566-44f1-b7f2-587e8efb25f8", "comment": "Malware payload (AsyncRAT)", "value": "c71d5160e9034893ad99fc53417bfad6b3a77c38b895bc5cf142a49edb2c7693813345311b53f9d297b0e0c0398f46ca", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713391481, "uuid": "5fac615f-62ba-4f80-ac3f-b209f4dba3aa", "value": "T14F638B0C3BE64125F1FFAFF15DE17266CA38F7236807959F24DA02860623AC9CD516E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713391481, "uuid": "7a38abfe-b5f6-4f86-b651-e98b609845bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713391481, "uuid": "41e30587-d15a-4acf-b9ef-659dbd9631d4", "value": "1536:69TvMHGXOqGQY6e4HEdg0xq+biomCftg4I+ONsS1QXQiv7:NHcGQY6ezmD+biG+4I+OOS1QXQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713391481, "uuid": "bdbed2f1-2327-4101-b2c5-86ec877499c7", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713391481, "uuid": "8dc454f5-ce10-4553-9340-3efab5b739a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713391481, "uuid": "30e39bfd-eec2-471f-af2d-c981f85d0661", "value": "xhTOzKi0iBBi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cec58d-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713367924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367924, "uuid": "5fe3f7ff-be74-46eb-a0b6-ea14197aa523", "comment": "Malware payload (Mirai)", "value": "f88e9ebd104be4e202db26f4935b9963", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367924, "uuid": "f98f7a0e-523c-461f-b4b8-32c064e4df75", "comment": "Malware payload (Mirai)", "value": "4035780e6c7e826f3c345181a125e0b2ac73d2f71e96a410dd45be4c4ee8ebe1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367924, "uuid": "11c8a9a3-d15c-4186-a2c0-f5eb2d73256f", "comment": "Malware payload (Mirai)", "value": "56fe0e987cff5009870a34ad64e512f13c1566c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367924, "uuid": "08cc1a94-a7ed-4795-84b8-c15d75281baf", "comment": "Malware payload (Mirai)", "value": "817362e3238ad055f3e80606055b99359ede0905be2118acb6b07cea0185ff4451dc5c4db490d0e53b54fdb013458385", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367924, "uuid": "341905b4-af48-4676-999e-22162c7a4e11", "value": "T1DD73A61E7E258FEDF799823447B78E216A5823C637E1D2C5D29CD6012E6024E241FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367924, "uuid": "2a0af1b0-272a-4561-b183-3d469e0f4307", "value": "1536:qztcPRFA6olzssw7BOsFz9lPU8ubdC6MbobAzwbFa10W:qC8nw7BOsVmbdC68zU8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367924, "uuid": "1298c8a1-1d7e-457c-bdf2-abcdfb9f8cd0", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367924, "uuid": "039edff3-da79-45cf-b9fb-8f23538e3b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367924, "uuid": "d5626eb3-a867-4e9c-8b33-32b3d317e951", "value": "f88e9ebd104be4e202db26f4935b9963", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca4284e-fc8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713339242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713339242, "uuid": "b5cdbe66-5a88-4766-86d8-943eef5a01ce", "comment": "Malware payload (Formbook)", "value": "8c80682b2f1ea7a3c6326daf9c607c90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713339242, "uuid": "903fb953-201c-43b7-9d78-6e67a592a76d", "comment": "Malware payload (Formbook)", "value": "404c6e6bc552d4c16f6ef3870e36431da3cd6bfa6ea5f283ddeeb3fb320b3713", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713339242, "uuid": "a26b5345-9bfb-4306-82e8-8826f9850fca", "comment": "Malware payload (Formbook)", "value": "0026bcd172f64f7779105dbe33dba13c37139913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713339242, "uuid": "30cc081c-28f4-46e0-8ffd-91199873b184", "comment": "Malware payload (Formbook)", "value": "b6bde1bfc6ddf797d6eda7baef96737d1663952dee2d20dad50dcd1cb3988be42b37966d4758e8fa4c6576157d193d1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713339242, "uuid": "e0847425-2079-4b00-9437-2397c9ec5f78", "value": "T10005E0AD365076DFC857CD728AA41C60EA6160BB530BE20BA41315EDEA0DADBCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713339242, "uuid": "fb0dcc03-ae66-4925-893c-e85909a20b44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713339242, "uuid": "377e9277-b149-4d88-bb9b-d65b01ca5d28", "value": "12288:7ve2cWjoI4tllz3DylKBAhxIfFtOYvw9wdM+7OrVYBlKVNrYl5BLvoD2lMPCDeeT:berA4tOlsAbIfDw9wtNCEBj1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713339242, "uuid": "174c2526-6dcf-4526-bae9-9b684820e7cf", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713339242, "uuid": "b8f72cd8-8ac8-4957-a718-08e159ed6d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713339242, "uuid": "36bfd73b-8bac-4387-bac9-09654c8cae74", "value": "SecuriteInfo.com.Win32.PWSX-gen.18442.28659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a594ad11-fc9a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713345162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345162, "uuid": "77d5dc39-e9d4-4708-b7ea-ab68ed61ef82", "comment": "Malware payload (AgentTesla)", "value": "9ecea7ad4e7e70e51a106920267d20ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345162, "uuid": "b58c3fac-e4dd-45ce-8229-2d6dca117342", "comment": "Malware payload (AgentTesla)", "value": "40bb8b7b9fec345f4aa54b05cc02fa42b404b9de341e07f7c6d7a0c1a1d801ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345162, "uuid": "0b58c070-1d18-4423-b5f8-77f2fa0d2f3e", "comment": "Malware payload (AgentTesla)", "value": "9cf8442d9a4496bbdbada0c29b853ca4838ddb56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345162, "uuid": "14af0d0a-85ec-465f-8676-205dd5b7736a", "comment": "Malware payload (AgentTesla)", "value": "fc18bfe3d3b254f79701ecc5f3ee938cd708a894f1307be9083ab70ce16dc73c1ea2f4c4f3d99bff1360017161f44234", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345162, "uuid": "5976deba-ec39-4ca0-ad17-93302015e0de", "value": "T1B2E4231C9BFC9B65C6A80779AC6364080736D282D055F79F6FE894F65D83BC180C6AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345162, "uuid": "dd39b15f-516a-42a3-80f2-b963157934cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345162, "uuid": "a19191bb-d759-4530-b165-61dece9bb3a4", "value": "12288:RO+sn4lkfaSKcc+M7OCwZCeJmyUeGKPBhZipKqq7Q29bIut2sCJuv:ROH4SfrcNO8yUeka59EdXJuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345162, "uuid": "6b7047d4-8a45-46f2-99f9-6286a3c4b60c", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345162, "uuid": "cf948a6f-97ea-454e-a71c-151c54f1efb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345162, "uuid": "e083318f-ac1a-4987-8486-910f449a6a66", "value": "UPDATED SOA PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e266b4a5-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713368028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368028, "uuid": "bc95cf69-9bf8-44d3-8331-916723eba5b1", "comment": "Malware payload", "value": "f9c1f88d41c47ce26940d62f658e5eac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368028, "uuid": "ee3adcea-9024-4a5f-bc24-186468ede35b", "comment": "Malware payload", "value": "42237aab731e2e25005c2e491a356eaea15054064034bf80fe78578b7384e921", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368028, "uuid": "ec9ac39e-9134-4e29-aaf9-2e66515f9c4f", "comment": "Malware payload", "value": "ca65bd09d3665bed981a44428f05966c2349d203", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368028, "uuid": "cf753fab-23b4-47cd-ae45-17bdf381fab8", "comment": "Malware payload", "value": "a88b847f3298d356f2337e3039223d8258ab25ea0e6cd775f5371326f5a3a124837624c96df2e743a6c3545c3f6338f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368028, "uuid": "e9f7022b-3edf-41a5-99f9-b25af14128b2", "value": "T1BE04C71B7B609DB7D81ECD7702DA5201108D9DAB05DE2BAFB278E918E76694F01E3DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368028, "uuid": "08b174d3-0a53-4faa-9a59-f6c18ba94430", "value": "3072:bKmt8tLodTv3v0v5vuvTvgvdvSvDvAvpvCvzvAvJvGvHvkvKvxvovrvavhvwvfvq:bD41k9qYetJ8addQRZVdfi+8qLwa+L9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713368028, "uuid": "3c7af2e3-783c-4476-8df5-8afcfec76b34", "value": 188246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713368028, "uuid": "1665fbca-4f0b-41ba-8a41-0cd2b5ee1b0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368028, "uuid": "c082e446-815a-4cc0-815b-cba0e4e84516", "value": "f9c1f88d41c47ce26940d62f658e5eac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0d2069-fcd5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713370596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370596, "uuid": "d75d154e-2ab9-43b7-8f8f-d172ff2c3dd3", "comment": "Malware payload", "value": "4afb7f2f966d4ce77a87860992f7f664", "object_relation": "md5", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370596, "uuid": "45f0e8f5-7f0e-4239-a3ed-5e4585657598", "comment": "Malware payload", "value": "44eb09ff486d2b84d59674992c52e8e3c0726c6b82c7e42bde94d32579d1524f", "object_relation": "sha256", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370596, "uuid": "a81ac585-bcfc-4d0e-ac23-491e97f5a6c2", "comment": "Malware payload", "value": "ec15afb6f52b9a7f50d0f9928247fd521646754b", "object_relation": "sha1", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370596, "uuid": "b4349f5d-7856-4fcd-b27e-5b643928ce1a", "comment": "Malware payload", "value": "f59ff61d413f56b86a4c79c6e57fb47a0b494b1bae3131dc6e70df501f30d8b523a47e8c8c67118c3b8dbcae96ae1c09", "object_relation": "sha3-384", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370596, "uuid": "8d6e9c95-3549-4818-b92f-183ed9528f78", "value": "T196D533EB612B814EEB140554D320CCD268BD11453618FCF6A3E3A1BE1DFBD7E6D442AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370596, "uuid": "bcc94070-b886-4dc1-9221-d4fbf8046429", "value": "49152:9tuyBcb0StOst4XSTvHvnBLFNB9Q3Pz89Ae4LwCNI/PW/lc+ApnfttBmM3:z/BAtOE4XKvnBLvB9t0UCNI3W/YFp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713370596, "uuid": "c6f71bbe-2b8d-498e-b6bb-b75f39ffc9f3", "value": 2817305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713370596, "uuid": "cb828f8f-391b-4033-a10b-da3826c0f6d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370596, "uuid": "d414be3a-a3ef-4417-bf1b-660df38179d5", "value": "Invoice_949287 2024_81859153.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9c199e-fc94-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713342381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342381, "uuid": "a97bec60-7501-4894-913b-beb08aaa29a7", "comment": "Malware payload (Gafgyt)", "value": "ad168bee27063c4f9fd029c74396111f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342381, "uuid": "b602c54a-db81-4173-a9fd-d31ce2e35547", "comment": "Malware payload (Gafgyt)", "value": "451171bbeb2d53d419b38803f1fd7b58c04476dbfd3a5d5a598373c03250528a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342381, "uuid": "4fa0f121-9698-4d83-a457-1c614f2cc6ee", "comment": "Malware payload (Gafgyt)", "value": "bf07091ed092bcb726a95cfe996a20e832548618", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342381, "uuid": "e544d256-6546-4284-8fa7-5c08aa87e318", "comment": "Malware payload (Gafgyt)", "value": "e53fedf3f0f743ef865f93641f4cc92c84f24c9bdd477c86dd71e53b35566d70586c91bf77f16dffc3b60a0e6a00c32b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342381, "uuid": "517ff142-588d-4bc1-95b2-97e8040e4e5c", "value": "T164E32B45FC519F22C6D222BBFB4E428D3B1A1768D3FE720399255F21379A55B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342381, "uuid": "e9074e09-08d8-4ce5-85d9-a6a01757db42", "value": "1536:iZRKgj/+3JYHXRCQnxO93RRRsdlL3qAoP8ILtbADzvlTPUDj6yKOWOTfmoDc+4Ne:2/jtHhNpbL3qX8IdAHlDGj6XvCcJNOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713342381, "uuid": "82a5860e-01ae-44d1-96d9-d12dbcdc5a1f", "value": 154240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713342381, "uuid": "045e8f91-038a-46c8-aa3b-5763bd0bcc82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342381, "uuid": "e052ddf8-1059-4e9d-aa32-f89d5e4ad60a", "value": "ad168bee27063c4f9fd029c74396111f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019f5d08-fc6c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713325130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713325130, "uuid": "438a3ddc-2a6b-4311-a600-ca5c6474e8bc", "comment": "Malware payload (Mirai)", "value": "d35769a3846371267a746f0e87ce617c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713325130, "uuid": "1f8bdd6e-458c-41e2-8f81-17d29a896acd", "comment": "Malware payload (Mirai)", "value": "472329c5ba3dd120456cac6e3e649120e32836803fa052390c16d78e9884378b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713325130, "uuid": "35863c4c-b88f-46e2-8d2e-fad0682a1f95", "comment": "Malware payload (Mirai)", "value": "8894ebd2a2a1f87bd784b2b1ecb11d9596bfe635", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713325130, "uuid": "24f431c9-8342-40ca-b36d-959f440d5564", "comment": "Malware payload (Mirai)", "value": "a1a755518aa0654c85da8f41ade808ddba463fe44d060eae413c44ef68553aa16620561866474028e05d43afd5d12fe1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713325130, "uuid": "44d9c51c-8a33-459c-a9db-b20a90cb00f8", "value": "T124F319C7F801DAFAF84AE337485309097230B7E145921A376367767FED3A099186BD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713325130, "uuid": "9c98130f-4604-4c84-a84e-c07414d9418d", "value": "3072:8a8HBbZgbliCKqOGQeuacWjcW0JcWcBSk4Mjbt8pTnRmVdUlL78Hw8+MLPEI:/MNgbYtGQeuacWjcW0JcWcBR4MbkT9Le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713325130, "uuid": "a30be26b-6bb1-4eba-89c9-dbe74b4976f0", "value": 163208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713325130, "uuid": "d2394a4d-d0eb-47df-8623-a27f4de85158", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713325130, "uuid": "dc52a665-f89f-4d39-8e6c-a85973a8c36e", "value": "d35769a3846371267a746f0e87ce617c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20ca66e-fd11-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713396347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396347, "uuid": "f7c1aced-ab96-4be9-9914-d55c47e3f504", "comment": "Malware payload (Mirai)", "value": "070cca947c410c16979fe583189a82d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396347, "uuid": "c3d09575-419e-4be0-b9b9-e480050dc2b7", "comment": "Malware payload (Mirai)", "value": "49dceb4f0aff538abe1258939ff9a2fb67dac3e098369c6649d82860010d1c06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396347, "uuid": "3adeae36-1b7d-4515-94c5-98ca7f81205b", "comment": "Malware payload (Mirai)", "value": "6ae2078849a881950f691125794c444df96ff63f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396347, "uuid": "bc16be5b-d511-45c1-a2be-e61258d126d8", "comment": "Malware payload (Mirai)", "value": "a618bafbc4c09be84a6bb46d47dcf1fda4297ae5ff6d2e050f2a5ff3eb9656871f2749d35bd97b11d4c1d8d0a905d8a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396347, "uuid": "4230e95d-b0d2-4384-8fe3-737b486f3fea", "value": "T161A30632A241D4B2C1430AF202A7DB770D32FEF727695956D3683EB0DE3208565A6F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396347, "uuid": "8ed34259-31a1-4c4e-88bb-2e1db51990e0", "value": "3072:12qG2kUOfTLSCBKQsKS/UJLk8Q8qmFnsGL/w0m:12OktbOCBxacJLk8qmFnsGL/w0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713396347, "uuid": "f25506d5-fab2-4a92-8f90-b5371269fdb6", "value": 102622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713396347, "uuid": "0f0402e7-cfe1-4cd9-9a0a-1d1dd0a58baf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396347, "uuid": "fe6d4911-8950-4107-8018-9790b4258759", "value": "070cca947c410c16979fe583189a82d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7beff7cf-fcd2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713369144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369144, "uuid": "c47c74f2-5dd4-466d-a20b-f816a8761099", "comment": "Malware payload", "value": "d9d647078087d98637aafc51a2f1dd88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369144, "uuid": "a228a67e-3a44-4c8d-a94c-297bba839a0c", "comment": "Malware payload", "value": "4ada5db5a040c1f6a08f6c324ec2b118ae148b65694d8a07b4598659a7ed4e43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369144, "uuid": "bdc06139-a809-4762-8fd8-86e417d896ef", "comment": "Malware payload", "value": "9c9c691acb3d9293515dbb06d4ecf73d8d3a1f2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369144, "uuid": "4e2c025b-8ec3-4400-80c4-f3cb5f64d6b0", "comment": "Malware payload", "value": "3255e681188f18c4486fc3648fbb482a5cabe347b2eed561500249d12694d23585ee62c64f2a81ae4e86cb14436ed5c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369144, "uuid": "66ae659b-934a-47ae-9d41-21c8308e782d", "value": "T14745BE0273D1C036FFABA2739B6AF64156BC78254123852F13981DB9BD701B2277E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369144, "uuid": "5f2ef02d-5dda-4a7a-9840-a3c2db4f04da", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369144, "uuid": "116cc416-5913-4c5a-95d8-e10bab3653b8", "value": "24576:cAHnh+eWsN3skA4RV1Hom2KXMmHadcCjDzHl1su/5:7h+ZkldoPK8YadcCj3Hl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713369144, "uuid": "8153061d-f767-49d3-b98c-8de7dd34ff1d", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713369144, "uuid": "6b6550ed-259c-44b3-89d7-7579b361e729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369144, "uuid": "9b60a57a-4f4b-44c0-84a3-e2708c5afff3", "value": "##DHL# BL, lista de empaque y factura comercial_787657686657689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896f63e1-fcbd-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713360147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360147, "uuid": "6da91e67-bf77-4b11-8803-0b8e611929e5", "comment": "Malware payload", "value": "ee5b2f7b41494ae7c08262467fdc1133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360147, "uuid": "2c4025fd-51bf-4a35-8537-73a534a6df90", "comment": "Malware payload", "value": "4dcd18358a0d573b8aa891048537c0b4bad8a7a7cdd4bd39e4114a2367c3bf82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360147, "uuid": "36e82be7-41c2-40dc-acd9-a788f664799a", "comment": "Malware payload", "value": "94e502480e135a6780ed0b0f44cc623c70df8663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360147, "uuid": "8b2297cb-a7ec-4aac-ac5f-a99bba47a925", "comment": "Malware payload", "value": "df589422267ca460ae3652da1b83c439df5a47a745b859aa258168be5d40fe058440736ece7464d6150b6a3182a61451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360147, "uuid": "95433f06-14da-49a6-a66d-6d3d33a8491d", "value": "T1C5D4F12667968C43F2D905B493B3E37877359D942A1B8212A6F1FF6B782C3C15E3D242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360147, "uuid": "2f938cbd-a4a8-4467-94c4-2ae3d7ae99ae", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360147, "uuid": "db16ec3a-426e-4a04-933b-be35b1452a5a", "value": "12288:49HJa4S9Q+RK59LYUaxfVSYmhzLKCx57zTE8fCtj8TQBEiOmg4njc:49HJabQjbLYxVSYgLBx57M8q8TQBNOmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713360147, "uuid": "2edfb01b-483f-456f-a5d6-17b595fd099e", "value": 608808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713360147, "uuid": "4cd3b085-b01f-4197-9c07-ec1649375231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360147, "uuid": "6f874d4d-efde-494b-a433-51359697aa75", "value": "\u03a3\u03a5\u039c\u0392\u039f\u039b\u0391\u0399\u039f DEV8759-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875faf0c-fcd2-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713369163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369163, "uuid": "64aff07b-4b10-40d8-993e-8c96f87bb2f0", "comment": "Malware payload (Formbook)", "value": "5e3633fe0bf74f78980578d57fafdf8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369163, "uuid": "6e0bde24-b045-4fd3-b02e-1377766dd43c", "comment": "Malware payload (Formbook)", "value": "4f26c5a2df2bcf04417c7fa65c55f055a2dc5529360f979dcf81ca9c62651c0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369163, "uuid": "7554847c-2ad3-41c0-9893-d0a9f3ca6fba", "comment": "Malware payload (Formbook)", "value": "0f8428ce1c99cb194f87795c394556ea8fc3d577", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369163, "uuid": "b41037d1-1c6a-4ec9-9816-86ef39df13ce", "comment": "Malware payload (Formbook)", "value": "ff1ea2ce9f8e2535bda886b5faa5689d672d520d34ce2b916bf10a84d744e3d54f2e228be451bec6eb2cafde505c4569", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369163, "uuid": "22706877-5900-41f4-91ba-45fdb92285aa", "value": "T10A35BF027381D062FFAB95334F9AF6115BBC6A260123E51F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369163, "uuid": "31c65138-9e05-4ba5-b910-6c049bf13fa1", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369163, "uuid": "dece2dfa-9b80-45d5-a037-170e256d611d", "value": "24576:nqDEvCTbMWu7rQYlBQcBiT6rprG8aHuHQ6axVpyl3:nTvC/MTQYxsWR7aHuwul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713369163, "uuid": "af996cad-a929-4090-98b7-e45b4ed5040b", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713369163, "uuid": "25ae7600-9ea3-4ed1-96b6-9964dc050411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369163, "uuid": "7b208ac9-1c07-4a6e-b176-7bae4dec00df", "value": "Cintillo 2024.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e898afc3-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713368038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368038, "uuid": "736ac97c-6cfe-486f-8d49-b16b1dcd4644", "comment": "Malware payload", "value": "0dbe52673192356cc80fafb7c469eb16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368038, "uuid": "e1c43a64-da6d-4844-b64b-715896bfc1a5", "comment": "Malware payload", "value": "4fef1537443d4c84d49151ac3a6757f0ecad6557655640b1f72d6b06520807cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368038, "uuid": "587a8927-c5bf-4872-b500-d5904f6e5b46", "comment": "Malware payload", "value": "32009caafe2a5be7132b201a11c315a9c2f0cec3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368038, "uuid": "80543c05-1dad-43ce-bec8-93e8f973787b", "comment": "Malware payload", "value": "a99e75d04cd67873b22c5233c33aa0494780e32e4bda1d2b5e5bf999b84a33871398a88ea79d207791ae71e6e7536fed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368038, "uuid": "d0ce111f-27e7-4172-85a8-12e619cf3b94", "value": "T1ECE30757B404CFA3F80A9A7205D75721B6B1EFAA0D831172B71B7866AE321D23576FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368038, "uuid": "378878c7-568c-42ed-a40b-93704750a0a4", "value": "3072:kpoWrPk2011M90EQ8m1acynDo/GRZgq329UzVbLamMUKQi7GngBZk:kC+qMKEQ8mxynU/GRZgqhbLamMUKQiK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713368038, "uuid": "e07a38e0-2b1d-428f-a11a-3627cc3449ac", "value": 149874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713368038, "uuid": "cae3a1fa-a84d-42f7-8d9d-1f91bf61099c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368038, "uuid": "414ce022-af4d-4da2-b8d9-b2244a5c4995", "value": "0dbe52673192356cc80fafb7c469eb16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58667b37-fcde-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713374239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713374239, "uuid": "ce64aa86-d37d-4559-a33a-21905634d98f", "comment": "Malware payload (AgentTesla)", "value": "e7d5b3af9cebadf634461574940da0a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713374239, "uuid": "8a17ba15-88e6-4bd0-b4cb-57fad4ba107d", "comment": "Malware payload (AgentTesla)", "value": "519fcde66b1b9c807cf89568d162c89103ee8065ba1009086881bbbefd69e4c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713374239, "uuid": "357b0076-39f9-44a7-a0c6-f315b03f37ed", "comment": "Malware payload (AgentTesla)", "value": "1b70ed9407cbe02fbb2ea7790caba4bae4c98a29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713374239, "uuid": "752396d5-482a-4a46-accf-dc88ddccf642", "comment": "Malware payload (AgentTesla)", "value": "0d5e82ac5a95c2ac0c24bba3f5819ec07329312dd88278d288ff1606d502da37244b44536da0dc62776e393bdafc9a82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713374239, "uuid": "8f7138e0-df90-4e43-8dea-e248a8ec1448", "value": "T166E42351F359EF23DA78D2BA11220E6A0FFD986552C1D4A86D81748CBBC7B3481973E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713374239, "uuid": "ae60a49b-5cb1-4802-8f32-63878a3980fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713374239, "uuid": "c3d0d44a-f9b0-475f-9601-d142013c7206", "value": "12288:I33nFyHgRMph6guOtDqB/PkKhcRdK6auXh35TPy4l52IQko3MN+Evy:IlyHsIh6fOtDqdfYh39lS6or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713374239, "uuid": "b38556fa-8226-4006-9d17-798534017d44", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713374239, "uuid": "dcdc5fd8-2f9c-4e2e-a79d-494f431cd5d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713374239, "uuid": "602cc5ef-bb17-403d-ab3c-afd355fe137b", "value": "Draft Sales contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f88a1b-fc9d-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713346312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346312, "uuid": "2ebcf7fc-3d0a-43d5-9c89-bbb2f943b1ce", "comment": "Malware payload (AgentTesla)", "value": "840ea25205acdee63e20a20bb011b42b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346312, "uuid": "20bcc911-d982-4192-9c7a-79191989fca9", "comment": "Malware payload (AgentTesla)", "value": "52202447ca339df6818aaef87e01a5d5c78acd8d45a0bf6248f37ad3e98c9bbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346312, "uuid": "df2b075d-d8c2-4bb2-a9fd-0950e66a629d", "comment": "Malware payload (AgentTesla)", "value": "18211b975527c51f77525d92a7e97307317847af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346312, "uuid": "0b8a7f08-9742-4727-ba84-0f56a155443d", "comment": "Malware payload (AgentTesla)", "value": "e90a76835656e969005b6ad77c3212bb339d20baad601d715c0c00a8b95b1dc08e27a32782f5fd73a385b696e50f8e71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346312, "uuid": "b58acd40-eefb-45a8-aa5e-73a6bb34d811", "value": "T13AE312624CC28658D84B132DDC454FD2F9BAA86B8B0033CC4F414BA959D714AEE7A7F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346312, "uuid": "a8aa9647-f5e7-4665-a483-f6757f9cbbef", "value": "3072:zTAVED4LQBe+WSd/YXjaNONYcTmtylxFxnVNQPyBS2jJu5V3EqPC+K:zTeLQFWW6fxfn0720E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713346312, "uuid": "772999cf-6f27-4ec4-8ab7-6ee29cbf18b6", "value": 146382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713346312, "uuid": "62b9c7ce-4805-4688-8e4b-ea704e7df426", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346312, "uuid": "96c7041b-f03d-4191-b1a6-e40f1d5f86dc", "value": "APR 20204 RFQ.xlsx.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61fca988-fcb1-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713354927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354927, "uuid": "66821353-a882-4913-8e0d-80576f3160ce", "comment": "Malware payload (RemcosRAT)", "value": "07dc16ddfbb8f4062d5e3db796c81598", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354927, "uuid": "23c58045-1b1f-41a0-950a-092d6ba847f9", "comment": "Malware payload (RemcosRAT)", "value": "5227518ddab487ddf8a3fb76f93a2588a628a54f015e63c1d20cde1aa498a2cc", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354927, "uuid": "d0441d57-ac63-446e-b31b-4bed25feaa60", "comment": "Malware payload (RemcosRAT)", "value": "5b4b75d67a04994e588b03574f188deaabe28f74", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354927, "uuid": "158a3127-de31-48d8-af2b-3abeb54f46b4", "comment": "Malware payload (RemcosRAT)", "value": "0cb881f987d3884a7a6697ec4692037c325e0a50e5bcefabc879fcb2304740f406523ece40730bce6221bd5f0ac9ed9f", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354927, "uuid": "6ec3c496-0ab3-41f3-9031-f23813c2e886", "value": "T1A0144BA0CEC922384F071BDAFC650562C5FC816A462610BDFACD275D6103E6CE3FEA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354927, "uuid": "eb9e5104-bcf7-4c48-b0da-253c9d94e27e", "value": "3072:2sn8jqaKK8ccABOwbDS2y2zJETxUuoHh3cOH/O02C3eMwvE6HsuRMBPo5mFSar86:FaR8ccABOwbDA2zJETxVu1vH/HsRjMBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713354927, "uuid": "f8b26ce9-7c81-4bc0-857b-8c248b369fb0", "value": 192310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713354927, "uuid": "30fef94e-d337-431d-857c-b0411d92e348", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354927, "uuid": "0eb344bb-5ca4-4ead-a634-33c56942c8c1", "value": "EqcaSLpedido001417.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02903ba-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361474, "uuid": "148455fc-ebcb-4c88-bf76-0aa276221138", "comment": "Malware payload", "value": "a80de84e94d420c746b52bf2da983351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361474, "uuid": "ac12fb00-0a22-4887-b044-4b3453589f86", "comment": "Malware payload", "value": "5375c8b3f12d655d1a4116411bd172ab8d8dda055eab22982adb95a132553bf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361474, "uuid": "23592e75-1182-4cb1-b5bd-f1f79c0f6c1f", "comment": "Malware payload", "value": "fcecb364a9e47cc5a66eee94a5fc738eeef9c443", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361474, "uuid": "1512c472-f5a8-448d-a444-3ae9a16256e2", "comment": "Malware payload", "value": "e1850dbdd009ebdd194abe06257c0306ddc2ed87c27de872d05093b97edb05b719ea5af6222ace69b605466441a5b6e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361474, "uuid": "4c76cb95-91b1-4c3a-bd50-1cdf38d316c5", "value": "T1D4463943F89095A8C1EED13086629293BA717C895F3463D32F50FBB92B76BD46E79310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361474, "uuid": "da7d6e18-3d13-44a0-8ea2-fdadde861a4e", "value": "49152:7Xa6xzZWhrb/T4vO90dL3BmAFd4A64nsfJPJ6TdXnT9aqeJaz2xNkapDnYRQoj13:b2ONLBzSxtSTvElHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361474, "uuid": "3a0ff1b9-47fc-4b2c-813f-b7f7a410f6c1", "value": 5435392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361474, "uuid": "3598a938-6783-435a-9a67-99a76551d6a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361474, "uuid": "a47c2870-d3e4-46a8-9860-6ea786c6268d", "value": "SecuriteInfo.com.ELF.Chaos-B.4493.24448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84558adb-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload (RustyStealer)", "timestamp": 1713353696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353696, "uuid": "f6f84525-4389-469b-9a35-7f3ad6175ce3", "comment": "Malware payload (RustyStealer)", "value": "22a976f5c4f69fd4bc787aa4d8368936", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353696, "uuid": "06f038db-4a5f-4241-80f2-26a272be0995", "comment": "Malware payload (RustyStealer)", "value": "5404c30f5f2408ab9e4a790e09ace77fd2d0f98dd30dbc7617dd64167e8032ce", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353696, "uuid": "603b619a-a0de-4df4-a94e-f30083f94a16", "comment": "Malware payload (RustyStealer)", "value": "e7318a849b946134adcee06a5b545e2867768f3c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353696, "uuid": "ff898ba8-519d-40f2-8991-2a5304cb08a7", "comment": "Malware payload (RustyStealer)", "value": "7f66a7b950e41f4cc886b7fce99356f0461ccee56ef0ae3e1a314fae5d65c5ac06f3f4643d85f012bf9de42bf24bc8f4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353696, "uuid": "db79d809-6858-4d70-a39d-0fd1d1aae31e", "value": "T124D518117B4A99ADC05AC4B082478B626A717CCA0B35BAFF4584B5343F7AAF51F3C358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353696, "uuid": "d88230e2-52d1-48d1-b39e-0c1095239373", "value": "1d589303777bbaa8685babdc003b2dad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353696, "uuid": "e5ed361c-4e8d-48c2-9022-2b95b2f62fdb", "value": "49152:GG0pnRH2ABzrO+/1GC1sdpvxRgad2cOrpO:JEoqpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353696, "uuid": "b7d87f94-c84b-4b8c-a584-2a8539c188b6", "value": 2910208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353696, "uuid": "e871cc7b-5f9f-479b-ab30-fcdcdfca35a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353696, "uuid": "0537c067-2e8a-4492-900e-7804d52252c0", "value": "22a976f5c4f69fd4bc787aa4d8368936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e362367-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361444, "uuid": "f84182a3-ee16-4a42-8b0f-696eb9edc252", "comment": "Malware payload", "value": "0b60dec94aa6a51e9bdce1e79c96d028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361444, "uuid": "3a5d7dec-89fa-4dd1-bf5a-6e5721aab672", "comment": "Malware payload", "value": "54ca9fe165ff480e14c1492dcd28dd4ce575226f431cd502e5d64c83cca107ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361444, "uuid": "81499e70-721a-4ee0-a50e-7dfc15eb84a4", "comment": "Malware payload", "value": "c30cfdd64cf9b74bf4ccbcc51095d3d08643e8d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361444, "uuid": "05ac6b0a-f79d-4df2-b61b-558d336fe6e9", "comment": "Malware payload", "value": "fb62036a8766306668d2f69c31ca6ef8ead818afb66217b74b656e37f246eeb1727c8eac644123e1d55a5569d91c6e4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361444, "uuid": "1eef995c-1f63-4ddc-b701-2186a93303a7", "value": "T14CE7335C7A18C0B2D9877772F2197F68A43A9E1253A35DB816C973C35378325AE12E3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361444, "uuid": "0011dd09-04b6-467e-9943-76490a66b93a", "value": "b1acf33ac5d2d07c82422095772ab92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361444, "uuid": "dc4e4a6a-8d1a-4e3d-bc9e-5f719009844f", "value": "786432:0nvnqSeY83w9+gw21eWRvIGU+6BPeCV+sxJ0S8Ys5qDTg2MK4gq6:0iSb83w9/b1epGUjBP5B4Cc2MPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361444, "uuid": "c9ad28d1-39a9-480a-969a-ca2c7598d1ff", "value": 65586616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361444, "uuid": "8dba165f-00ae-412e-9312-e113f7babe3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361444, "uuid": "cfca652a-53be-4ed4-b943-dfb67a1a840c", "value": "SecuriteInfo.com.Trojan.Siggen8.16025.17419.5040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ba1108-fcee-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713381242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713381242, "uuid": "c5082e3e-1713-424b-987c-1615c1f3aebc", "comment": "Malware payload (AgentTesla)", "value": "30b8cc608bc018649c0b9e70ab108163", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713381242, "uuid": "24dedd8e-0ef9-4a86-b213-1bbf4602a8f0", "comment": "Malware payload (AgentTesla)", "value": "551548dd1d1dd87d5231716f0f2003c0ee561f9a2ef7269cdf6534b96b02f465", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713381242, "uuid": "f1810655-40a7-4c58-bf56-0a5b42d1b7ed", "comment": "Malware payload (AgentTesla)", "value": "f41a645c38846eb51dcdd05f5da1283362eb86dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713381242, "uuid": "4e8ada3b-f06c-4793-a68c-7bf661a232af", "comment": "Malware payload (AgentTesla)", "value": "87c1e382d1d56338944e86504528cc81c0332dff19c04e46567e843171a270a30ebf6494a11bc2c2ec31ce875b36c923", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713381242, "uuid": "8d34474d-b5f2-4465-82e0-5418df356dd1", "value": "T148F4120271DC167FCA4B06FA4481D0601779A2AD295BF7CE3E81A3D8969FBC59C839D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713381242, "uuid": "f0ff5f59-ac0d-436b-b44e-62229e7304cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713381242, "uuid": "7757e24b-e942-4ca6-b4ce-002546bc3fe5", "value": "12288:/RRCs2cWjoIn307AawswWczf064V/TqGA7nMTeU8QgVPT+c9Y4OBxHqntvw7HZO:JBrAn30ca1czSVLCUckc9Y4OPUtvqHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713381242, "uuid": "c79a3535-d563-42e2-b882-73e4f4a6d13a", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713381242, "uuid": "c6975dde-f6d0-4e3a-a746-b88c401e1b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713381242, "uuid": "c61412af-619c-4bfc-815f-b390e5fe9c09", "value": "Fizetes,jpg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0ff6d9-fc84-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713335649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335649, "uuid": "ad091973-c5a1-45a6-a328-3f6b7f9e68e9", "comment": "Malware payload (Formbook)", "value": "96fe3d00e8b2ba36dfb240a004ab28e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335649, "uuid": "323bc22d-40c0-4811-9d92-ad974da15376", "comment": "Malware payload (Formbook)", "value": "57b81292b61a36171a2ad822d255aae878a8f9ca187efb43da94c7865c8388c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335649, "uuid": "1fb451a9-8f8b-4836-a503-6e35ece8e1a4", "comment": "Malware payload (Formbook)", "value": "757169009af1210acab01e9a2385e5cca4b94f20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335649, "uuid": "59f900d0-a551-4a13-9bc4-2f58a6f6f34f", "comment": "Malware payload (Formbook)", "value": "f8432d0ed3459d3f581b2e12c5f8af0b6a5840dfe347bc7f7a7a9114dbf214bad061f11918176006cf19711ceaf3534e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335649, "uuid": "bf8a38ef-18ff-4eda-a7ff-09e53592d3f2", "value": "T149F4124877FC5AA0D8EA0F3650B4AA11873DBC126C13FB6D6CD060AF5DB2BD64B405A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335649, "uuid": "8183c764-f225-4c0b-9723-7d4dafd38482", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335649, "uuid": "dd95f5c0-2edf-4338-8d5f-d30a9f3e8058", "value": "12288:j+NKG40wYjR2HI7OZGiOp+epbysKCRePsDl2h4TJEAvmxUP5kR:j+LXMH4OZGiiV9RWsJ2h4TOfxqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713335649, "uuid": "ed45cb84-6e48-446b-a9f6-704109f2d513", "value": 734216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713335649, "uuid": "940ff10b-36c0-4027-b9de-0c1358828858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335649, "uuid": "64945499-ed1b-4e6a-976c-2cad5eb9c074", "value": "HYCO_Invoices MS2 & MS3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b33cd9e-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361466, "uuid": "8842d604-66bd-4f68-88b0-19ece304330f", "comment": "Malware payload", "value": "673678d43433a9929a6187697fab94a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361466, "uuid": "8c2edd41-fb5e-4e2a-b48b-860530d93f28", "comment": "Malware payload", "value": "5806cb3ed937a1a956bf4ead2da5fbd38005d44de25396d5e597113fc7bdfc60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361466, "uuid": "0f8ce762-bf82-4b04-b079-918a2a78287b", "comment": "Malware payload", "value": "146f053413664dc97f8b24ee806a508ca9d56f0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361466, "uuid": "865b33ea-d057-4696-b46f-04dd8c7c0948", "comment": "Malware payload", "value": "05977f15226d5b997129f5c71dbf359e97412002314b5cdbd48c24ab3c57b87a0290b5c174ae8b853820509f5bdeb243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361466, "uuid": "08aa9b74-4697-4bd0-a311-39dc319d73f6", "value": "T1382533264F5EA01798093A32FFA4D2D2C007E41CC5B558DD02A785FF65EBB8E6B983C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361466, "uuid": "4bae740b-6274-4a41-8c4c-610f4b35cc0d", "value": "24576:utcSmWTNhls3yf9+CIfWL6Vc/B5/+xguY7:uDmghls3y1+XfWL6Vcp5/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361466, "uuid": "01b87fa4-9a5a-4634-bf32-74385ac5752a", "value": 1052917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361466, "uuid": "54c46efd-3345-449d-b2a9-7e3e9b6e8f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361466, "uuid": "f99f4f66-8f15-41be-8d4b-b108baf15590", "value": "SecuriteInfo.com.Heur.23245.23884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597ba2bd-fcef-11ee-a120-42010a9c002e", "comment": "Malware payload (RaspberryRobin)", "timestamp": 1713381542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713381542, "uuid": "5869b78f-ec76-45c6-a4ea-1fd761fc08df", "comment": "Malware payload (RaspberryRobin)", "value": "f0aadb531e95fa90cca9a0cab8cfa929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713381542, "uuid": "399505fa-97b9-4361-922a-3ab89b181da7", "comment": "Malware payload (RaspberryRobin)", "value": "5898061e58d5b01cdd342689b4b4d3dcf3a0f7cbd63fd30d1c38e6c57a81d295", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713381542, "uuid": "9e6758df-9a3c-4113-b77b-ca03991d56ce", "comment": "Malware payload (RaspberryRobin)", "value": "92cb9abc8ada4139834987d03ca63009f379e609", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713381542, "uuid": "b7bc3c30-89f9-4703-8ab4-1af28b0ca9e3", "comment": "Malware payload (RaspberryRobin)", "value": "6cd5086e71bedbd18702ca2f09c0ff4a7014137575ad07fb6ce57dce3f53a30da66e1ff026d04eb6041e50a748e5d06a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713381542, "uuid": "a223ed8b-cd10-4a9e-a3fc-4be7d8592229", "value": "T1F2A5232177C4C172C5A22A3309628285993C7D209FB78AEF97E93E1DDF396C19934763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713381542, "uuid": "233868fb-bbdd-4f93-89c0-a80572a67abb", "value": "10b73c5f7fc148e21f974da703236659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713381542, "uuid": "71d674b1-4638-4969-b480-0388d3e94806", "value": "49152:anGImUyz9PLUuPwIhzu4N8az3z0P5wePrTh+nkZpHNmtGM9x7Gt42rEEe+vSS:aGIyz9LUwpzu4Fz3KFDTR/MrGS2re+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713381542, "uuid": "e5ebf9ed-6fa8-4b24-bb7e-9e9780c9a394", "value": 2229232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713381542, "uuid": "8c28720c-b4a3-49bb-bae5-9a02e30cdb3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713381542, "uuid": "0471cd2e-cef8-430b-aa6c-22130fbde4ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99d2d4a-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713368013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368013, "uuid": "97fa7fa9-615b-4274-a90f-c6394674ffca", "comment": "Malware payload", "value": "4b46d4b91e2e2a46886dcc002b038732", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368013, "uuid": "3f6f836d-b3f3-494b-9886-a75b7c3082de", "comment": "Malware payload", "value": "5b5510b13f6c8b6ca635019e1473036a239f7b2f059ddb66bb9f8debbbe990c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368013, "uuid": "7d1520a6-5e5b-4d87-830c-bb1961c3b4ac", "comment": "Malware payload", "value": "aa05669c460970a880956a07f17f87e4ae91a4b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368013, "uuid": "8515ceba-1192-4cef-bbb2-0898380f5c33", "comment": "Malware payload", "value": "5f39815e5e06d3262818d17ec855dc0487436d0289ba4bb9476835c39dc8a4e39aad709e34a47130092b01d038fc9316", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368013, "uuid": "c3465623-b37e-4cf3-bc55-d46609a40464", "value": "T18E94020279C18432D67219361560DAB95A3EFC700F748DDB37598A7A4F603C2EA3EA77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368013, "uuid": "f6c1eee9-d14a-4da4-885c-f798edb90886", "value": "82004e1f718cc406824f64c2578845d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368013, "uuid": "eb382367-c1d7-49b0-8336-d84566574cee", "value": "12288:7lgmeMlqZV3zlw1Ez5Zpqz7CwOodUb4pk:7neiWVjNbYzHjUs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713368013, "uuid": "f6e4de58-7654-4c7a-b8ed-0676b5a26f29", "value": 435824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713368013, "uuid": "2ecaaee6-a3fa-4842-845b-80c589c806e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368013, "uuid": "2ea7564a-9172-4a65-8f2d-091e3631fbb4", "value": "SecuriteInfo.com.Win32.PWSX-gen.900.19500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f204522-fcff-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713388316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388316, "uuid": "4d80a161-e0cc-4b9d-8895-e2ec62187c78", "comment": "Malware payload (RedLineStealer)", "value": "4b4106cbe0cbf4ca771a185abaf54362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamrui", "colour": "#A561A7", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388316, "uuid": "65bf15e1-44b5-4804-9650-739e9a2b8d90", "comment": "Malware payload (RedLineStealer)", "value": "5d529ebadf935d071cd64d97ab459aa12766af1063cb2fc067cff5c118dff2fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamrui", "colour": "#A561A7", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388316, "uuid": "5d6e5324-ccb4-4c6b-b6c7-373addac23f4", "comment": "Malware payload (RedLineStealer)", "value": "b0e595390c77b313a08a81df366a2ba3f8e683b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamrui", "colour": "#A561A7", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388316, "uuid": "3d2673f3-bcbf-45f9-b8b8-14a86288a1f8", "comment": "Malware payload (RedLineStealer)", "value": "2ccd3f65997034dee1ceb9769c8964903b474f02b0b14edf895e79d37befb60ae6358eaff52a73a0e11d1ac4888920d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kamrui", "colour": "#A561A7", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388316, "uuid": "fc34c06a-3ab4-451a-8c41-02a7edb5c958", "value": "T14304AD2171C0C1B3C4BB113444E6CA799A7A70714B7A95DBB6DD2BBA6F103E1A3362CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388316, "uuid": "e2fa6bbf-31fd-4477-8e64-3049214940e3", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388316, "uuid": "30cee4c9-b14a-4fa7-bf72-96eb8b660497", "value": "3072:fDKW1LgppLRHMY0TBfJvjcTp5XGGnH/K+Q9jCL:fDKW1Lgbdl0TBBvjc/L9Q5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713388316, "uuid": "51be62dc-db5d-4be8-a073-cf0aabd0785f", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713388316, "uuid": "4737ebb7-0bcc-4d27-9de1-d79145dea218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388316, "uuid": "7a5b835a-f8fa-40eb-a544-1f83ee6a564e", "value": "ENDIDEV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a89290b-fcbd-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713360149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360149, "uuid": "e2db28ad-5e1b-442b-b46b-2890975a8738", "comment": "Malware payload (AgentTesla)", "value": "bfd203d85d6aeb94071e2897b02739aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360149, "uuid": "7088a04a-dacb-444e-a351-ebd84a8db920", "comment": "Malware payload (AgentTesla)", "value": "5dda5302383b5a1677891f2bcb1da4876634f20c6cbecd2ec9a5e63a24fd5cdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360149, "uuid": "376fdaf4-9473-43de-b545-d4ed1b01fcf7", "comment": "Malware payload (AgentTesla)", "value": "6d811b83bdaa7c1b5e6dba4aab03c5bc35c4e57a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360149, "uuid": "64ce1e01-8850-4b51-9826-aaf9ddaf5573", "comment": "Malware payload (AgentTesla)", "value": "375b1cbe4a9f116e2c96e0d20b55aa4db206297cbc24f3fbbd2308cac40ac34cd60a6a465db751df9be027ec35535b50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360149, "uuid": "7fad1a0c-490f-40ac-a7a6-615b6d91d8c6", "value": "T111E4238D33392B23E8BD3BF20542096347B1E1321879F7992FD914D89669F8495E9B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360149, "uuid": "08f8e1e8-c2c0-4904-82a2-665924cdd10e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360149, "uuid": "6c570bc1-64aa-4431-93bb-7a16824e8cee", "value": "12288:WUHs33hhOvt5Q6BSdN9/yaqv2omAvAbOET4h2cWjoIR:Pq/Ovtcur+ojv8OEirA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713360149, "uuid": "8e118a5f-cc28-4383-a1ab-8aaa8c55aa13", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713360149, "uuid": "dc10b1cc-04a1-410e-93f2-c0fdb59a95bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360149, "uuid": "c835e192-40b5-4140-bfe0-b2d6ad6cda74", "value": "Order Confirmations.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1024158-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713367972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367972, "uuid": "e68abc8c-f667-4cdf-ad1f-7ee81f1e4740", "comment": "Malware payload (Mirai)", "value": "ef29fe2f87b8cf4b2f245f1a04964490", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367972, "uuid": "af4d3e8a-cfbe-43b4-a712-36c643d6c48f", "comment": "Malware payload (Mirai)", "value": "5f5c05ad4628341c0e09a7973174ad1960f1e8171d21c03fdea871034b24f010", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367972, "uuid": "02111cc8-a9c3-416b-93c3-dff3fda68ed6", "comment": "Malware payload (Mirai)", "value": "2113a2d6b5e55967eb8a440031ee72f8dee43937", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367972, "uuid": "066ec950-ab6d-4846-a0ed-076b2e936a9c", "comment": "Malware payload (Mirai)", "value": "9351fc5c707514246a854a9b4e09b0a855fc86f14fef48a9836211b1e6ca2783058e5349863d018c459c6ae2493ce7e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367972, "uuid": "5d71c7bc-05dd-4df1-9a04-081f56f889ee", "value": "T1D7C34C46F7404F13C4D6177ABAEF42453322DB94A3DB730699285FB43F8666B4E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367972, "uuid": "a4d6e0b8-97a1-4f1a-87f8-720b1bef0d83", "value": "3072:emfwYRH+XnekTDsTLyxjXV90A6LfCM/9IPKgUYCorqmWXpAsV:emfwYRZkTDsTmxb6LKM/90smWXpAsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367972, "uuid": "af8fbf52-25db-4a52-b4bc-1b4e8748456b", "value": 129364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367972, "uuid": "b2f27444-acc0-4658-af7e-154c5205475c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367972, "uuid": "3edcbf51-bb16-44b4-a16c-7cc03ed34bb1", "value": "ef29fe2f87b8cf4b2f245f1a04964490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5ca7c5-fc65-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713322523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713322523, "uuid": "2a1f7b05-029f-4a82-ada6-053d2b878071", "comment": "Malware payload (Loki)", "value": "742b63d93401a9af88183725ee503df3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713322523, "uuid": "e3006d29-ca10-4b2e-834a-28a584635a7b", "comment": "Malware payload (Loki)", "value": "5ffa345944786c7b505a3b1b3392560b1b987529c49e11893642c8be816aa313", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713322523, "uuid": "390860e8-50a1-4477-a9c4-784f242cc3e6", "comment": "Malware payload (Loki)", "value": "ecfb96a3f57aee691a1c80a750518f39a8cbc474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713322523, "uuid": "def5a7b2-32b3-44b7-8346-163606b7533f", "comment": "Malware payload (Loki)", "value": "6854106e9330a8c5ae074001bada3416004368049a2350d78a1cf2f468cf8b4f72abdea0ca929e3ea91e7c6e9ecc8723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713322523, "uuid": "b7b864a3-fac1-4d88-a7da-6d5206464581", "value": "T18ED41291FE547927CCB72FF51116763087B5E9852910CBDE0ED2A0896EE3B5022E8B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713322523, "uuid": "ce8f69bd-71aa-4b66-8f23-06977b8cc0c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713322523, "uuid": "85e50dee-4bee-48d8-93b6-14a9e6a2bebf", "value": "12288:tGL21ILq9J2cWjoIa8JnjoQ/huW2YxUlbODcOYNSddW4Jf5CoXkR:ML21ILq9JrAa8RjDwLYxN4NGNfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713322523, "uuid": "6da29546-ea65-4271-8a94-be1a27c5d2fa", "value": 604680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713322523, "uuid": "3b817ece-44ea-42bc-b7cf-e264fd8791de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713322523, "uuid": "94c3f886-8ed2-4b48-a561-2b7e621ce93e", "value": "Payment Advice16007618765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f57b50-fc94-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713342376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342376, "uuid": "e5e8d1d1-75b7-4d81-90e5-3095ecc632ec", "comment": "Malware payload (Gafgyt)", "value": "6d459d0c0617fd1d907a1703f7d05774", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342376, "uuid": "adf81167-dcd0-4d2a-87c2-5197cad85b5d", "comment": "Malware payload (Gafgyt)", "value": "60fad3d03171353efea70a0e9a0c511d34c3bbd8f9f57bfa6e8d989cd858ba14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342376, "uuid": "2dfdd654-6873-4a6a-8d16-29dda5dbb44b", "comment": "Malware payload (Gafgyt)", "value": "6b97659caa3df9e8514c224adea5dfc8cc73c12a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342376, "uuid": "bdf1befa-dcee-4c43-b7a7-3113eca89a46", "comment": "Malware payload (Gafgyt)", "value": "af963648492d1351c5e6d5fc33717634056df8f8fdf3c1ceb06c61c8d27c0881edf9528e646c2951083f4ff1d2aaadb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342376, "uuid": "c9004a6e-f930-48a5-afe9-c02a9e305b29", "value": "T174E32B45FC519F22C6D222BBFB4E42CD3B1A17A8D3EE720399255F20378A95B0E77142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342376, "uuid": "c2feaaac-c5bc-4a3a-a278-027291aae233", "value": "1536:nBUUj/bOvFXiif9Z/m/rdvhItwppB5AlZKGwADbPPTxyAJzVfOkOlz9yIDNBNl9l:Btj2Fnf9W7LB5Y6AfPNDJzVADJKFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713342376, "uuid": "6db9a047-10d1-47b4-9624-1611823def64", "value": 154240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713342376, "uuid": "f552d27c-63fa-4d6e-9eec-4dd87bb445f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342376, "uuid": "5c9336d8-d6b6-4ed8-99ff-012f04a790a1", "value": "6d459d0c0617fd1d907a1703f7d05774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d93d4e9-fc62-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713321017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713321017, "uuid": "abda884a-dca9-41ad-9bce-7b8bc4e633a8", "comment": "Malware payload (Loki)", "value": "678b937e3e7e02e6b27158a8ecc573ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713321017, "uuid": "915b2b8c-8838-4aae-8eb0-9d79d680b819", "comment": "Malware payload (Loki)", "value": "64b47fde027cfd04023331dcd19612933dc9b9d77731b487844c129d0d354b20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713321017, "uuid": "6d5020db-9aa1-4104-8d3b-5f1d3e6d08de", "comment": "Malware payload (Loki)", "value": "e01f386b972ff55da1edb53ccda0bfd56e637477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713321017, "uuid": "3c54258b-c8b9-414b-922f-48f79a232275", "comment": "Malware payload (Loki)", "value": "88190bffde6a2a74f4ba94a2e5721e5c0eb9b93e2aa4212560785b98ea5a8ea31f849650e5f5e5c21c0be1f10aefec86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713321017, "uuid": "681f91fb-f5fb-4a44-81e6-2ebce2da5bcf", "value": "T1B3C4121CA7E9ED00E6EC0B7EB03791254331E6A5F906FB2B6DE484E64DE338481169D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713321017, "uuid": "1ad695a8-4f64-4069-a724-ea739ad05fe6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713321017, "uuid": "29a49323-4c99-4ae3-aa24-60e80cd99e3a", "value": "12288:MztjtvwaVSJISD40FENpOm4dCpc6o11I/qbMSlL+IjuhA3kR:avwaIOU40FEgdD6WK/qbMS5+GuhAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713321017, "uuid": "1299beee-49c1-4fb8-bbd4-d47720918e1c", "value": 567304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713321017, "uuid": "dda5200e-b392-4995-a105-c4461e947ab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713321017, "uuid": "9d4136da-e9db-47f9-b5b6-1a19fdf5b676", "value": "SCTR116709000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26288d8b-fc72-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713327769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713327769, "uuid": "b9fd418f-3304-4d25-856a-bf74f79f2221", "comment": "Malware payload (AgentTesla)", "value": "cfaf6fedf4a8954df63b75e1574e66b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713327769, "uuid": "df674822-1b16-4dea-baa3-a13bb38047fa", "comment": "Malware payload (AgentTesla)", "value": "64c3f8bf923b9869c7b0f2a77eb1b1db64eae1caec23fa0da3da85c2c885b139", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713327769, "uuid": "c5a26a11-acca-4b00-97f6-f28830b8061b", "comment": "Malware payload (AgentTesla)", "value": "dc5d8ed078cf6225e133c228670edac311af28b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713327769, "uuid": "4c320b21-3bbf-46ab-9681-6d506fc64378", "comment": "Malware payload (AgentTesla)", "value": "68a42000d0ee614d68aa03628cd45b5d1b0236ab1c63c6d6143f549b8441bc8e93b36d3ba5ea5597c4c335d36959021b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713327769, "uuid": "1ed28e4b-d41e-45c9-b5bb-cee48cba2a37", "value": "T1D6E423C78B0A37A7D69E8F34229B3983B77270D3546CC524509AC34CDF89B65F8EA506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713327769, "uuid": "fcb437e3-4ca0-487d-98c9-8b04ffb5b6ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713327769, "uuid": "83c104af-317a-4d3b-ad30-d396f38a4259", "value": "12288:kkvq31eoWxRl1d7EmIsoY+rq5hUo22vKY8kALxwtOzfnzRxaMpTjAB8d45VIo6w3:keqF8d4mIn6UoVvKY8BGCfnzR3pTM8Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713327769, "uuid": "c3a774e5-2c61-4acb-862c-dc62150f43f5", "value": 666120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713327769, "uuid": "82d33bc2-5dd5-4d8f-bee4-eb2d09d31401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713327769, "uuid": "ae5b931f-94ad-410a-b760-c1b49cd30fc2", "value": "cfaf6fedf4a8954df63b75e1574e66b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15eb21e3-fcde-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713374127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713374127, "uuid": "9dfeaab8-e338-4561-940d-4c4e6288662c", "comment": "Malware payload (AgentTesla)", "value": "b721ecb7cb904cd4873a163506376826", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713374127, "uuid": "9ada9440-73ed-42e6-a9bd-a7953f73c93d", "comment": "Malware payload (AgentTesla)", "value": "65213a977ea348163508bd4c82895c4945f6091a596334d16bdda6bf25b6f992", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713374127, "uuid": "aeb6b0a4-b5e1-4632-b371-02646a67d1f0", "comment": "Malware payload (AgentTesla)", "value": "adb6c049e1b556b11d0d25a9be0de10989d5fc01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713374127, "uuid": "063a8367-7b57-4916-8e5f-f8cfc6eac877", "comment": "Malware payload (AgentTesla)", "value": "e572e124a33462c8995254760c5eb3fa29b0f7441c2c7c004552b4e942bcfc2cad451fe2e8e499254551192c501b467e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713374127, "uuid": "e2c9967a-d2bf-42cd-aba4-9894114c2a91", "value": "T14AE42326F9D6393D5C871702BD6470E0C8C2C87459E82D6625D52FE96C3768F283E3DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713374127, "uuid": "13a04ee6-d4c2-4821-880c-3edfc39caec4", "value": "12288:sK9eJ5i7Bz7Dr8ARWBXk/zEfDKtF3thxdWD6XnT3XU6rF:LoJ+DgPByzJHLnLXU6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713374127, "uuid": "8532156e-e496-4616-8c24-73a38e68a415", "value": 669596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713374127, "uuid": "90843c30-8366-49a9-8dd5-57cd9b5fd4e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713374127, "uuid": "b4bc97ca-a991-4db7-8522-3ecea6c24a09", "value": "Payment Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1794e13c-fc78-11ee-a120-42010a9c002e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1713330321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330321, "uuid": "7a1cba57-eb0c-4723-8538-539835394b0c", "comment": "Malware payload (CobaltStrike)", "value": "50c9f9b4fe6c26be872aff095e05a981", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330321, "uuid": "5b6f7291-4467-4f12-8556-de32fe975f82", "comment": "Malware payload (CobaltStrike)", "value": "66d79ffa703a6a51e4fa8dee5ad1ed9b5dc8b228a8e385a0fb1aa5994cb245c1", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330321, "uuid": "eb49a180-5626-4494-a595-7142349b6f19", "comment": "Malware payload (CobaltStrike)", "value": "c8a0319c185e4f64775401a05bb20dc4aa4e56c6", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330321, "uuid": "9ae113f3-146c-4737-9dcf-0d060377efd3", "comment": "Malware payload (CobaltStrike)", "value": "c5f535e525f4dcdbc30ff62e23c2cb656febcf7d60bcf40f042649ca559e18d0000a3d1f891a20ed6f410e97be82fc1f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330321, "uuid": "8ab8e3fc-dfd9-4c33-b5e7-9ce1de117062", "value": "T1EC352A8B7C9010BAD0B992318D6652917B71BC980B3227D72F51B3F82F72BD41E76369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330321, "uuid": "3be4ca3f-a9a6-4185-a493-6d1c36e18ef6", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330321, "uuid": "d1957f10-b18d-48af-94af-6422ba4b7d1b", "value": "24576:uSn0N6s6wGwWjt53VnTlZjK3ZgESPzK1:uSnA6s6wGwYX3VpZqZgEGzK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713330321, "uuid": "192c4fa1-3612-4147-a5cc-a3d1ac05d6a0", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713330321, "uuid": "6e6bbf75-5376-42c9-8f8c-13d6b0595d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330321, "uuid": "3dc43d4b-1ec9-46f2-8721-7b2a58382d3f", "value": "50c9f9b4fe6c26be872aff095e05a981.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e9de4a-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713367930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367930, "uuid": "6da1689c-e4bb-465d-a558-58874f03419e", "comment": "Malware payload (Mirai)", "value": "421a1b03330448f4b094e521b08b5fe1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367930, "uuid": "30fe2b90-0b98-4ac8-bd29-78a748fcfb3f", "comment": "Malware payload (Mirai)", "value": "67dbeae45c8c1d2e97f1e96ecc54250a62d474302bee97e344c4c3934b9e36c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367930, "uuid": "85b6574e-c96d-4443-87c4-1246446e4fc1", "comment": "Malware payload (Mirai)", "value": "fe914e9ef904a016ac68323b1195eb43fa5f9576", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367930, "uuid": "c6f7905a-2df0-40bf-b636-1a0b0f612563", "comment": "Malware payload (Mirai)", "value": "94663938fb60cb2fbcfe03335e14a92a9e2fa84bd9a9674baee7bd53b9a7aec1e80491cf9a7e92f288abb98bde387e43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367930, "uuid": "cf0637b8-1fda-4035-b49f-294039e7c3e6", "value": "T1EB338C71F8291E54D15642B4A4288F352F23E2C893933DF356A1C3B28017AADF91EFB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367930, "uuid": "c108a643-c18d-4065-8ad4-6272563f4a8a", "value": "1536:mamyClrLp7wnwio4d27X1ol+3XXCr/3a10:mVyHH2oM3XXmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367930, "uuid": "f39a991f-4cdd-4bb7-884a-8f8e914fedaf", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367930, "uuid": "17576995-775d-4bfe-8fa9-77a9a7ec3ccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367930, "uuid": "38d909b1-0c0e-495a-bbce-5d1ec94ada33", "value": "421a1b03330448f4b094e521b08b5fe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d1b5fd-fcaf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713354023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354023, "uuid": "365df619-56f7-43f0-8ba3-6e6a1b014866", "comment": "Malware payload", "value": "ba9299f5aca9d493bf47a6fc09477aa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354023, "uuid": "6b62950a-1ce2-40b6-bc08-e959df055491", "comment": "Malware payload", "value": "689fc6569e607d322b57868bcea1731e6f96a1b3e61cc0827fdb5e862a2beb30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354023, "uuid": "f6db416d-a37d-40eb-b61a-62760ed4a4e5", "comment": "Malware payload", "value": "ecba5a76e63f1bc51afca348f6878b2ad9d1c811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354023, "uuid": "3324baa7-2f2a-478b-91fa-e7895b7412d7", "comment": "Malware payload", "value": "ff3252160a5fadd3b1960d9983b36dce052c90d00359693d4363b4094e5f492d308b14924a1429630aedce4ae63bc7b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354023, "uuid": "12024ac8-28fd-4118-983d-86de200888bf", "value": "T1F9149B65DCACB5F4C0811D32E521CE92CCA5CEF9C9BA792A8ECA3457D9B27C4C1BD940", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354023, "uuid": "3935ba19-5d3c-4665-85b3-d50c13d29cc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354023, "uuid": "09a45e61-31d6-4ea9-a513-424c13927dc9", "value": "1536:O6OId6RN/afO3JjmJXuHcCGfCOQ0sgUi1+JlwdMBSMupfbNQZBSOxXjpFJ3phKVR:3Ora4JjeKQ78tBbKMkE8t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713354023, "uuid": "669abe97-fcf5-4eb9-97ac-1afd76160034", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713354023, "uuid": "d490c225-5f95-4331-9939-e8247f4fc62c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354023, "uuid": "63e297c3-78be-4e54-aeb9-e4d34a0ee49e", "value": "SecuriteInfo.com.PossibleThreat.25391.27908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e96e5b0-fd12-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713396690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396690, "uuid": "62b3f344-ca7a-4ab7-a211-d817d0634ac1", "comment": "Malware payload (Mirai)", "value": "88709fe05e8900f4f1b48ccf0ae3c7f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396690, "uuid": "4d082b8c-573a-4975-baec-aa789f25825e", "comment": "Malware payload (Mirai)", "value": "68f0d4011f606ff57f7fc04e03aee497c29ff2d2640a3cee6e65df8f830e0d0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396690, "uuid": "577a1b78-06e5-4b92-a13f-623308183665", "comment": "Malware payload (Mirai)", "value": "fe6661c30748e6b66d83d1e85a1bdd3e09be4423", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396690, "uuid": "eea6cafb-0bec-4629-beac-5e866ba3f23c", "comment": "Malware payload (Mirai)", "value": "149ed85f83f0759eafd59e689a54e111f21ec7dff710eace87cb1cdb75f5b42e54e69fe9d819f32e7d17b5bb2ee756d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396690, "uuid": "939fa56e-3ecf-4ab1-b1cd-6790154820ff", "value": "T1D9E3E83727270A23C0D9507002E74333AEB5DF8724B85297AAA07E9C6F375943996BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396690, "uuid": "486e1d7f-be41-4cd0-8f11-04ee73c78494", "value": "1536:/IOHljrVnQR65FV9X1sgQe+wkxf92qRtYRptC+LJ7WyMguRHysMpJ6UmUwMtiIbH:g8vz7t2le+9Ryl7WnAJ9mUwMtrwBNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713396690, "uuid": "286487d2-2697-4c78-8988-70d911da529e", "value": 145317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713396690, "uuid": "99461636-f7d4-480e-b9aa-dc82a6b9c88d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396690, "uuid": "a1664afe-0c4a-4e6f-a0ae-c6e165188408", "value": "88709fe05e8900f4f1b48ccf0ae3c7f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905b131e-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713353717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353717, "uuid": "8eb0bf26-c7eb-40fa-a187-1f3d6b258564", "comment": "Malware payload (AsyncRAT)", "value": "a1d7d1e4286076ec061ceb06d111e775", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353717, "uuid": "940a258c-0854-4678-b9b6-291070fbb777", "comment": "Malware payload (AsyncRAT)", "value": "69a3929ef1219159e606fb0b5f66c37baeea26e69a0e544f113d0102e38505e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353717, "uuid": "d43cb70d-d8a0-47ca-9724-e815cfa05e1c", "comment": "Malware payload (AsyncRAT)", "value": "bfb2cf0436607e478b056414bcb3540c8a75473a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353717, "uuid": "c3e38729-f6e1-47c5-88fe-0447bf83fe9f", "comment": "Malware payload (AsyncRAT)", "value": "175f7ceccc5a02930f754b079e963ffc0c30b3d9f00d2bccf963a2531a5a4cccdcf0947cc60d97311d0158dc0079b15e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353717, "uuid": "325be7bd-e942-4aa6-92ff-33789c920cfc", "value": "T197234A8877E48A15D6FF6BF92973A2020631A903AD13DB5E0CD49A9B5F33B804E417D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353717, "uuid": "80a52a09-a4b5-47ea-a340-216c168e80c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353717, "uuid": "aa110e55-a2be-45c6-9bb9-6c74463aba63", "value": "768:gfNadYHyxeERAYULgsVlc0ItSFNt9h71XE6yOAhaYQXCsd:gFaeEGYwxFT97XE6yOA3Qxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353717, "uuid": "e0cc7a46-00dc-4792-a51d-dcdb5f10b70f", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353717, "uuid": "08ca29b4-9a90-41c8-8be1-6381470ab61c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353717, "uuid": "38c374cf-1700-4d45-ba42-7625e6d27766", "value": "a1d7d1e4286076ec061ceb06d111e775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0a6179-fca6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713350465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350465, "uuid": "b87bcc00-3e41-49fa-978f-cbe72f015742", "comment": "Malware payload (AgentTesla)", "value": "38a8ceb310b422f0b748451d49f84556", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350465, "uuid": "c1175d1c-2431-438e-a474-50addd3ed7b4", "comment": "Malware payload (AgentTesla)", "value": "69a939ec3215ff1248cbe31b69cc8173887ba9694abb1b9a575828934f8a2c20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350465, "uuid": "62b26365-9c3a-4b82-a530-534b0564095b", "comment": "Malware payload (AgentTesla)", "value": "958f37cef534c5b3d12d2c0a8289b27d0ba7989f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350465, "uuid": "855c8ff4-8040-4c68-be43-b5e2a7d366ab", "comment": "Malware payload (AgentTesla)", "value": "7fa9675d84f7bb20985d3727d1dc4ad3e9dd23b4abbf4f0aab3584918c4d7e39ca6811a1fc6518885207d34470dedf29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350465, "uuid": "046e1167-b35f-45cf-9550-e8fd1b3807b1", "value": "T173E4237E73DC8376C835DFF44A22913143B26D5B2816E68C1EEA65DC28AF361A5D0E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350465, "uuid": "928288f5-9d44-43d9-98d6-04a9f95af688", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350465, "uuid": "ba1b9da0-b58c-400a-8684-9663f4e28bab", "value": "12288:fDDW2T7Ta7zM2E0cNAkVqpAKPAYvQvdRq6tasHJ0KRwbDKNLNYrz2cWjoI:PWy/0Zdrpv8IKC6NLmrzrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713350465, "uuid": "7fd0c75c-5071-4835-971a-117aaf443f36", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713350465, "uuid": "a573a9be-8773-4886-94b5-e30ec73ef4da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350465, "uuid": "53336df3-7367-4680-bd3d-2070a40b069a", "value": "invoice1337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85705333-fcda-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713372596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372596, "uuid": "7a900456-c5aa-438b-a423-be9eaec540a7", "comment": "Malware payload", "value": "89fe382c8842bddaead4c2d51e82f6dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372596, "uuid": "eb5b0017-50d9-4829-9dbe-29bcfe191cee", "comment": "Malware payload", "value": "6abe4b95f1bf4a2bb03468eba8eb72fb7ff3f339cfa1a226dd0ca22e6997b30b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372596, "uuid": "f51813a8-920f-464f-9ec3-d50b37fe993a", "comment": "Malware payload", "value": "6459b07ac70ec643ab4b585170a16914991b8686", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372596, "uuid": "3b8aab2d-af94-4a18-806b-6d7433796c70", "comment": "Malware payload", "value": "3ed6337abbb03b0706ad6a7ac64357762f3d9fb6f1bfcaaffa8c6fbdbf8c60703c5ba7f92fce6eff847db81665c8eb24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713372596, "uuid": "d1ba1b46-ebee-4a29-820a-1e5a068be9d6", "value": "T1159533A35B5954E0653FD03B841FA88F71E8B9D4DC0F6231E098AFB128D5A971423EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713372596, "uuid": "a6196404-8973-49c3-b68c-ff2a291686e2", "value": "49152:T/LqKFCQyDi8ee/zmCLa4yyrChkwl+3r6+Mziv2UaPfz:XzWDaeLmvmWYJaiu1fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713372596, "uuid": "3204580c-7e0e-4a8b-8211-b998100c7fff", "value": 1891108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713372596, "uuid": "608462ab-2813-4c88-b018-b4f3cf1d3cc6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713372596, "uuid": "1922b8fe-6ae5-499e-86cb-5009869673b9", "value": "aab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1f9d25-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713367940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367940, "uuid": "3367cb01-5e28-4430-a473-217306e124b3", "comment": "Malware payload (Mirai)", "value": "6a5a9dbbf2e4d42679b7a96c408fa308", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367940, "uuid": "4956c97a-8ff6-499c-b807-bdd103a37eec", "comment": "Malware payload (Mirai)", "value": "6b4ee1839216de0a56addb06fcfe20df8793edfb7ce7d8186b6854f688556be6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367940, "uuid": "753f2cf7-8800-43b6-abb2-c1a5b36342c0", "comment": "Malware payload (Mirai)", "value": "191664cbcc9e16585b40a342da1ee7169abd915d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367940, "uuid": "cf5694be-3f32-4212-a9ef-ff8bbfc3e780", "comment": "Malware payload (Mirai)", "value": "fbaaae6a9207f842d3ab3e752d11641b93564e6e1df8ccda56d5b009ec65b74b19a02082357e2b321cdb76047933a724", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367940, "uuid": "fe41d432-e756-4643-ae66-59039b602c3e", "value": "T151531856F8914F21C4D512BAF92E254E371617E8E2DEB2239D201F247BC792B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367940, "uuid": "a0ff61d7-ae45-44e2-ac5e-7553967e02d8", "value": "1536:qLnd+gnRugigBISlC9LdDA3DMKi2LC6HF6a10Pa:DgRuSk1SLC6HFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367940, "uuid": "ec754fb7-7b58-4251-b141-8fd9e77fa3cf", "value": 65528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367940, "uuid": "a4f73ed2-f244-4c7e-8082-9e6967a6be93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367940, "uuid": "911c93c7-f86c-4681-8824-d2a868d20ed9", "value": "6a5a9dbbf2e4d42679b7a96c408fa308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e10c7a-fc9b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713345435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345435, "uuid": "5b87d14d-f7b0-45c0-a901-2852a7af8334", "comment": "Malware payload (AgentTesla)", "value": "b1378c703917aad2b39ac60a11ecac89", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345435, "uuid": "7ac001ce-1fb5-4ae8-b292-016887bb2e1b", "comment": "Malware payload (AgentTesla)", "value": "6bcafef0253aaf74e0c13610ac60d5b166f1e408e78ac44f042ee627eb26ed60", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345435, "uuid": "f27c46fb-6b1c-47b8-9f3b-5e08dc0c0798", "comment": "Malware payload (AgentTesla)", "value": "0aaa571398b607d31048ef00636d94fa4a6deee2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345435, "uuid": "5f061848-494a-4949-bf01-eb2cb94a221a", "comment": "Malware payload (AgentTesla)", "value": "9bdb3b6c1dbab610ace46e96be921a1c4b058f77130385d6703d14abf8c14d35d1ee64200199242db302a7ac4b0409c5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345435, "uuid": "91419319-3c11-49cf-8ba2-c17308a77ae9", "value": "T1F25423DC494CE871B0BFAD8455479C033FEE41E4BBA54F6BA0845864DBFAB449829783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345435, "uuid": "0d437530-f4fd-4f8b-9f76-a5373d02505c", "value": "6144:mnLPXIjd01wleZLrxuWYGltmsUdNLPt5Gd7q7X0PBkQ1HRm:mLPIjWdraGl01dpPtG70X8Rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345435, "uuid": "953efbff-0567-4c5a-9d55-d835e9e8a908", "value": 297242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345435, "uuid": "fd83bcb0-d776-4704-a250-1fdd86cba603", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345435, "uuid": "d79b7486-3f18-4acc-b456-1be2a1e126d9", "value": "Eaton PO-45150292964.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82cefcd7-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361425, "uuid": "323704b5-1d58-469c-a95b-7f85484b7dca", "comment": "Malware payload", "value": "f2ff5de09427e8808709764b1c9f6496", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361425, "uuid": "8162e7b7-4fe3-4bb7-8f07-e83cba64f8d9", "comment": "Malware payload", "value": "6bd3297623150aa06df88f84a793f460248913169574d6c9a292c6d1ec55cfec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361425, "uuid": "4f65fc29-5243-41f2-abf5-22eccf787961", "comment": "Malware payload", "value": "a94a56a0ad50d707c2355dded89a0349c3de1db4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361425, "uuid": "8f5189b2-e092-46ef-9220-a06dd760b18e", "comment": "Malware payload", "value": "83c65c4a383ab517ce92abdfeabdabee2de16621ecaeff1bb416cd30ac60afbeca781a06c66ee3488aad2cb5ed16cbd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361425, "uuid": "edc928a3-d353-412f-bace-c3d266895229", "value": "T1E3365B65BD5EE462E6C833783B7193D4323EBC489F4192235610FFAE99F67688F12112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361425, "uuid": "78cca50a-bd1f-498f-9a15-c3a4c3ead4bf", "value": "49152:7H+5dH9Zq/34LCFNoUAFKVCsh5EN2q3OY2NXxB1:r+5dH+/34LCFNoUTVCsXEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361425, "uuid": "2b207b6c-30d4-443e-987e-a6e54c61ca28", "value": 5177344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361425, "uuid": "6fa64713-1c37-4745-9fe8-b03079b3a72f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361425, "uuid": "86880fcc-5ab2-40da-98ed-580a635f3576", "value": "SecuriteInfo.com.ELF.Agent-BSR.32705.13148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90846f81-fca0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713347704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713347704, "uuid": "c2ed2f83-451d-4c29-a4d4-0793914f29bb", "comment": "Malware payload", "value": "879e8ec49af82fad3cba14f8c2660897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713347704, "uuid": "cbad9979-7621-404c-808c-88cac3782483", "comment": "Malware payload", "value": "6c7dec68b134fdac9247bec027c295c5121c0814f2c05e7274caab10f3580212", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713347704, "uuid": "9cb33716-9290-46dc-9277-161cfd1fd77d", "comment": "Malware payload", "value": "afe0e172efb08a300e5b0637289151753b810cfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713347704, "uuid": "a55f9578-f83e-45e2-a893-eb97633dc323", "comment": "Malware payload", "value": "8195c357c5e3db2ba8eb638919d8f9a0ea9209eb36b8e38a311e903352be38e8930b490b59e7e18cf22c55b197bea667", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713347704, "uuid": "2a2846d0-d8be-4a7a-a9a0-d885914d58ab", "value": "T17E159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713347704, "uuid": "0677789b-3fb6-4cfa-9c88-b8763e5085ea", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713347704, "uuid": "bb9718ef-d538-4c85-b8c5-1ed6bfb4d55c", "value": "12288:/qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaSTa:/qDEvCTbMWu7rQYlBQcBiT6rprG8aya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713347704, "uuid": "01687295-9791-41e8-93cf-83e0c2d32b91", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713347704, "uuid": "8c08b59d-9f86-431f-b0dd-08dd699da52b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713347704, "uuid": "8e1c8bc7-e3fe-41eb-b465-b7bb03ae41c0", "value": "879e8ec49af82fad3cba14f8c2660897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6dc9bc7-fce6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713377940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713377940, "uuid": "64f73152-ed46-4929-82d6-b9f7a96d60a5", "comment": "Malware payload", "value": "f9798babee04ced0b65d4e7249aa0ce3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "msi dropper", "colour": "#4F41E6", "exportable": true, "hide_tag": false }, { "name": "network enumeration", "colour": "#A3B1C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713377940, "uuid": "ae06db4b-20f5-480c-970a-aad30e14489f", "comment": "Malware payload", "value": "6d953223090c61bd00ba9a174559e57ce39b794c6fe88880a97487a32b09855a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "msi dropper", "colour": "#4F41E6", "exportable": true, "hide_tag": false }, { "name": "network enumeration", "colour": "#A3B1C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713377940, "uuid": "5a6ca694-a67e-4794-a624-c33e11579c7c", "comment": "Malware payload", "value": "fa8a2f69f4b84ddd241dd7288a01c768404ffedf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "msi dropper", "colour": "#4F41E6", "exportable": true, "hide_tag": false }, { "name": "network enumeration", "colour": "#A3B1C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713377940, "uuid": "2b11bec6-c4d8-4d77-ae78-297348784d07", "comment": "Malware payload", "value": "e1c78db8b1c93c9904afc8d872a5cd454db161ccc8f8f98caa4d35446d2dfc49bb6849eccd0b04bb7a10088a42ca859f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "msi dropper", "colour": "#4F41E6", "exportable": true, "hide_tag": false }, { "name": "network enumeration", "colour": "#A3B1C4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713377940, "uuid": "0d31857a-2460-44a3-ad09-368d669a81f2", "value": "T199214585D890442C53336F66992FF284E9C241220F43E0F9702CFB867F5A6CD525DDD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713377940, "uuid": "7583db6d-4a30-4d6a-a01e-4bfbe66a4e5d", "value": "24:eDP6LgA9cR6VDmgZWtumLmionfSdvc/HHqoozuM9Vgl33zdMArMCCu:i99R6VaoWtusXonKdvc/HHqooyM9Vgl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713377940, "uuid": "b3ebeaab-7809-4ea5-82a9-f85b78ed04cb", "value": 1354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713377940, "uuid": "667287c8-f64e-4646-b458-4ce025c8f796", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713377940, "uuid": "dcd542c5-6f1e-4ab1-84ba-10e50867dcb7", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50dae7e8-fc79-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1713330847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330847, "uuid": "73ce0079-4d3c-409a-8596-6448eba5f8d3", "comment": "Malware payload (Amadey)", "value": "cb2487ebc8a23756a66be03075e5b70d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330847, "uuid": "03428125-e89d-4dde-bd73-6293a2520117", "comment": "Malware payload (Amadey)", "value": "6e1d2a58743dd5b05b0654ae4067d77f7580ba07fe034cd7b068f4a084d9fdcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330847, "uuid": "abba8025-3c2f-4e8f-a8d7-e99facf04e6b", "comment": "Malware payload (Amadey)", "value": "546d98369d3b08424a26558b9386e622803a2df9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330847, "uuid": "71c3427a-9ca5-4b78-aedc-60190e4138cb", "comment": "Malware payload (Amadey)", "value": "1e66698f5d67cf471416f095d6b7085dea11ea24dc170d931ca640afe99cb941e99018e00d0da5b27af2eddf0ffb6f13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330847, "uuid": "78bd4b3c-caa9-44d2-935a-2f15b8f68057", "value": "T1D8A4BF8372E06873F53387724E6DD5B4363EFD628E565B5B27487E2F18B00A0E622761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330847, "uuid": "781d04b3-3b69-45ba-bf2b-26e399d3f866", "value": "15d4342385ed3590f2f3489674cc6c48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330847, "uuid": "7262ce72-71a8-4126-bb0d-95f8a29e1296", "value": "12288:euPbHRtHVoFoYCadwyggBQH6owmsJlZS:eQKF5CadwyBS63lI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713330847, "uuid": "b626ff9a-6509-4ab0-a12c-2230dd07cf40", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713330847, "uuid": "88e87744-0b4a-4815-8f3b-f79552af6993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330847, "uuid": "cd6d3d13-8cda-4bd1-b716-c5e8f29f2f74", "value": "cb2487ebc8a23756a66be03075e5b70d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68d2972-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713367981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367981, "uuid": "c47c07b6-d0e8-4725-8971-4a3d0768756c", "comment": "Malware payload (Mirai)", "value": "a1d5c1a8e6833e8e2c338f2a7022fbf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367981, "uuid": "5984ab28-9f01-4660-b7ce-9afe5e2dc78f", "comment": "Malware payload (Mirai)", "value": "6e45772659f3553505397271009601f75144ed45ef05b401d60638edbd2ca844", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367981, "uuid": "1fa5bf72-3f44-48fb-9e8d-d1126948fe2f", "comment": "Malware payload (Mirai)", "value": "251991f32c131b1ecff1990f064a6bd1d5cc27fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367981, "uuid": "69e93483-6774-4421-ab73-2f6936cf33f2", "comment": "Malware payload (Mirai)", "value": "63e5fc50b5c377a9357ac23a9f59d332d01b8cbec64ce966c6cf1cdf0cbf052c6701480adacabc24ca1eb1365a67b3af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367981, "uuid": "0d72a67e-bbf8-4db1-8c20-ea95ab52a9ef", "value": "T159435B21BA352E17C0D2A4BA20F74B24B5B517DA26E4C61A7DB20F8DFF211506513FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367981, "uuid": "0c64cdb9-717d-49b3-afb2-d0c1231ef87a", "value": "768:6MCvorOQHgTKrdjkoMTfF3u9y3kwR/7eL2w9vpEjmN4gpywO+EZ/Jh+lV0U9YA:pCvtQHGKrdj2TfF3B3kI7QbTYfiV0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367981, "uuid": "3a87d61b-062c-4ba1-8e21-801340e21d46", "value": 60500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367981, "uuid": "4c440747-c8bd-4613-8b44-5b6425fbc0a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367981, "uuid": "855f9ecb-722b-4758-b82c-e34df9852ebd", "value": "a1d5c1a8e6833e8e2c338f2a7022fbf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f160680c-fc65-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713322526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713322526, "uuid": "4fc96f56-f18c-48a7-a378-b1980ac540ee", "comment": "Malware payload (Loki)", "value": "2a4a3291479ab3c056533198f88d7a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713322526, "uuid": "99c31493-014c-4687-8bfc-8b3fced1ef29", "comment": "Malware payload (Loki)", "value": "6f3336aba5c3090b559dcdeb912fb17adcbdc8faa76c2f01379e3bc890b8c74e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713322526, "uuid": "4fcb8fde-380a-4cde-bb34-886922f30c1c", "comment": "Malware payload (Loki)", "value": "eb46327c7c987aa2676690e74bacd0190b3e855a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713322526, "uuid": "e7b3d1a5-ef1a-4c0b-9ead-536c0179d30e", "comment": "Malware payload (Loki)", "value": "93c8202f96046bf61313de2b4bb4c4fcaad990487f696371923ca3e3b2f40e54e778fa7655415aeea866278524510368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713322526, "uuid": "bb3f976e-b50d-43df-bc1f-3fe8829fa528", "value": "T1BAD42290FF9C3A33CD62A9F10262DB704BB272596936CFCE1DD250892AD274153C6B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713322526, "uuid": "78fc6593-d68e-4116-8fb9-169d03c20c19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713322526, "uuid": "5850a183-98d6-4fe2-820d-0f1ba3a41689", "value": "12288:ZGL21ILib0z2cWjoICQmsszslJt6LR+Ny/TYwb/DYNzE8oYQH+8kR:4L21IL60zrA2zslHuswb/yzE8oYQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713322526, "uuid": "1a6f0cea-ac4d-4561-a623-e6d8bf9288a4", "value": 605704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713322526, "uuid": "89e58c21-093d-4e6e-ac5b-ec63381c81d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713322526, "uuid": "74df0570-78db-4413-92f3-fc1e1d953028", "value": "SCTR116509006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62d569f-fca7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713350854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350854, "uuid": "d1568775-a500-4228-a1e2-d06bd94307cb", "comment": "Malware payload", "value": "bca3b499bf4edf8590ad273592fc411b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350854, "uuid": "9a27d23a-5f2b-489e-8ccb-c4b7e7d2f411", "comment": "Malware payload", "value": "6fb6dc7049299c3172ee60c3f0a0319bd33d0c6b2c9836bf0051e59084e6fce0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350854, "uuid": "f77e9713-3127-4fb8-af25-e0d48269c468", "comment": "Malware payload", "value": "c18679cda189f68f8d7022055a7e5d6aff8d1e58", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350854, "uuid": "607ed601-bcee-4b83-96e0-29ed9c473af8", "comment": "Malware payload", "value": "5f44b25a6ca4498d849418e42be682d04f77505e3ec7b36cd2ec4e92e586d48c54a0e17748187162072680d9db4e8f1a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350854, "uuid": "5915b57e-73b8-4303-9f59-d2d4560c23fe", "value": "T12926BF6E97E45E4DAB1B4BE59C3BA7E81942CF01656F86CF15C1CA44E3E8FCA104B390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350854, "uuid": "7348c2f7-df8f-4ef9-b2a9-dbe984dd65a1", "value": "702466d805e925a74c5b750dae64fa7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350854, "uuid": "c4c78855-4165-4f6d-bbfd-88ae7a63dbdb", "value": "49152:pAkKo7fIMLsI7eAJceXxl5h7+JF3HYgijO6WDZwdKYQgf3RjFkhDa+nRk2H8d:pP37fIceAJLkvCO6WDZwdKggh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713350854, "uuid": "dca00b9b-79a5-4037-b0c7-e7804971ac51", "value": 4792832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713350854, "uuid": "038a5d10-41e7-4f2e-be22-1979c54ab952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350854, "uuid": "15d9b7d9-76a5-4f5d-a10b-fe76ed268d6a", "value": "SecuriteInfo.com.Win32.DropperX-gen.16918.1810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f1572f-fcb6-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713357325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357325, "uuid": "f4b45739-6bbe-4767-8847-84804247e78d", "comment": "Malware payload (Stealc)", "value": "686bc5a372f70238970a2bde229977fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357325, "uuid": "703257e5-5dfd-45da-99dd-65aba7d0fa39", "comment": "Malware payload (Stealc)", "value": "6fe192fbca5a63363c6e7e438976579517ba732be8fb3e388717d9875c17389c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357325, "uuid": "720213e2-7187-448d-9449-66e46d9e3844", "comment": "Malware payload (Stealc)", "value": "cd0c281623ac98d8c826f17b668c2797ccb19fbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357325, "uuid": "44b7d277-af1c-40df-8942-aedd3b80c3a1", "comment": "Malware payload (Stealc)", "value": "afa5738b2221c7c6399e9bf9f060c0196223ea7deb95074902bf7689abfdeacbd5ec112352f40ebe7499f62c4a60205b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357325, "uuid": "0777eba9-2271-4d29-83f3-75557b50537a", "value": "T105646C0272D1E470E67347336E6D82A4662EFFAD4E556B3B23485ECF09710A1E632772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357325, "uuid": "adf7dd88-5c09-49d7-a10e-980682d6528e", "value": "f9963a225f61513c7541623aa0db2a94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357325, "uuid": "4e20a1f4-d14d-464b-bf18-d4484f57e18e", "value": "3072:YCBdyfmv9M8mPDbgBh9vI+0PCHdrjMFRw4uXiY+q/cLe+MmwRdDdBz1WG4dfm:qAMngzFIIjMP7NRq0i+MmsHoVdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713357325, "uuid": "ad407d53-9ad2-4e0b-b4f5-07b34551a16c", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713357325, "uuid": "2a0ecd5c-1872-414b-bcd8-c05eed62566a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357325, "uuid": "defdfd94-cc40-4cfb-82c0-8046936cf2d7", "value": "686bc5a372f70238970a2bde229977fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc29e5f-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387914, "uuid": "69de5059-0c5a-40ab-b4b3-54dc271f3d0f", "comment": "Malware payload (Mirai)", "value": "c897fea5ffe7da8decde9579b95d2fcb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387914, "uuid": "321bca22-309e-4954-ad84-f2b66bb267e0", "comment": "Malware payload (Mirai)", "value": "7007fce0513cad2a219289e25572fa7899d07e6589d587d532edd824f9255d11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387914, "uuid": "27a7d5e8-6da6-4214-b53e-71a0ba0c5f94", "comment": "Malware payload (Mirai)", "value": "bdd3b554fcbcefd40ed441bd9822ea30c19b7d1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387914, "uuid": "6af2dd4a-368b-4b5a-93f0-336ef69a8ccb", "comment": "Malware payload (Mirai)", "value": "e2de4c033f9b7ac033d42e90d5a68d7157808b89983fd1fb4bf5cc220bffcc7d4b63e5af35ea5e9fbbe06e108cee697e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387914, "uuid": "a0f78cd6-a28b-4105-b0ee-1a34b1256215", "value": "T19D732B96F8814B22C5D512BAF92E158E332317FCE3DE72129D206F24778692B0E37D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387914, "uuid": "29f28ff0-6eb6-44f8-abca-1e155f063d45", "value": "1536:PgnwqUwB84sGTsDI8sN4YTRdzQaJU1Rz2IhihlxHd25vQ:etBhjwD1rGdzQaJvlxHd2lQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387914, "uuid": "71c52175-8dd4-4afb-a724-38a63d0b6a5d", "value": 75132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387914, "uuid": "22599bc1-b88a-4db3-940b-7eb5c7db2826", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387914, "uuid": "38ba8987-5981-4196-9f7d-2ef74bdda014", "value": "c897fea5ffe7da8decde9579b95d2fcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1902b044-fce4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713376709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376709, "uuid": "c0529b3a-4260-498b-97a3-370b41185136", "comment": "Malware payload (Mirai)", "value": "c23abc48662c5fe6e0b8c54a602ae467", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376709, "uuid": "5a3b15c6-d73b-45df-b7c2-fb5f98117d3e", "comment": "Malware payload (Mirai)", "value": "70763963990658142a5ee4917015d1a2511c09a4ef0709f2a2819be6caa1941d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376709, "uuid": "7eb3a3b3-8c7b-41c1-98d0-187ae3341687", "comment": "Malware payload (Mirai)", "value": "8d1023e2a3c55b726e507aea94d1a181d6df607a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376709, "uuid": "73cb2003-651b-4b3b-9c20-31e56d679374", "comment": "Malware payload (Mirai)", "value": "4de11ed0a3f79c3fd38e015838892aa5576850cc2a9dc4515f43576849bf5b7764fc2784edf7f541a33540b43c998f4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376709, "uuid": "c2a53bd7-b7b6-41f1-80e2-d2638d073e67", "value": "T134F329C7F900DABAF80AE737485309097230F7E145921A3762677A7BED3A19D142BD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376709, "uuid": "b6a3ac22-df96-45c3-ac1d-af367f01fc41", "value": "3072:S6OuJIMBlxOq76QeuacWjcW0JcWcBA72Kl7JGsuGRmVdUKL8rKm8A6jv8+:FEMB36QeuacWjcW0JcWcB82k7butL9mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713376709, "uuid": "28c13824-b1e1-400b-b123-37acd3c77224", "value": 167368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713376709, "uuid": "9788cc06-32b1-416f-96ea-3b285f251330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376709, "uuid": "030824e5-f33b-4038-944d-7d4a6dc42762", "value": "c23abc48662c5fe6e0b8c54a602ae467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df54f3bd-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713368023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368023, "uuid": "858cbfa8-8905-4bf2-a13b-d9dda6346367", "comment": "Malware payload (Gafgyt)", "value": "22a11fef99cfcf02c53ceb571323e1f6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368023, "uuid": "97bcafc3-40bd-44dc-948d-dcaeeb318763", "comment": "Malware payload (Gafgyt)", "value": "713c7a9186a8b3cb5c71204e175661cfdee031178e887f0e8e16b5fce2fb2bbe", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368023, "uuid": "627db1d1-658e-4502-868f-4a27ab2428e1", "comment": "Malware payload (Gafgyt)", "value": "e29ccb20b083138e6a182d0124b533dcdc18efe5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368023, "uuid": "8d573138-a28e-4fec-a422-9ecfa1c176e6", "comment": "Malware payload (Gafgyt)", "value": "54f836fae1f4c9e1a66585c618735a89c3dfe0ea67f97a8b985bcb60db3742f2345e88367a064f551163b32aef38bedd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368023, "uuid": "bd5ffe51-3c87-4fd5-8f9f-46dae7cb4f6f", "value": "T146E34C1775C2CCF6C003897216DFA2515463FE7F0A672143A789BD606F3D99A0A6AFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368023, "uuid": "adecd30a-fb6b-4df6-b342-fb589f52722d", "value": "3072:71ge08g0kIKkPfPXRv+Ul4LVZutJ8adPF4KQTjsSNT2BVIAebjfciNGmS+rk:CYDXR7aDutJ8adPF4fFNT2bIAebjfciC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713368023, "uuid": "2d53dc6a-ff84-411e-99a7-db21bdde55d8", "value": 149768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713368023, "uuid": "febb282a-66a2-44f9-8da9-76be5b17a182", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368023, "uuid": "3376873d-0d2b-4430-887a-9bc00cf67070", "value": "22a11fef99cfcf02c53ceb571323e1f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cb014d-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361428, "uuid": "3ddc96d6-740e-45fe-a525-81a4ea2d1a6b", "comment": "Malware payload", "value": "97a8f67c2c5ab8bed5fd869d6c9810fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361428, "uuid": "38b94f4e-5b4a-42f4-80a2-f42bbb46089d", "comment": "Malware payload", "value": "7581b550e04c1b49797a657ccab8a484d27ad2a18b6661768d52d92e2aa55492", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361428, "uuid": "068a8cd1-665b-49c9-a86e-0ab2e528ed3a", "comment": "Malware payload", "value": "d80368b8e3944becadf255016d5b1476b1864229", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361428, "uuid": "4453264c-05be-4791-b439-1ef7de091454", "comment": "Malware payload", "value": "6364df040dd75b304ee3a40a1a57f68edb05ae15ccf183d6ed9334a3e8de133245de47e3f9ffa589b2edd02b08cd47db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361428, "uuid": "8cb57494-5887-4444-b22f-93203def7c30", "value": "T161363942B7086FA9CA60493385B38ED117727D996F315343AB14FABEA8B63054F15FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361428, "uuid": "6bb454f2-f97e-4d4b-a0d5-06cc205d6a5b", "value": "49152:i2LzgioAq4P670Og/d6I+eFRgjpmbLQYLy28UntKyB1:nLzgioh4P670Og/d6I+wgjpaLy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361428, "uuid": "9f5306c9-8feb-4054-8701-81351e0e7fbf", "value": 5111808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361428, "uuid": "aeb93646-5a46-4cf4-b950-6dfb3578c6b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361428, "uuid": "f5a55d0a-09af-452c-9b8a-3f151c299fda", "value": "SecuriteInfo.com.Linux.Kaiji.128.13152.2632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1da708-fc7b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713331914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713331914, "uuid": "487a9c0f-83a1-45ce-ad04-2a3329b5b360", "comment": "Malware payload", "value": "6f23976152226e51911822cec434d823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713331914, "uuid": "3b2d50d1-e623-4fe9-b17d-61440094dead", "comment": "Malware payload", "value": "75b1e14c1d1eb5d692d67a59ee0676b768351f4f0da6451d157b1cc3399009e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713331914, "uuid": "3e150036-f1a8-4de8-afdc-f0bcc0370157", "comment": "Malware payload", "value": "4ad1937a39bd1ca37f8956fdd4b08ca28d679c91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713331914, "uuid": "93806f8e-6a8f-439d-a0e3-e190c8cc9ae0", "comment": "Malware payload", "value": "c1452686bf4c7163f248d8fdcfe878aa8de6f5fe407c9bdcf7920e391d2ccb11aaa01bb9f4b6b8ae758ff789b9af077c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713331914, "uuid": "0e1bdc7b-e118-46f5-81c1-3c459a2fe9d3", "value": "T17C621943BB848972C76113B03477B66AD63BB9601FD49783AB95A6950F750C0F433B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713331914, "uuid": "5ddb6bd5-8084-4009-9a75-1595a391d23d", "value": "87a7ccd365a74668ac9b2126968e31a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713331914, "uuid": "b8404186-2d6f-4787-ae72-3176e0733b94", "value": "384:0bubLBWKupIDaGUIYzHjoaulzun7xN/fBz:3kpIDadIYzT7xN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713331914, "uuid": "9dc30cd7-1987-4315-aee4-ce8add7bbfee", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713331914, "uuid": "7e3d6e2d-07bd-4bf5-8ed5-156f86d88596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713331914, "uuid": "70876475-ad4b-4f57-b06a-239ab63206e2", "value": "SecuriteInfo.com.Win32.TrojanX-gen.21226.23526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d50b40-fc9a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713345181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345181, "uuid": "e518a850-7876-481a-abb8-a7001daa00db", "comment": "Malware payload (AgentTesla)", "value": "2e691dc165af7323157bdf874cd62834", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345181, "uuid": "e095e75c-a353-4c5a-8418-a9f7131b81d6", "comment": "Malware payload (AgentTesla)", "value": "75dda3b3316361c49ab4d39fc484f5f254c28520855357cc84c31a44198d1c81", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345181, "uuid": "e597280f-5230-4c0b-b9ac-be5134b37a6d", "comment": "Malware payload (AgentTesla)", "value": "123e0879be0e702eee7dbf81dd0335e253d28300", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345181, "uuid": "d2063112-5a6b-4719-bdfc-2411d6932a89", "comment": "Malware payload (AgentTesla)", "value": "bb82fb37802135b2804410a42c19e51d2e41053722ca7245b16a4f195227a0661d48e58bcd7217293e98261ac96cc550", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345181, "uuid": "deeb08e7-4f94-48ef-a9c1-9680b05a024e", "value": "T1E444236D5D79BE14FBA1BAD29F205B3E1A63085C576812B360DC93C428BADC37AD0173", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345181, "uuid": "30776fbd-4479-4bbd-8bf9-8ffb44e25041", "value": "6144:aZlAhDeTzHNydbk5xjHN/aiIKsyR0vTXWyEU:FeTzHNEbqxh/bIKuTGyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345181, "uuid": "f4bb9e67-f5a4-44e6-9296-4db12ce1ce79", "value": 262483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345181, "uuid": "0aa107d5-aae8-4962-9f2b-aed7dee855a5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345181, "uuid": "f2bb54d2-6d62-4947-8410-e2a3e9b4f580", "value": "remittance payment of invoice DMWW24009.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49433ee-fcc4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713363200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713363200, "uuid": "0f81b0af-5099-41d2-94b7-c858f02554a0", "comment": "Malware payload", "value": "b09392c1bf4b70a45ab90a50c5a37126", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713363200, "uuid": "995df789-5c81-4602-bf69-c60b18b1873b", "comment": "Malware payload", "value": "763bbd1106d54e54b510f1a5a184de50bee8752e982010ef6e0cf5706132d6b4", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713363200, "uuid": "f01835da-4ad2-41ef-8d30-f2467ce1b9a9", "comment": "Malware payload", "value": "2ee49d44e7554ee90e48341209bf02fb7157fe94", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713363200, "uuid": "5829dacd-8887-49b1-8869-a85ec4e0812b", "comment": "Malware payload", "value": "7f86d2a53f7522fe99232fc1860ad48b6621d58e15173b653c3db6db9500f8f2be9e09bfc007255a78669a4a49869ff7", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713363200, "uuid": "c4567b8e-c0f1-45db-b4e3-dc1b8fa2733b", "value": "T12464D051FF81870AE855177149F78EAA6221FC419F53470F320CF32E3EB42A95E27A66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713363200, "uuid": "dc53dc8a-9bd8-4dfd-8673-cf0a2510bfb8", "value": "6144:DgunJqJeY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVvFMIgDTiMFe5WP6D+3y:D5JqJ33bVvFMIgD5w+3RRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713363200, "uuid": "f2bb5cb7-734e-4b2f-b2e1-551b68d1de47", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713363200, "uuid": "19c003c2-e114-4e63-aae3-15f189247353", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713363200, "uuid": "63f8d45a-2e8c-46d2-8786-4e6f479dc0c3", "value": "RFQ.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1451708-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713367945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367945, "uuid": "6dd01d6a-72b6-43e7-8eeb-67341c6aebd5", "comment": "Malware payload", "value": "914c5a1b577c2bf655b5e612cdae2dbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367945, "uuid": "0f202b60-58a5-4591-a413-342f0df47e5f", "comment": "Malware payload", "value": "76d783de641dd9225b02c4134608932819610e5b06ec7fe35c3ca54fac026ead", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367945, "uuid": "94099544-ac22-40e3-8275-2959dcac45d9", "comment": "Malware payload", "value": "41641c21839371fabb9c2865e7e81d3c2cc34cd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367945, "uuid": "0038f0f1-b61c-40bf-99b8-018b29ff6af3", "comment": "Malware payload", "value": "53f4acedb1733e9dff1ca605732f316586f5b2df5e7412d6ce61ba0f18f2da64aa729c02c32673fc4d5cde7be1eb6453", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367945, "uuid": "835d0674-93be-41cd-91f5-f3aef2762197", "value": "T16FD32B4749208DB3C001AD72367762545796BEB70F8F1685EA2DB9A04B3B8CE651FFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367945, "uuid": "4222a1df-599c-4d72-9edd-615b75aba8af", "value": "3072:VJRCVE8KEuCWcXO30H+netJ8add9Qzhsi0CcFydKQ5uGBgBwU:VJh8KiYEOetJ8addQn0CcFydKQ5NBgBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367945, "uuid": "5a304ba5-05f4-4571-8fe8-6d5172bcc089", "value": 141842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367945, "uuid": "9827fd89-e405-4b60-8b08-15581ff6c815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367945, "uuid": "26c4892a-bee5-4cf0-977c-bb4c4e1efe5a", "value": "914c5a1b577c2bf655b5e612cdae2dbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a402cc-fc60-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713320114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713320114, "uuid": "1f6f8f3a-2ddc-492b-a24a-43a65ee848cb", "comment": "Malware payload (AsyncRAT)", "value": "bfe9ca3a9060f8b106ef1e7448416289", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713320114, "uuid": "9d9f9276-15b3-4b43-a9e5-0650cf1d2dae", "comment": "Malware payload (AsyncRAT)", "value": "7755538e0afd5973ebc9e8766a817b5b562addfdde5fc3950f4bbffba9790ca9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713320114, "uuid": "17b04721-d27a-49df-b5e9-46d389ad5d35", "comment": "Malware payload (AsyncRAT)", "value": "aa2e83375485435a6bc81aa59e769b4888dc9ca2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713320114, "uuid": "da3780e5-535c-4b6f-b2e3-f036fb4310a3", "comment": "Malware payload (AsyncRAT)", "value": "f71698ce96bdf46ed0f5437e591748f1b7d893d52fe3c787d0c437bb28b27ce19ae738923f400a0ea4b4ec2e039dc4fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713320114, "uuid": "7ff9e347-bab1-473a-b920-836b74c511b7", "value": "T19F34AE112EA0DBF2D177C5B0FE24C6E09B3EB9BD5B7491073694175F6E3C2A0962A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713320114, "uuid": "fb1e56ea-6a4e-4b14-90bd-f6bac5f2bf9e", "value": "9d610f0fc62075f620c7e94e08d0d24d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713320114, "uuid": "ff9817f2-a974-4e65-89ba-a43b3fd6da48", "value": "3072:L0LhLBEcMX2oGfC33bMuLeof5Okopz3Ob:L0LhVMmtiX6JkW3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713320114, "uuid": "2280acb6-27de-4ef8-ae18-f4bc8b3a814a", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713320114, "uuid": "5d20fa89-b772-44ae-87b0-e0f1988debbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713320114, "uuid": "64c38090-6930-4810-9fc4-9fc6761e6162", "value": "bfe9ca3a9060f8b106ef1e7448416289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc91a81-fcd7-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713371132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371132, "uuid": "7bbc1b7e-6e90-41f9-a438-504ff50b9363", "comment": "Malware payload (RedLineStealer)", "value": "9001b4d829eac33f2b06ab34bbef7480", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371132, "uuid": "74d75172-c5d8-4724-bc3d-08ac2d079325", "comment": "Malware payload (RedLineStealer)", "value": "7981bc15a329fe58ae76f26d03fbcab5d7c32658f29a1529d4d83b9e377a81a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371132, "uuid": "cadbdec8-6002-405f-8272-3ac5ca772217", "comment": "Malware payload (RedLineStealer)", "value": "108914745f61a7502a382871345d4af604814823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371132, "uuid": "5e67e0f7-6e5f-475b-950c-de23889c3537", "comment": "Malware payload (RedLineStealer)", "value": "d19a893e15fdb193f9eab3616e5dd33d30dcdb3a11e9368a311b2f310ddeb056031e6088e85518af03b50fa5ffb0239e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371132, "uuid": "a5f59e59-cd31-4ad5-af1c-0b786a9b1b8f", "value": "T10FA35D2067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC164E71FA7B865957FF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371132, "uuid": "54b7fd04-4545-4f41-a7d5-21e4bd7cc838", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371132, "uuid": "b16c7bd9-0dca-42a2-93e1-980140cc2839", "value": "1536:WqsoPqsglbG6jejoigIn43Ywzi0Zb78ivombfexv0ujXyyed2jtQulgS6pE:E2fwYn+zi0ZbYe1g0ujyzdlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713371132, "uuid": "d04a5f30-5621-40cb-8142-cbba7599c609", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713371132, "uuid": "c04098f4-bc81-4604-9f2c-a30c7c72c230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371132, "uuid": "0c8bc7de-8d25-4cb4-b2eb-95f908572e74", "value": "9001B4D829EAC33F2B06AB34BBEF7480.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcd1361-fc7d-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713332717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713332717, "uuid": "a786544a-3419-4a42-aea4-727c16c765bd", "comment": "Malware payload (Loki)", "value": "a9d25742936345bea8b04ccea8d734a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713332717, "uuid": "c8eb4cbb-5ebe-4aaa-87d8-8d9efdb38373", "comment": "Malware payload (Loki)", "value": "79879e8ec6748d39187201ab487066c6376fb1470acb7fc549cef32e4bf87415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713332717, "uuid": "7d8b1ac9-8943-402e-8f03-5a55fcbfd61a", "comment": "Malware payload (Loki)", "value": "3095759333963b09c097ba18832cdc1485518964", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713332717, "uuid": "08c9465d-0555-4c03-92d6-2ac547a79697", "comment": "Malware payload (Loki)", "value": "701ee8125010e16b7b46bda174da5c0e5c42d5be1c3b0a20ef1a0cec37492bce2d2f19d0e477d430eef32361952c4322", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713332717, "uuid": "08353c38-7808-4c4a-ab9f-d239878870da", "value": "T1F5D41226FDACB633C96626F75253A27003B2A3402A38D7DF5DD3F14819D3B1026A5B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713332717, "uuid": "bd0d0a18-d8a9-4339-93cb-2811ff10d866", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713332717, "uuid": "59c76b01-dc6c-4199-88f8-d729a382bf54", "value": "12288:/GL21ILyzQ2cWjoIN7khkqPiFKzuZ3q928rW2A2arldVKOOkJAS1gkR:uL21ILyzQrAykqWTZ3q9frW2A2ar3VKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713332717, "uuid": "efbde3f1-5a3e-4e5e-8d26-d07c3f4d06fb", "value": 604168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713332717, "uuid": "902923e0-105f-4224-b2d7-a5d5ade4a91b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713332717, "uuid": "eee3b63a-2adb-4b48-930a-3ae487300f03", "value": "SCTR11670000pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ce66d5-fcaf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713354028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354028, "uuid": "3b108eea-ab99-4754-93c7-7fe73ae934a5", "comment": "Malware payload", "value": "1df0eeece3ecf6ebe78df3237443a294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354028, "uuid": "aeadd97b-5f06-49ab-803c-218b53387166", "comment": "Malware payload", "value": "799629f172c1d59735b106a202a950dffd2c2d4c5be5177519ea09511c3a0067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354028, "uuid": "eb5979ef-e2b6-4498-9cfe-d17fe83eee5d", "comment": "Malware payload", "value": "20276c71c4043a1d3924c8f570ea36e17f5bc930", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713354028, "uuid": "148af751-b3bb-4943-bac5-2839ae1d101f", "comment": "Malware payload", "value": "47a7177882a634df634db0569d40e9aaac59406c28dfc9a0a12f5e77b99e1463ebb4ecff5f7586014db17eb09ce21832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354028, "uuid": "f15e1d80-0637-4c5e-a2fe-52faa194207f", "value": "T1AE666D43B2C9A539C06A0B7548779A98843FBF3136258C175BF43D8C8F399816D3AA5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354028, "uuid": "07c95632-71b2-4653-b14c-a044a2a0b5b0", "value": "8e5652277a2f5a0e9483ba8efcde97f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354028, "uuid": "752be2e0-e574-4d64-bc7a-9b36dc895b47", "value": "98304:ywwHWFUte4b0jXEFEEpHWg7uudBzDF3pZ1m2/waY:4HybjUGEpHJZl1m2/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713354028, "uuid": "e198214e-9227-4499-b19a-b4ffc9078939", "value": 6604288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713354028, "uuid": "16012ecd-3321-44b4-b46b-6d4b84067b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713354028, "uuid": "edbfeb94-ee0f-477b-9770-7cde86e33efa", "value": "SecuriteInfo.com.Trojan.Agent.26357.23703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c52d075-fce4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713376715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376715, "uuid": "04c96732-25c5-4c34-9c82-e1196de64841", "comment": "Malware payload (Mirai)", "value": "7f73269f6cd3b8823581391924916587", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376715, "uuid": "910d0180-0bc4-42f7-96f2-69c3a1fcd17a", "comment": "Malware payload (Mirai)", "value": "7a4ec3a28d2dcdc4f1629fca569b7400495f5e13bcde568d43c9ea5690366aa8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376715, "uuid": "a1111f08-1518-4236-bd27-676f93578823", "comment": "Malware payload (Mirai)", "value": "afbe2f9a9c730c3855ba26f7615e3fecb4e0f7b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376715, "uuid": "e69ef54a-8ce6-40d6-903c-1372d29d8db0", "comment": "Malware payload (Mirai)", "value": "f1688a7789d21da74c6e214d308e6ac155398d1b201e46405104ffa27079ce600a340d313cfe7ac84a07585901116aaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376715, "uuid": "74e952ca-3404-4282-afaf-440baa311af9", "value": "T1C1E31B56F9818B12D5C111BAFE1E128E37131B78E3DE72129D246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376715, "uuid": "860e5de9-4f49-4a49-8f50-2d7b3c005f4f", "value": "3072:QRpOoacU6ia7eXGOckYcakDZnTZ5C1tAiY6+:QRQoacpVeXpckJasr4tAiYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713376715, "uuid": "1f6b5757-a567-4005-a348-7b8e8460c41d", "value": 148092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713376715, "uuid": "d0b9466b-64fa-47f2-a0f3-7d6910ec302c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376715, "uuid": "5fb7831e-4070-4d3e-a1b3-5a88e9fc64b8", "value": "7f73269f6cd3b8823581391924916587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e81109-fc63-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713321378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713321378, "uuid": "5499f7e9-1ad1-4de4-a035-6aafbc0adeda", "comment": "Malware payload (AgentTesla)", "value": "78f627add2ccdd0f16400418e5f829b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713321378, "uuid": "7c7d5e84-786c-4ea9-a68d-121d52381d7a", "comment": "Malware payload (AgentTesla)", "value": "7abd4b1c93d30c7ab8f817ebcf83262950131614590c9b254f05449ec493818c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713321378, "uuid": "837d708e-2d28-47d6-a6fd-8674bc46755e", "comment": "Malware payload (AgentTesla)", "value": "013aac15ad0a20af80eb1f86cdf27e6159c7ac9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713321378, "uuid": "2c9d632b-2cba-4973-9e77-3acbb148f0b0", "comment": "Malware payload (AgentTesla)", "value": "2ce02bed93cf4bd5bc8a65f5869e5bc548f229667479f97d57434e5246b65edf6b214ed9008f9fd7d034140e6b7ee04b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713321378, "uuid": "76e57360-be4a-4d73-b272-da40c8e712ea", "value": "T156E41308E6BC1A01D19E8B79E45225540376D586D053FF1F7CA45CFA0F2BBC886A4DEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713321378, "uuid": "01cba4d5-6a62-4088-ba11-87107b6aef82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713321378, "uuid": "f51cf6ca-cf98-426a-a790-52af3de26ca4", "value": "12288:FrMrr9rr3owmyqJgA1XzGDWUPh//2dJaDiY4TynUF1wzn68c0BBQXd6Zu3q:MoZwANziVR2dJaDiFTz6vB2XdWu3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713321378, "uuid": "9d662705-d1cd-4b5f-a4a8-6a323ac2aa4a", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713321378, "uuid": "626eade9-a861-4eb6-99a9-1fc4bd0cd91c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713321378, "uuid": "e1e771d9-7d46-473b-a27b-2dc5621c2df5", "value": "SecuriteInfo.com.Win32.PWSX-gen.28055.17747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919f569d-fcda-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713372617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372617, "uuid": "13dc4acd-4115-40a4-892c-398aa3b03563", "comment": "Malware payload", "value": "f4d912c22eee43c92abf8ca741d83fc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372617, "uuid": "2f3a924e-cf93-4b8c-80df-0aa3d0b4b8b4", "comment": "Malware payload", "value": "7ba3a88c0317c036662ff1d718b86080eacb6a19f9ec367f7681b6e3b2b31878", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372617, "uuid": "e53b6ba5-9b61-423f-8fbf-52a1a6f80f10", "comment": "Malware payload", "value": "74a29a15f6ef82348f3d9384b2fc4c59d94980ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372617, "uuid": "e2f59ba0-846d-43b2-9600-2790079fc5c4", "comment": "Malware payload", "value": "9e84616b75bbd247972725d6a43f80d413f0521ebe9f445d913ce1b64cd2f0086915275f34d51749456eedace4d5100c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713372617, "uuid": "63f7cdeb-ecd5-4beb-86c7-f7dcd13ac8c7", "value": "T18C55338CAFA5DC89CC8D45BAD915D5403C2A8FE9A572FE865F516700FB4293306C8F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713372617, "uuid": "76ab6164-f726-4822-aebc-cf516e9cff16", "value": "24576:aGFamIZxv0IXK2nbZ1kp7Kkk95OQbdP89cLyarqu6Tcuvq3czE:aJV90Ia0bZ1kuZOaGLu6TcbYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713372617, "uuid": "16df0f91-dff3-47f0-8f25-849764a95321", "value": 1290612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713372617, "uuid": "209345a9-4508-4be0-b2fe-723f95811d4a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713372617, "uuid": "33c34bda-dd8c-4381-a036-d29cfadffc76", "value": "aad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a7de1c-fc6f-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713326719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713326719, "uuid": "d6275d54-e1ef-4561-8083-59136e66b5de", "comment": "Malware payload (DCRat)", "value": "4f0a0a77c8473028b724fcd4431a5128", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713326719, "uuid": "a7d24f50-7f81-4bed-9130-4037fcea0445", "comment": "Malware payload (DCRat)", "value": "7c0217b4f09d7b5eb5a087c45aed6d13fca45ec3be6e32df510a9ad9a71d6c1a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713326719, "uuid": "1006d9a6-3fbb-4658-b1aa-39c0a5a61213", "comment": "Malware payload (DCRat)", "value": "af1705bf6b02cb0ccc703ebaa55c4ea8c07cb968", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713326719, "uuid": "388f5f6f-546a-48d9-8f9a-9d04ed351169", "comment": "Malware payload (DCRat)", "value": "78c30d5ef02baf9c525530c14c6fae933e7cf98ee57b6fd8b3b51213c307049ee03745a2fde4a0cb2f6bfbd1e8f96bc6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713326719, "uuid": "3f870f4b-c271-43d7-b3cf-c1f5ecacf927", "value": "T1B2D5DF027F64CA51F519123BE2EF854487B0E8516AAAE31B7CBE33AD55123973C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713326719, "uuid": "435c2051-ab5e-4787-8af6-bb4e1de89092", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713326719, "uuid": "73ce7e7c-b77f-40f3-92b0-ae3e39b96d52", "value": "49152:OUK2oQKwtABwKO+0QIvoY3jFx3KNQ8qd28ZaQcULQ45i+PynH4L:OaoQXKfNNYzbaNEdZSeTynY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713326719, "uuid": "b0d2d385-f565-4431-a34d-d05ae6275d92", "value": 2771968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713326719, "uuid": "ea74a876-8e55-4926-acc5-34d9d648ebe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713326719, "uuid": "88acf899-0af1-4d41-9ec9-c011f96cc392", "value": "4f0a0a77c8473028b724fcd4431a5128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea2585b-fc79-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1713330843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330843, "uuid": "584a9314-03f4-4bb3-abc3-4f87924d8fae", "comment": "Malware payload (LummaStealer)", "value": "d05ddc72d9c4fae1ee83e9ac16275afc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330843, "uuid": "b05cc755-bd9b-4c0e-b306-b926058bcdb4", "comment": "Malware payload (LummaStealer)", "value": "7d233935547785aa757807b0a483b8ac5fe9195297f0fc0f53d29931b9dbbfda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330843, "uuid": "f9762c2e-28e7-4ef1-85a6-96021426b563", "comment": "Malware payload (LummaStealer)", "value": "852e1078974794aeaa40a74201efce257987be2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330843, "uuid": "5a5d78e4-dcfd-46dd-9870-9b4d9f87f30e", "comment": "Malware payload (LummaStealer)", "value": "aeea50c7b372c76c1681f1f346e8e830e4388c4e0e8a6dbb6bb323ff6802172d4a0a7d787bad6d5816f4817b25ee0ae3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330843, "uuid": "b4c30c32-e052-4b3c-bc4d-7afb221b7176", "value": "T10164234FC2E96932F6ADC57253B4425B59F1D86038148FA5B428B0FEB3AB7538C0725E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330843, "uuid": "ee5f6567-c7d8-4b2c-851f-14400ec86e4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330843, "uuid": "d103e1e8-54c0-4d9b-a76e-e68249e2e152", "value": "6144:j11lb/L51L7HCaspEUi48UgZUbTtg/N0inheNH1e8EtlcjItq0a0:x/X/f418UgZUG10iOVM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713330843, "uuid": "1a6be2c0-5372-4ef9-8630-fd79f67f90e5", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713330843, "uuid": "d526f908-6064-4f08-b378-db4ca66acc13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330843, "uuid": "7456862c-5b12-41bf-b25f-4a7f52666f34", "value": "d05ddc72d9c4fae1ee83e9ac16275afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40b63cb-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713388244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388244, "uuid": "096098c3-1548-4279-9f6c-a4cc5473bd07", "comment": "Malware payload (Mirai)", "value": "8ea122771d5c6a928d94793db9434d6c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388244, "uuid": "441009fa-aadd-4ebe-b11f-ece41cba830d", "comment": "Malware payload (Mirai)", "value": "7f3e57bdde7a07c2adc37982642f42c1fe23be702b2d018bcdf41c97c0ac5060", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388244, "uuid": "067fb73a-612e-4a82-9dd5-7a5433c0490c", "comment": "Malware payload (Mirai)", "value": "7495ca13b0b7c3091c7c21302b440bca99ec6561", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388244, "uuid": "6b1a61af-482f-4210-b667-d8405b6c5e85", "comment": "Malware payload (Mirai)", "value": "501e3ca1b8ab9f093092a18ed807f5efd73983c79cd84c6e13f097d1c40ec383ab12f1ea0d39e13c505266823bc6aa7b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388244, "uuid": "b61fa5b8-8c42-4e1c-b6b5-bf2231c74961", "value": "T178733B13F69180FDC19AC574072EBA369D23F1FE1238B26A27D0EA233E89D315E5D941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388244, "uuid": "c5f99994-b18b-467e-addd-60f178d74296", "value": "1536:eBRLjegGYqIjitGb6ja5Iac7XiJjdDLK8vyJTGITnekLa+rJUeY/:ELKBYqtYAa5i7XiJdLjyJzekLaaJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713388244, "uuid": "00c2b498-6b1c-4c96-88b6-80a449c51b4b", "value": 80016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713388244, "uuid": "e60ca515-f4d3-4f30-9324-d615330d9932", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388244, "uuid": "19522c51-8920-4f8d-8645-1267d428fcd7", "value": "8ea122771d5c6a928d94793db9434d6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81fdb48-fce3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713376574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376574, "uuid": "16f62ca3-ca18-4cf4-a2a4-654cb6405544", "comment": "Malware payload", "value": "b0192dfad5381f844af4c3af42d9eeb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376574, "uuid": "333387e6-fdf2-4115-a036-efb65d866166", "comment": "Malware payload", "value": "7f9f67d56a0a49554bb85641a21554a478fbdce19ac853e3447fdbffd1dc5434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376574, "uuid": "ce18f39f-976a-453c-8066-6a5f0d60150f", "comment": "Malware payload", "value": "5c31358537aca2ee1bcf759f0580b60a1eb977c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376574, "uuid": "0c5dc46b-ea40-463f-9029-978992af6fb9", "comment": "Malware payload", "value": "26c776d0a6de03fa78dc7178d9381ef01d989c89ac643dc3f893f0114bfb84b3d4a29e35d48db2d93bcb9277e8363008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376574, "uuid": "6b2a3399-1ad0-498b-9fcc-af76ab91a45e", "value": "T16D64F10575C1C471DAB65A310464DBBADF3DF8300E24AA9FB3885AF64F306C2D62AD67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376574, "uuid": "adf320ba-e5b2-4368-9606-c19daabb4f84", "value": "82004e1f718cc406824f64c2578845d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376574, "uuid": "80d0951d-a822-4abc-a042-fd63653af363", "value": "6144:xSK+aNVSVLZ/ywJ5aOiaQiNXnVdLporfmjhax3aE4pX:xSK+pLwwAipVdWcAx3t4pX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713376574, "uuid": "981b3204-88b6-4364-b90a-e7db4f09e0cc", "value": 334960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713376574, "uuid": "a5be75e0-ef74-40b2-b8ef-aee491776663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376574, "uuid": "3b326b98-10a7-4245-9ac4-8a0819781ac4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8075c4e6-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361421, "uuid": "ddc2bdac-65e0-4550-80bf-d130d549098b", "comment": "Malware payload", "value": "247fdabbc08e5c2533772d7e24031998", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361421, "uuid": "f033c2a6-bb2b-442f-b2f3-e180d2972108", "comment": "Malware payload", "value": "8051c19ab1872a1b8a98293b158c59ea6a890234da283855d09d7dca491c151e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361421, "uuid": "39d0778e-4a2d-463a-93bf-13371d3bc8e0", "comment": "Malware payload", "value": "fdb3542a1537fb49526c4796c8b96dbf715a1ad4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361421, "uuid": "7ff16f9e-1c89-4f08-b741-4f32cf9430e7", "comment": "Malware payload", "value": "9eb8f58660d0dacaa337b406fe294bc39236b606a0d2a060823e710e1336f5b7cc929d1e33014955c3854e6ee36644e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361421, "uuid": "187e4ae9-8f06-4301-ac4a-688b286586b3", "value": "T13A5629037E28D71EC62921345EB2CA9467393C9545DAAA13B395F30EA8F20BC595FDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361421, "uuid": "cd663e9f-069a-41d7-8560-7d3789df1f3c", "value": "49152:L3qbSw1zUu72RTScFnsKbyRHzPDPs4coYtJkEk2wBIxWyDp/9zUH+zOuFx83ZIqG:jqO0o2mgDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361421, "uuid": "56479abd-d3e2-4890-ad17-af16dce75302", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361421, "uuid": "329cc2c8-1c59-43cc-b648-6ef7eb52219f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361421, "uuid": "aad17558-7ce1-4530-8e8f-b4bc32394ff6", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.24591.12992.3848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2191b254-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387891, "uuid": "2639f069-11ab-40ce-9d88-93c7f98b139b", "comment": "Malware payload (Mirai)", "value": "8747f4453e8a48d68cdc99984e455139", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387891, "uuid": "fe168f77-36dd-4913-8aff-67c8d5b7bcf0", "comment": "Malware payload (Mirai)", "value": "8075597891b9d8fef3afb1dcd2087e7e1c410561c7f36d2019049628045912ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387891, "uuid": "0035c159-d3b9-4367-83fa-5bf1bf36a2cc", "comment": "Malware payload (Mirai)", "value": "76930872b415bb46a43a743bcf6bf28573151e57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387891, "uuid": "cc12722b-8eb2-42d1-81d7-e5e60c3b1d37", "comment": "Malware payload (Mirai)", "value": "cc06605b0f98c49414f41d80ae47d4b94c5e8e50d6dade38e67816b01cf163a0235533a03f6ea44dc601c9a4e057fcb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387891, "uuid": "61ad1b3f-5875-4833-b399-2d064259f59b", "value": "T1B0932A96F8814B22C5D512BAFA1D118E332317BCE3EE72129D205F2477C792B0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387891, "uuid": "728ed718-8d1d-4ff4-92e1-c8559a929e07", "value": "1536:2h0nWcjlpUQajn9vmGAkc7yk1Yz2nIUZavSArbOQvM0itji3mGq7lJ5M2MSid:2MjlOQ4nVmgGE8IUZavkji3mGqxJC2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387891, "uuid": "98cd4f53-1b63-407b-b41c-3e34852d413f", "value": 91640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387891, "uuid": "07fa4636-c9f6-40e8-8619-378edf51ef0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387891, "uuid": "f1b3c6ce-d5c0-4142-93a7-b224fb3c17ff", "value": "8747f4453e8a48d68cdc99984e455139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7a27ad-fcc7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713364339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713364339, "uuid": "aaaf1c9d-540a-4c55-a9e1-752709363001", "comment": "Malware payload", "value": "3de5358264a41ac85d98c38808182e91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713364339, "uuid": "db083ade-7d00-42ea-91bf-d78e82bfc662", "comment": "Malware payload", "value": "8094a8c981f13553f95aae6130a182b63de1527fc935f48f17b7ca2c9b619b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713364339, "uuid": "a20ba7b3-46b1-46dd-a1c4-794925863c39", "comment": "Malware payload", "value": "0533a6a33bb8806927d47f37518658b2947b5744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713364339, "uuid": "cee72df8-1308-464f-9285-a26067d2dd79", "comment": "Malware payload", "value": "c2cab000e07f6222b74b4f41380f12c0f60bc08064580801c9821d7815ed0c2f8dc2e1b1c3bca56170b3cca28499b8d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713364339, "uuid": "c83f6aee-2a60-4ed3-932a-b22fe3668766", "value": "T1010723C27ED9D2B4D5EB872455C7278E60E0B6D5A1BD960E3EC64C032A30F6B8D09673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713364339, "uuid": "be19ab54-4829-4da4-b292-2a193ae614c9", "value": "38bdd6af544a7f239116d0a0a3d68b09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713364339, "uuid": "db143f65-af31-46e3-b41f-0497dfd1b3e3", "value": "393216:LSVksteh8w2uBbT0XwZEzboiND5deGdeRSbtSnKIpg5HrWF3m3ubs:LSVkdiw2IbTZGo2DneGMSbkKIuJ3ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713364339, "uuid": "7163ab13-a3c5-4cac-8fd4-42a1bbbfcd8e", "value": 17761792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713364339, "uuid": "29f01c1d-6343-4e5d-ad6c-3c1c4717791c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713364339, "uuid": "5c9dfa7f-2304-428f-bd17-d14795989869", "value": "StepClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f9332e-fcbd-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713360117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360117, "uuid": "474beb9f-904c-47ca-b5ff-dc7d3ab0cc29", "comment": "Malware payload (AgentTesla)", "value": "c4ea0b1a6a980d176743c40d6930f289", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360117, "uuid": "e086a5d5-3313-4a2d-819b-b38ae18d0f52", "comment": "Malware payload (AgentTesla)", "value": "815c461885ae99cb392b58031594a3d547dc9d786848fe7685f6f4281ca1828f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360117, "uuid": "d996b860-dead-4d98-bab0-85141f1e96a0", "comment": "Malware payload (AgentTesla)", "value": "f49d7d7b87cb8c771eb7bcf57a7b1ebda942d2bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360117, "uuid": "b1778ce6-5174-4c3d-bfb4-3cb1e1088248", "comment": "Malware payload (AgentTesla)", "value": "c658bca47142cf9fcb1769861057258f358ebc1ab3ef1b0bf896e0a8722df51fbd7ac2eed901b4c1806ec407e3b6e688", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360117, "uuid": "994c0103-1470-494b-9de3-be54d6953f74", "value": "T15EE42344BB25A763F8F8A7F04016856043F37A3B2CAAE70C4DD456FE9276B118861F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360117, "uuid": "5a45a577-d6a2-4333-a02d-dd59a61c4a9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360117, "uuid": "5c1758df-6ca4-46a3-9dc6-f0cc22398bb9", "value": "12288:RyrxaWQ/sjLMGU9WoptnGiNX3LnIiX6KIWhH+LP22cWjoI:yx1HDmtnyk6KIWV+LP2rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713360117, "uuid": "e431d01a-24fc-4818-89cf-483bb19e757a", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713360117, "uuid": "048f3d8d-6318-4cce-b430-a3a0ccdb1399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360117, "uuid": "6b9f6323-9bea-4d32-af65-8d621ea09930", "value": "SHIPMENT ADVICE FOR CLEARTEX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa1e922-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387906, "uuid": "a92f999d-fe43-4cf2-a7b4-99c71ae7a830", "comment": "Malware payload (Mirai)", "value": "00d1f86f94f89a0bc157e9f9a0ba8902", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387906, "uuid": "24fe7ad9-335c-4514-94c3-fd1578526144", "comment": "Malware payload (Mirai)", "value": "82e11ef42181a31afbba5cc941831b149dec6cd4ef5cdfedc7e6c27526b4dbb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387906, "uuid": "1760b9d4-6d0a-4980-835b-efe4bf6338ba", "comment": "Malware payload (Mirai)", "value": "11dad6f9edbd732549ae0c667d2d255c38c2f149", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387906, "uuid": "bdf199e8-3b37-48a4-913a-c5c7bed01d8e", "comment": "Malware payload (Mirai)", "value": "be5296a5449c9dea19dd6597a024b0895290c5e6c83fe6189971d8472044bd95a57a80f2f3ba21cc0a657a4c734a71e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387906, "uuid": "4da0da77-a14a-4285-81af-da77fd218ffa", "value": "T1C4535A32B6360A27C4D1A87A21F74B15B2F547DE26A8CA1A3DB11E5AFF306406543FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387906, "uuid": "df65b31e-8a35-455e-b15b-aed861315f7e", "value": "1536:CbPSQeGdSkW14ZUDd7mgS2Dtsg756tl9ti:AKOBp4sgVsti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387906, "uuid": "d1282068-b6c4-4223-a953-ed661dbd5235", "value": 65460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387906, "uuid": "f98fffd2-c165-4d65-b164-6875f8728fc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387906, "uuid": "cea46ebe-298f-4357-a1b3-8b7a24247c9e", "value": "00d1f86f94f89a0bc157e9f9a0ba8902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c911a4-fc9c-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713345745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345745, "uuid": "64e2973b-0c42-4451-84d1-5d96e01c5708", "comment": "Malware payload (AgentTesla)", "value": "d5db9ee8c6502979187bd03d07242915", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345745, "uuid": "875db3a4-4998-4b05-b67e-c41e899698d7", "comment": "Malware payload (AgentTesla)", "value": "82f32be71d9c226d53658209924e4e534383b0db5481dbd49923692ef5666940", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345745, "uuid": "24ab8f34-359e-4bec-879e-329b4ba63b27", "comment": "Malware payload (AgentTesla)", "value": "85cefbee57f4f4912a81631eb664afdf9962096e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345745, "uuid": "af4508d8-7ed6-4851-9450-7ca866f3e32f", "comment": "Malware payload (AgentTesla)", "value": "361bbb13eb32a69a62f16eedd5029e44a635987a744303985d5db251e8d80a560106b9f33eb96570b4d406317d142ee7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345745, "uuid": "31e4d17d-d800-4c4d-b8ad-e05905084dce", "value": "T129E4231C2F9D5A08C4ED137DA1A2A4145334E696E10BE7BF3ACC10FB1EB67D0649A25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345745, "uuid": "eb56bfa9-8874-426b-8068-031fc0d296c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345745, "uuid": "4cae16ae-fd78-4ab3-a3b0-c79aa4ba91ff", "value": "12288:5sSnEw8i28IGrqd1F1Wlw7OjOv8MoVgNoVsbzGXZdOVVeLZaKk5Tu9:LnEw8i2MrI1F1yw7OjW8M5oUGjOVULZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345745, "uuid": "fc2dfc41-7681-44bc-8e6a-6e5c64c08e28", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345745, "uuid": "aad887b3-acfc-4002-88d6-b6470bcb17df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345745, "uuid": "2fed3107-ee9a-4f09-8948-2e85a02c4045", "value": "AE23SDS04-3 BL.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d91af1-fc84-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713335506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335506, "uuid": "207fa5e9-cc9e-4d11-887e-dad5732347a4", "comment": "Malware payload (AgentTesla)", "value": "f80fa75b20a27db8a2b6ed99d851b325", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335506, "uuid": "1a879950-0640-4a56-8b7d-2f9c5ac0113f", "comment": "Malware payload (AgentTesla)", "value": "83d7c49b200e4da1a0ea724a384ea1736734a37d98e3ce66afa5fc6ff9d1c846", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335506, "uuid": "985c91be-28ff-4037-babc-d7003d229a60", "comment": "Malware payload (AgentTesla)", "value": "66bf49d4e71b62b077c92af79ed51b13b9d3b052", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335506, "uuid": "7b16e035-cca0-4f05-bcc3-7575a2abc749", "comment": "Malware payload (AgentTesla)", "value": "fbffffea649ddb90dc283719e97b42b2bb1d8d358ae75b84fb4a3d79a936cd6145fb63405c1ae1edb82b3ba8d0b89c06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335506, "uuid": "aee9e6dd-d2c6-406f-8cae-86d91b73667a", "value": "T157F42344FF2D3177D6B66AF2055152700BFB646E2830DBCE0E92608B6BE374065D6B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335506, "uuid": "70aae12d-fa54-47e5-96e8-d73278ff84b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335506, "uuid": "5ead7fc1-1893-4d51-9bd0-613c49504b83", "value": "12288:jGL21ILsDn2cWjoIbz6QPOqmJ4DcVNhtuHrqlWqKwaSyxPdRWOgNp/dSz1j4EUU:CL21ILsDnrAX3OqmJ4euHelWqdaBx1Rd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713335506, "uuid": "feef6431-2607-4bc8-a759-a4df9d605dc6", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713335506, "uuid": "86d0d566-e9c4-4ee0-b069-a1fe53d251a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335506, "uuid": "eb5fce36-fc8b-4dfb-ad79-2eff2549f8a0", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b588df02-fcb7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713357644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357644, "uuid": "1688aac8-d7f1-4c4b-87cc-e123b6aae34b", "comment": "Malware payload", "value": "fd27903ede056209aaf7d4c31de2b77e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357644, "uuid": "61172c52-f2cc-44fc-ac88-bffd014b0e3a", "comment": "Malware payload", "value": "86140834126c98d77401f3742c214833b897026828667cd8b6b31bafba64f5bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357644, "uuid": "8b70636e-112e-40b6-b040-37357ac4a14f", "comment": "Malware payload", "value": "88709b506c4e3083e2d5a91f6d6b1b1a423a643a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357644, "uuid": "fbfdb154-c1d4-4ca4-9221-5da15e9cdc55", "comment": "Malware payload", "value": "80024ac3d56d7ca5306837e1d4c170528b42a0fd8959ef32afe291be26321ca17f1c47005566f05d93f3092f853733e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357644, "uuid": "326c9ddb-96c9-483b-8e60-1b0fb79c28e9", "value": "T10446F957E89550E8C0EED174C726A223BEB13499073437E36FA196F11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357644, "uuid": "3ea993b7-812e-4601-bb68-e81c426f085d", "value": "49152:7Xa6xzZWhrb/T4vO90dL3BmAFd4A64nsfJPJ6TdXnT9aqeJaz2xNkapDnYRQoj13:b2ONLBzSxtST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713357644, "uuid": "6aaefcc5-f2cb-4fad-b63d-9d78ad22dfb7", "value": 5435392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713357644, "uuid": "42e88c7a-bcbe-4e78-a505-9dadc19dc617", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357644, "uuid": "53783abc-91cc-4904-be43-39d974147d22", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.24575.2179.13282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f638382-fce8-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713378626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713378626, "uuid": "ac85551d-0a12-4f02-b9c8-a4560edc4353", "comment": "Malware payload (AgentTesla)", "value": "259f46fd4f0450441042a602283c64d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713378626, "uuid": "585b8330-b271-4f99-8d2d-0821e67d0df8", "comment": "Malware payload (AgentTesla)", "value": "870b351d47a9afbc5b250a50a24cdd348ed65d95eecee4cedff4e3191ac927a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713378626, "uuid": "e99938df-d64b-4b2c-9316-8a1f15f92326", "comment": "Malware payload (AgentTesla)", "value": "a16e2004fda4021d79642e51f04eb479eff67975", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713378626, "uuid": "06420da6-5b77-474c-94a2-574dfac37c67", "comment": "Malware payload (AgentTesla)", "value": "85ba9d017c6d2f7e75a1678665e8796c8256d6b038d9d61a323f32d2cb7d0e64ae51c2f0d76ef0efd5815535daf7954a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713378626, "uuid": "af249443-ee7b-4c87-b5e3-d11d2fadb635", "value": "T193E4238A3345A717C438037E5D348A7247F0D1E3654BF2C8BFD1A0FE6BD6B1568628A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713378626, "uuid": "3cdf52e8-6298-4b62-a6ab-f2ecbe513957", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713378626, "uuid": "93178ab1-073c-4224-ae81-3d6f83033413", "value": "12288:cpVnFyHgjly0NfusbxNMAQLQ5QOGm/Fz7ZLK3YR7oy/5nIc:cNyHE8KusbxmPLcQHm/FzdOwjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713378626, "uuid": "73aedcaa-9fdb-4ae7-a7d6-a85372144f8c", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713378626, "uuid": "e0e02664-a97b-4d25-bc90-799a877e999c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713378626, "uuid": "da93e2af-010b-456e-8f23-dc3831be8b57", "value": "SecuriteInfo.com.FileRepMalware.7644.21541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d57519d-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713353685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353685, "uuid": "c72d036b-758f-42d6-aa06-3508f07c8ff3", "comment": "Malware payload (AsyncRAT)", "value": "d0685487fa7e474e68a40a1b1ff49b60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353685, "uuid": "8a62f233-c415-408e-bb80-ae0f9065a88f", "comment": "Malware payload (AsyncRAT)", "value": "87189ae08967742a49ed5e98fc5731af9fa843b4bde08151ac5d16a71f0052f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353685, "uuid": "fc415340-b2ad-4ce8-8ec8-68d6f28401f1", "comment": "Malware payload (AsyncRAT)", "value": "069285708e07814d852bbd5f39a7ffbb3c9e2d94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353685, "uuid": "c4b9a9b3-4c6b-4f89-8d3b-b5ef9a4a6940", "comment": "Malware payload (AsyncRAT)", "value": "4b7ca199b7ad95829ca5426a028e7fe7b2e56e43d91e275fd899ee35bec649e6bbce8a532b641cc2694496a188e7aa36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353685, "uuid": "9b5657a9-b34e-4a90-8689-0f5f53e77f1e", "value": "T15DF3C26937A11044DC6E1F791BA2191EC1BBFEA67E3EE64F5454B66087333C80813E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353685, "uuid": "2ca3d0b6-f7b1-4016-9aaf-a75b5906fc02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353685, "uuid": "475f322e-f2cf-4949-a72f-1b3a40b2e941", "value": "1536:216oQ/DtPFVzE95jNNKCw5VY9bG1wWQkAw6JOXHWIOGoWIFjo7xLFVGy9w04xJXX:ouxFG9Rw3Y9bGVAfOXWxrjCT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353685, "uuid": "22eb7ee3-a812-4d92-a109-a55aec784b5c", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353685, "uuid": "6d1fe279-f73c-4a53-bd5d-5336828fc34d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353685, "uuid": "3214e3c5-8147-42a2-9aa9-e66c92c31bfc", "value": "d0685487fa7e474e68a40a1b1ff49b60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e466c2c-fc9b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713345499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345499, "uuid": "4b16b9a9-2926-4c28-b417-d28e9a6272ff", "comment": "Malware payload (AgentTesla)", "value": "78550899b6e880a7047238f480a12bc4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345499, "uuid": "7b42b0d0-6168-4384-ac16-342a547e485c", "comment": "Malware payload (AgentTesla)", "value": "873353c6cf6b56c98581b7f23fd1ca2987be77e4c0a3e0b8418607abe9e804c1", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345499, "uuid": "791761b1-85bc-4326-bff2-87a051282765", "comment": "Malware payload (AgentTesla)", "value": "020f5124f137eee542c66eb7747d47107c367b6a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345499, "uuid": "b3a7a5d3-0ac3-4f25-b223-7db287e8cb24", "comment": "Malware payload (AgentTesla)", "value": "368d310b1c4cb513ebcbedd9c7d1129dd6560e832d0048b205cf31cabd910a71778894e2a61f2ea2bf4bc5f9b98282c8", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345499, "uuid": "9059185d-7468-4cb1-a7bc-1e024b61632a", "value": "T11F5423469D1AC2F9BD0BFDAFC2B4E6F110BA90172804235506E9EDB0E0F9C4AEF75255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345499, "uuid": "fa8e5bd8-71ef-46db-80a5-e305b3e7f3c6", "value": "6144:YV3nfXmfL1hnq/HtVIsXR+JiRNiuOJJrRQo:Y5XiqzIshuzSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345499, "uuid": "1910de77-746d-4a68-bd65-18b5a9162dae", "value": 297356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345499, "uuid": "c6ace08c-7a17-47ef-8f3e-e4ceb58c0b45", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345499, "uuid": "da1e3df8-511c-42a2-be15-e6acd5683e26", "value": "SAMPLE PURCHASE ORDER.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd3d6e8-fc90-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713340611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713340611, "uuid": "b1abfd0e-87fc-4ae5-94dd-ad3ab5532296", "comment": "Malware payload (AgentTesla)", "value": "e51789e6769e567dfe2ed2cc98b9f4d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713340611, "uuid": "110a642e-e966-498f-90b6-d71bb27f8ec1", "comment": "Malware payload (AgentTesla)", "value": "87455c255848e08c1e95370d6744c196a9d6ba793353312d929e43a4e2c006ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713340611, "uuid": "25972903-1bae-431f-8dfe-a6a3196ab090", "comment": "Malware payload (AgentTesla)", "value": "d021b46c74e131124a7b4c3b6b004ff8e38d5395", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713340611, "uuid": "1c4101be-25a7-4269-8f33-25b961e43eb9", "comment": "Malware payload (AgentTesla)", "value": "f5eebab39b5cbb511b10cf7a57d0a1db8c2d1451604997c056fd8077f8086b1c9fcd828ba2f7e84ec4926332167b139e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713340611, "uuid": "3092d0d4-10e1-4817-8813-aa98cad0613a", "value": "T164041279E87FE48AD8464C7BDD6A359F4B29B10283FA19B2B0754F5A9004E71F272370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713340611, "uuid": "2ee8a428-4685-42f2-9a82-3aaec0ba5413", "value": "3072:7vRtf4KV41iOBoekcHFXJnHbtuzj7yNp40UFI/z/92+xNhNr5+m8hH4:7vAhk6gKnHbQzj7Umxczg+Jp5+mWH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713340611, "uuid": "6b26b9c0-081c-4e8f-bf38-a5b1bc8ababc", "value": 184824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713340611, "uuid": "d68b0578-9e26-4f3e-8f25-ce3bb0da1062", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713340611, "uuid": "3067129b-5a55-4d3f-b477-6aa9e1ba4b17", "value": "Prefer Quotation.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4848ee-fc84-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713335721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335721, "uuid": "5bb9f4cf-654b-4ccc-a11e-5ccfb1f7c08d", "comment": "Malware payload (Formbook)", "value": "dc730ce99454b09b0cdb56ad864393a1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335721, "uuid": "91d81601-90ea-40b1-b29b-64830e687ba0", "comment": "Malware payload (Formbook)", "value": "875354779fb810fdab20845476e3e312f030edf58dcc043b2ea8ac566d95fd9b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335721, "uuid": "c5284892-e995-47ff-972a-4e0814e9eb7b", "comment": "Malware payload (Formbook)", "value": "221a2f95154e2bce9723c5f19d6136984549f745", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335721, "uuid": "0800251b-fa55-48b8-9219-469083db997f", "comment": "Malware payload (Formbook)", "value": "a8e8b74622c7f3fbd9be658c51bd5c783358f6379d71dc40298e4be9e5b8301d0bb11f6fada96709f4dd3faeb777b890", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335721, "uuid": "dd6fdcd4-0d82-4372-b600-f9fda8f02aa8", "value": "T112B3AB1267FA1208F5F77B88A97611340B37BD9AA97DC64C05CC290D1FF3A848865BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335721, "uuid": "ed967fb1-b6a7-4bba-9e12-f397184292cd", "value": "1536:/2ng9U1lBHFcJUJI+YZb5bJ9Gmgz/+rtfRDFqGb5uJZUU0tKl9CP8Z:/DU1DHFUGmgURDFBe0tKl9CP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713335721, "uuid": "e199dfbb-03ff-4f41-9f8e-c0a1f74c71bb", "value": 110068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713335721, "uuid": "11c0479c-6548-49fe-acea-0fec2c249765", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335721, "uuid": "09da51bd-3b4f-40db-861c-19fbea945e68", "value": "TNT Invoicing_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585f3fac-fc84-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713335584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335584, "uuid": "d33c8d48-50f4-41f4-8ef3-5dc96efac01b", "comment": "Malware payload (Formbook)", "value": "aa895435b952a3e1de308f56387529a0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335584, "uuid": "d348ff2b-9121-4ca5-b280-482c6c9bf4f8", "comment": "Malware payload (Formbook)", "value": "88b68de66488d34c48ba9dc56b84f574366402ea49f4f3bb7abdbbb4924df3f8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335584, "uuid": "b12f864d-8afe-421f-9761-b42ab2b84dcf", "comment": "Malware payload (Formbook)", "value": "c07ee9fa1053546bcdaf0404b7fa3f4d154bbb97", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335584, "uuid": "ec658ac5-c0c1-45e2-accf-a16f45c5f454", "comment": "Malware payload (Formbook)", "value": "dd9a9e7d1ebbd5034e3af322d18b9f80417a325732beec5e622d080230916edb72c8605b99e8a08eab047d0c631ac34f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335584, "uuid": "681161d0-a7be-43ed-8ba3-2a912a251118", "value": "T1AB75BF0273819062FF9B92334F9AF6115BBC69260123E51F139C1DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335584, "uuid": "e6c3d64c-6a7e-40ec-bf07-a11b49905baf", "value": "24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8a3vyGrX:ZTvC/MTQYxsWR7a3vyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713335584, "uuid": "86b129ed-663c-4de5-84ba-597bad9719b6", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713335584, "uuid": "ebacdbe9-7b77-4a91-958e-0f0607609402", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335584, "uuid": "8d8a499f-4eed-45cd-a6ba-a99ca39f70a5", "value": "justificanteX-X2024-04-16T133815.900.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143b3150-fc79-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713330745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330745, "uuid": "5c1954ab-1c1f-4a36-93cc-eed78f5502c2", "comment": "Malware payload (AgentTesla)", "value": "3a64b763c78291700bd114bfc3ecdde3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330745, "uuid": "e988cddb-e0e6-45f8-905a-f35ad9e10ac5", "comment": "Malware payload (AgentTesla)", "value": "8bbfa40764eabafad6f90d973784f343b8d7146689f4fd4384da26935b2bca5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330745, "uuid": "57bd414f-823e-4f2c-b3b8-0087aa89913c", "comment": "Malware payload (AgentTesla)", "value": "7260be2d4cf3fbcf231e94a84c8f3cf252163c89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330745, "uuid": "53aa917b-711d-4610-a109-b877211e68dc", "comment": "Malware payload (AgentTesla)", "value": "927a0c18099279a131afbb9a15298ce9c45ce6c5eebd2f6963b7131212faf4e0e01ff72520a140f2c5df6a393a27819d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330745, "uuid": "84fc35b8-79b4-4a7b-a34f-1ec19bc2b73b", "value": "T190C48CC0E98566A0ED59AB356A36CD3542237EFDA874A41D28DE3D273FFB3931022153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330745, "uuid": "ee29479e-31e0-491f-abcb-dd68b284ef84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330745, "uuid": "fbf719e6-7694-4ab0-bb41-bc91937ad603", "value": "12288:bPOq1+u42964kZGQLd6yG6I+GAdP7r9r/+pppppppppppppppppppppppppppppb:bPdlMRZGyd9Z1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713330745, "uuid": "c08db05b-0f71-43b2-94fe-ca90bff6f630", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713330745, "uuid": "82981db7-c611-41bc-a26f-34afe02eb91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330745, "uuid": "8656f400-65b6-446d-b360-9c1a6fc8f6ca", "value": "Eaton PO-45150292964.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a245b9e7-fc9a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713345157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345157, "uuid": "0be70dcf-1877-4905-bd79-ad1165e1ac15", "comment": "Malware payload (AgentTesla)", "value": "c4de2cf29db8a02653a697b5bbabfebf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345157, "uuid": "78e8b95b-b659-4c9c-a685-226ff8caef1b", "comment": "Malware payload (AgentTesla)", "value": "8c4dda23700346f414a8a8a4993bf7d26afa50a4f3a045808f507078041f61bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345157, "uuid": "16c4ffd0-d2b0-4a01-814b-609a763800ae", "comment": "Malware payload (AgentTesla)", "value": "ad63a2eb9b5566f9648da35cdea0b5c831c9df4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345157, "uuid": "0697991c-ca05-4c04-8239-021109d292e4", "comment": "Malware payload (AgentTesla)", "value": "7e7d3340e0d33b0249b7806b5bbac2aed41fb0a63ba0cdecf8b5f70f5383a103e064dcb92f00ca158742e731fd94b461", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345157, "uuid": "cccf8bea-f138-4423-ac48-c581938976e0", "value": "T1B7E4234D63C341F8A2F738BED542E04E2315FDD15CBC728A6297EFB80992575868FA24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345157, "uuid": "a1ffee7b-053b-4700-96d4-94d312020217", "value": "12288:dXs/7DDFyF1G4qkiU/biCsac/9GcOxtQF6x+GYIoXZ0UYgHqwjEdxucM:dXs38PFDiUmr9GcOxNx2DX3YgHqwixfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345157, "uuid": "8fd38996-6ea4-4c03-8a29-11deb3418fcf", "value": 661649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345157, "uuid": "c5282201-126f-4e0c-98f6-b4e6143f27b0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345157, "uuid": "e3dd6748-db12-49e4-b165-c32d6f058c9b", "value": "UPDATED SOA PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03064236-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387839, "uuid": "7f04ad0c-024a-4be8-9157-73e9be8469c1", "comment": "Malware payload (Mirai)", "value": "69093cf8ce568e871aa1f0f470f01ea9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387839, "uuid": "5edfea56-598b-4ba6-aeac-87a9cdc9cf81", "comment": "Malware payload (Mirai)", "value": "8cb30ba3d4e41fff1d38b6795c38c95411bbc09a9ceaf8ccba0bdc271406b4e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387839, "uuid": "00e7a32b-25e1-48cc-b21d-e1a72e3aa390", "comment": "Malware payload (Mirai)", "value": "848c9ea208bb50c986c6340342fb08cc0176ba17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387839, "uuid": "4619e13c-28e2-4762-98c3-a452caba8c18", "comment": "Malware payload (Mirai)", "value": "26026da91d54d9e84dd237dea399332ac1e253f97538cb53d9b9abcfd265b70f78e5c98fe0c1bf448fb1390e34886270", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387839, "uuid": "10db5628-68c6-4e01-a10c-c9be9d0535fc", "value": "T18BB3D61AFB510FFBD86FCD3705A91B0639CC555A22A83B3A3934C92CB54B25B19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387839, "uuid": "d6258766-05dc-4520-847c-c0bbde4b7c7a", "value": "1536:HAXJZtGTIE6xOGydThWA4sojYsztmovggQMqueuZG15SdR7opm7zUb+nKmxSiu:HqJ7GTIE6xIuglueufoupnKmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387839, "uuid": "62f0a748-117d-4b14-af0b-55246bdd0d4a", "value": 110248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387839, "uuid": "86bd02ea-d4f6-44f3-86b4-47cefccbb98c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387839, "uuid": "50abf5fe-3bf2-42fa-bee6-c17a1f89631e", "value": "69093cf8ce568e871aa1f0f470f01ea9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab127224-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713367935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367935, "uuid": "dc226d4e-851d-4937-8071-c9b522837cc0", "comment": "Malware payload", "value": "796e052e18c3283cf04d6d7a16762dba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367935, "uuid": "3b43b8ed-37c4-444c-8d88-2fc4528c6933", "comment": "Malware payload", "value": "8d221729d44dbbf05ce21d9f299865c042795b1a0c524dd9d2a9a858a16d2e31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367935, "uuid": "5a502f95-9492-4124-978f-e32159fa608b", "comment": "Malware payload", "value": "cd212fa5be5f6eccd236bb4e6137d975091510bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367935, "uuid": "419a9763-2387-41cc-af21-b1c7341880b1", "comment": "Malware payload", "value": "19a178c787ae24e2ac443d1e5bcf9ca49190da9e01c6fd0255ae70b5e013ced220327f58cf55d13bd5cc6a59a891227d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367935, "uuid": "d263e898-ca6d-4c0c-80fe-537bc4c73d91", "value": "T142F31A3B26231E13C084087201E31334A9AECFAE34BA17D3ED997D95AF3599435A6FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367935, "uuid": "9cb2ea7c-b206-47c8-839e-98b133c55ed4", "value": "3072:ngAqXqpDToPde3AnutJ8adPF4KQThs2dE07bUSQ07GngfCk:n1qX64wcutJ8adPF4fPdE07bUSQ0KngV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367935, "uuid": "b0f58195-b439-4cbb-81a1-6f4ace69ec60", "value": 163759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367935, "uuid": "fb63a65f-1eec-486b-9ec9-47a604c52573", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367935, "uuid": "2152ff6a-deaa-475e-ba7a-3286013f13ee", "value": "796e052e18c3283cf04d6d7a16762dba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21a6c56-fc95-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713343090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343090, "uuid": "6e86d34f-8f84-40f4-a678-2d871639e5a0", "comment": "Malware payload (AgentTesla)", "value": "358eb055a3e02d64e50036b0a8da8aef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343090, "uuid": "8b6e0eaf-e6e4-43b5-ab7d-46f288eba07f", "comment": "Malware payload (AgentTesla)", "value": "8d2d8c501fada7bdd87729ed2a3ac9e260e595591e2f8d12ab2b6a3c4680fc86", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343090, "uuid": "1605228a-0b78-4eb5-809c-cda47e8403a4", "comment": "Malware payload (AgentTesla)", "value": "5caf890ff7d0d57f706fc5d2c6baca81783e752a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343090, "uuid": "4dcb7dab-062f-4c51-a662-924360248602", "comment": "Malware payload (AgentTesla)", "value": "9e1c5feeb7f5dc30cce84acfd7bdb9a8e2c07f4f566c4152d340d0562aef41418b466745511552b8ce7185ec3a4ab96a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343090, "uuid": "59e7b828-3ce2-4783-b604-1c5a874d0a0a", "value": "T14BE433F5E9A20FFE5F8063EE02412BA56147FC51ADEA9D3201CD40997B2C11CE9679E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343090, "uuid": "34e51770-53f3-409b-98ea-08b63d8a314e", "value": "12288:NWHvzMYjY/Rzy6+KahJNZWWsumicRbgXak60X33Gzyt2LCx9sDwDtOR:ov3Cxy6iLN4WvcRBk6pytsCx9sDwcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713343090, "uuid": "c55365ea-2798-484f-a75a-ea25fcf528d7", "value": 665175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713343090, "uuid": "ecd2e7aa-bed6-49a5-a209-d686a99d2414", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343090, "uuid": "71122321-023d-482c-9db4-ded3c00ac692", "value": "PO00221.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ca8930-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361453, "uuid": "2bdbbe3a-2a41-45bf-a4db-868f49f1574b", "comment": "Malware payload", "value": "54c8fb5823fb2ec4e2530e8f1321f74d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361453, "uuid": "a79e2617-14ec-40a4-9fe7-0c0dcc707007", "comment": "Malware payload", "value": "8d4175a6e419a096e411d746123a8723ebbb8386cb5d58e10a730a702221a1e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361453, "uuid": "f7e94c6c-9927-46b5-8d39-94b2a950008e", "comment": "Malware payload", "value": "05b06eb109597687f53065e42b287259cc871c65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361453, "uuid": "4a6711e5-e96b-4bc7-abb7-5c15db1bf0c2", "comment": "Malware payload", "value": "49d65bfaa5c22ab8710e6a73d5f15b06d7cc2f45b1b87bb2fe3170bf7e6bfeaf8faddb176aa3c927a52d8948851cd71b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361453, "uuid": "85ac847c-432b-4e37-8d75-821de5365096", "value": "T1A4E7330C3E1980B3D9876771F6097F59683E9E1253635E781AD9B383A339325AD02E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361453, "uuid": "97957ca0-7e81-443e-a094-7b1778797f69", "value": "b1acf33ac5d2d07c82422095772ab92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361453, "uuid": "52f28014-76bf-48e7-aca4-35e4b90cbdb5", "value": "786432:0AvxqSeY83w9+gw21eWRvIGU+LBPeCV+sxJ0S8Ys5qDTg2MK4gq65VkE2gElS:0rSb83w9/b1epGUCBP5B4Cc2MPgZeNlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361453, "uuid": "316ab987-7164-4010-b315-7ac5e7c64f4b", "value": 65519800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361453, "uuid": "f83a19a6-f4e9-487b-acfc-0543b8b2acfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361453, "uuid": "01b7f451-20a7-4033-8c1b-9daaae95ecd2", "value": "SecuriteInfo.com.Trojan.Siggen8.16025.23030.8287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6cd2c9-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713353739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353739, "uuid": "32095f13-57cf-4716-bf9f-0c4f3149468b", "comment": "Malware payload (AsyncRAT)", "value": "b3aa8653079137d67f1998dbafeca57b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353739, "uuid": "3ccb53fd-f28e-45b8-9254-88d77dff6fad", "comment": "Malware payload (AsyncRAT)", "value": "8dc0ce77162bd62f1c4aa4108d2f82a3ab64e99b23b6d369a9f8e884b1e7b8c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353739, "uuid": "88817a3a-fb23-48f5-99a6-8454eeb5b40d", "comment": "Malware payload (AsyncRAT)", "value": "c386202ac9c537ec72cd66049d8d97be6c2351f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353739, "uuid": "5ea0e274-a6cc-4b07-afb4-7c1d109d007a", "comment": "Malware payload (AsyncRAT)", "value": "0ba26d92bcb92e3106a8909d070d4fb02b31fa1fd4506e7c79f320e53835f46f41e42579c388d7e0775ce521bd6d9e17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353739, "uuid": "6db18d74-b508-42fb-8653-c1284c6f6d1e", "value": "T1ECF3B2A437A12050DC7E5F385BA2191EC1BBFEA67E3EE64F5454B26187333C84413A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353739, "uuid": "a1ecb652-e067-4a3c-82c8-31275931b450", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353739, "uuid": "440d4839-03d6-48f2-a96e-49877c6b450a", "value": "3072:uVuD8ZKNx6EpT+flldbIsbqOipDQQkEbrjCTo:kEPT0lldbLIDkui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353739, "uuid": "f16be22e-1f75-4d38-97ad-c78c8713b572", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353739, "uuid": "630bebe8-8f40-4e28-b2fe-dae135999225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353739, "uuid": "7eafdf3a-db55-4957-845b-37ed53b012aa", "value": "b3aa8653079137d67f1998dbafeca57b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e55f805-fc80-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713333769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713333769, "uuid": "b886398b-3599-4735-861b-acb9ff8e0586", "comment": "Malware payload (RemcosRAT)", "value": "ee0f619c36e219d029614aaaa9699200", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713333769, "uuid": "23306478-8b7b-4b50-af59-381b9e22014c", "comment": "Malware payload (RemcosRAT)", "value": "8e92afa2cb2358fd64c3e23016c726536072fb3c4d0fcd76f55b5970cf3be704", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713333769, "uuid": "fa3acca7-2e86-4656-846d-86673f0a1d03", "comment": "Malware payload (RemcosRAT)", "value": "8eaace9d066b1d33e17ac896008832c8a9ca66be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713333769, "uuid": "27e8ddc7-04f0-4504-828c-684a2587f7f9", "comment": "Malware payload (RemcosRAT)", "value": "69ee649a1d543cf9ac92fa8f86a59eefaaf3006b740c2ba7534aa11bc29054137d86da4e5dbf7fd53dc22cee8b4062a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713333769, "uuid": "3859dc1c-22b6-4586-b3e8-fc696ee64a9a", "value": "T1F755CF0273D1C036FFABA2739B6AF60556BC79254123852F13981DB9BD701B2237E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713333769, "uuid": "9e8d4244-03f6-461c-9fd8-60fd8f699652", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713333769, "uuid": "cf3d30ba-8391-48ce-8451-51a9f0ef2c55", "value": "24576:mAHnh+eWsN3skA4RV1Hom2KXMmHa7ozVYFNVETk0mCLXnR/wqTWf5:Bh+ZkldoPK8Ya7ozyUmCzBbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713333769, "uuid": "fb766d99-62cf-45ae-905b-fb34ff975515", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713333769, "uuid": "cdb81291-af5f-46c7-bfdf-7aab37cda09a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713333769, "uuid": "cc22ac1a-556e-446c-b7ea-f2280a3827c8", "value": "ee0f619c36e219d029614aaaa9699200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b092492-fce3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713376444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376444, "uuid": "c32f2539-85b2-45fa-87e6-2af44df90f80", "comment": "Malware payload (Mirai)", "value": "86ae2ce87aef895340917c48d11d01f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376444, "uuid": "f9af09d7-bf14-48a7-910f-1fbbf32fecec", "comment": "Malware payload (Mirai)", "value": "8eab8756a80e34658dad5408261a25da3fb64744f66b588295c911a71734a428", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376444, "uuid": "1b1c5b95-5a19-4e4b-be3e-20ad9be0a465", "comment": "Malware payload (Mirai)", "value": "ff8a93d362487def1469a4485cf6868087f5ed5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376444, "uuid": "e394bcfc-a060-456a-81c6-957518a209a9", "comment": "Malware payload (Mirai)", "value": "f0c37c78d22dad570e586eec875a917ac3aec86d984cce9218923b0edde9bbdb4f5baf012db34924e4e504ab55fa7cd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376444, "uuid": "75892d75-2b56-4bfd-862e-69c618517709", "value": "T129C37CB2D8192FA8D024E8B4F4B88FB81B63A58581571FF965B7C3B40487D8DF504BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376444, "uuid": "068349af-24d5-4151-9b3d-dcbccff8f425", "value": "3072:vR4zUjpm+V78EjRLZIO58zzcy9hVlTUW6c:vUUV5JRLFy9xoWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713376444, "uuid": "0f61c7fe-1f52-4079-895b-ebe43e2726a8", "value": 126180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713376444, "uuid": "34d345f6-fa6d-48c9-9bbe-5adeef7d9383", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376444, "uuid": "a80b9180-6f77-4fbd-8ed1-84e1e9289d77", "value": "86ae2ce87aef895340917c48d11d01f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29777566-fc4e-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713312312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713312312, "uuid": "dcc5200c-d86c-4ccd-8ecd-e25693536096", "comment": "Malware payload (Loki)", "value": "abcbfb3d531d8efece1fbe4a775ddc42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713312312, "uuid": "e368d768-56e1-4b9a-afe7-1bc77082b924", "comment": "Malware payload (Loki)", "value": "8eb0fdf0ff3b38ae84311b29effb0030a3b9a38430f7b8ee7918d2eb1301b12e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713312312, "uuid": "be8d0e82-aa4b-4554-a876-53b9e3d985cc", "comment": "Malware payload (Loki)", "value": "6bd0e9ba6e9cb5940a746a798aa382d1ac4ad781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713312312, "uuid": "ea8293b4-5e86-4b01-b60b-241890fbd6ec", "comment": "Malware payload (Loki)", "value": "a7c81f3e3938420e69edca486998d99f34f7edbb014e33dd51446a7eb4f0b735a131e6533b8a40bb3bdb24390fab9045", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713312312, "uuid": "41ffdf53-3a2c-4ca6-8697-960f5140de1a", "value": "T13BC4124C1BF8E700C65C477AE02385198771D2C6A247E71F3AE518FB1DA17E8D489A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713312312, "uuid": "4123958e-58c6-443c-bbe9-2582290ee2a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713312312, "uuid": "386db92a-9693-4801-a808-ee960ac905da", "value": "12288:8JSpOXGHT6O0SoGHndk4OVPw0WrZcKUXh5Mm0uY8jiup6kR:SRXmEInkV09qXhaK+upZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713312312, "uuid": "b1e2a9ff-dcbe-4818-95c6-3869e719519e", "value": 569864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713312312, "uuid": "31a46cb8-e841-4e4b-bced-431610f30670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713312312, "uuid": "7963687f-ed5d-4ba5-86f9-15a2ae925c98", "value": "SCTR11670000pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e51748-fc94-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713342369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342369, "uuid": "83d80a51-9888-4c59-8775-041e56edf8db", "comment": "Malware payload (Mirai)", "value": "6966fbbdf73a15dc33e3cf857be7dd61", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342369, "uuid": "fa76d480-de79-4b2d-94d3-5b05e9d7d7a4", "comment": "Malware payload (Mirai)", "value": "8f680ed38fa9229b7b3b53bf730526be633ff635c35df8537ef98ffb3e58e170", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342369, "uuid": "29f0dcca-7db8-4db5-96ab-00900692af88", "comment": "Malware payload (Mirai)", "value": "f4a4b39a2e162d97074d1b0b50914ecd5538b5f9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342369, "uuid": "78cc8e02-e2e4-499c-858b-73427ee28e07", "comment": "Malware payload (Mirai)", "value": "e035c82f84d766cde27a0b8276c4ac97f28f39ec1e75ee9526cff2b1286c58b98a5ff12452bdb684b16a3124213884f0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342369, "uuid": "d3283bc1-87aa-4cdf-b58a-11ffc261352b", "value": "T1B8F36C06B5C188FEC89AC2B44FAAF136DA31F41D5134B19F67D4AF226E4EE215F2D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342369, "uuid": "43f9d6f9-983d-46bb-b2ce-51daa5fb8b95", "value": "3072:OBj+CxpQTHfigjI+tN5XB09SneKhZoLsiWOi83tz:uaVTH1eKYR3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713342369, "uuid": "505c7031-267f-454d-b329-bf0e70e880e3", "value": 159752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713342369, "uuid": "ca1e9742-d357-4f12-b94b-1f62c9604af3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342369, "uuid": "5ca07435-c52e-408c-b9f9-f51b71dc84b4", "value": "6966fbbdf73a15dc33e3cf857be7dd61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61042c10-fc7e-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713333021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713333021, "uuid": "b14e4efd-998a-4b06-bba2-5d6e1a65f843", "comment": "Malware payload (RemcosRAT)", "value": "ac5b979626e0255c763834243ddf8028", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713333021, "uuid": "d5d71774-629d-4565-82ef-18d2cd5f52e7", "comment": "Malware payload (RemcosRAT)", "value": "8f6edaf7a58a791bf05eb1d5d3bac18561dad46b591bf0a3ed498358fa875e9d", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713333021, "uuid": "a955e6c5-fa03-45db-b161-8661917ffc78", "comment": "Malware payload (RemcosRAT)", "value": "507a1e4daa53d11c2453fd4c707260a5b8f054fc", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713333021, "uuid": "28f6fabd-3dd0-4edc-a09e-4e6596335899", "comment": "Malware payload (RemcosRAT)", "value": "67ca04e1db14789b247d6175da2129d2e44c5ae66c32315402ac40621f2bff6d470ebaccd0d1d295415c8582c80ad011", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713333021, "uuid": "5f8791a6-f3c7-4435-aab9-3de8d47fd0fd", "value": "T11F153920DDD4073E0E5707AEFE910A52C5FD8629462680BDEADE072E61035ACD3BF769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713333021, "uuid": "4fc52c96-330c-47bd-92bf-e6e9bd75f361", "value": "12288:YGS9YA36Oat2ZWorFnXJD5b9NVzWixJ3q+DhXYBauruyZv:YGSSy6/IZWortfbBz7JTFXYUbyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713333021, "uuid": "bdfc7a0d-c7b7-49d7-90d0-86e468df7881", "value": 954504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713333021, "uuid": "d47eee89-2a3a-41a0-b918-939ff9c6cba3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713333021, "uuid": "b433966f-8b24-47d6-b1b1-caf47801afc1", "value": "RFQ NO S70-23Q-1474-CS-P.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00faae0-fcf7-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713385230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713385230, "uuid": "bf9c0e28-777e-46c0-b2c3-cd83f1889718", "comment": "Malware payload (DCRat)", "value": "a440481c46ddfcd031fa591392d1cfaa", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713385230, "uuid": "f5287e2d-be85-4672-a495-5a4cb319076d", "comment": "Malware payload (DCRat)", "value": "913b985da938b934ff7a3174ba08045b21b7fac60748bc618dd34ecbc0b8b658", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713385230, "uuid": "63267743-bb39-41c7-806c-84f1709c7501", "comment": "Malware payload (DCRat)", "value": "249d6439c00bcbe7cc0500b589fb45eb8deaeb85", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713385230, "uuid": "e71a0e81-24bd-4ea9-a7c5-33df3af06438", "comment": "Malware payload (DCRat)", "value": "f5c4f03685e9420a3ce0fcf7e9e0d90252c224629c43503e72a92e238575b861c82dd132f6c28873fc51f1da9f29e47a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713385230, "uuid": "736af8bf-4e47-4343-ad9c-a6ef78b83e9e", "value": "T11FB5CF0699A34E33D2A57F3589D7142E82B0DB22F752EF0B3A4F19D169063319B176F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713385230, "uuid": "efa69c02-86f7-42bb-b996-fa656b47aea9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713385230, "uuid": "2b59484e-3fd9-496f-827d-197e6b308325", "value": "49152:d5H9+Jlsn35Q9LLr4aUT8vHtePTN9DNyNTVGqlzC7Vnp:d5H9+IIIbyHte7DYNpzleVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713385230, "uuid": "30b23a0e-37e4-44ac-a9e2-f853f1907dbe", "value": 2396160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713385230, "uuid": "7b4490b7-0894-46bb-9add-3e7134077427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713385230, "uuid": "92618b6d-5448-48c4-be96-bc5f7281ddf3", "value": "a440481c46ddfcd031fa591392d1cfaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0618449a-fc84-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713335446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335446, "uuid": "25007e0a-7bc2-4a83-8b74-e38daa2d4dd5", "comment": "Malware payload (GuLoader)", "value": "c2f857fc016d526e8d10ca2cae025646", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335446, "uuid": "e8c45099-9eb2-4d91-8e05-96d878765b46", "comment": "Malware payload (GuLoader)", "value": "91cd782ca6e1f6880ab68a75a835d8f5dfa539a5a92c791c3e9a53c326428a47", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335446, "uuid": "65d8f813-b186-4b48-8299-63d86c03532f", "comment": "Malware payload (GuLoader)", "value": "f1434dd87a5070ced5de997c92582937ff486872", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335446, "uuid": "2a3c7b82-516f-4c09-8795-60dee12a83fe", "comment": "Malware payload (GuLoader)", "value": "130d0084b9a5ca17997151e993b4a7d621b3dcfdb1f34488dc4bec8c4d650831edd43d85f8785a9c7b63151123c4b945", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335446, "uuid": "147d3d60-1c99-4b70-8af6-cebc0fd0a8e2", "value": "T17A44F7F08F0A3619CF4B3EFAAC6445928AF55195051628B5AADC07EDB383D2CD2FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335446, "uuid": "1bf2a274-681c-4ee3-9c0e-94033cfdd92f", "value": "6144:2YBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJf08qN:72dOUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713335446, "uuid": "020710cf-cc82-4b19-b631-b5469b215073", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713335446, "uuid": "e10828cc-453d-4135-b555-1e44acdf2b83", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335446, "uuid": "c03dea59-f17c-4ee7-9934-425c644d71ba", "value": "Credit_Details21367163050417024.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a48824d-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713353733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353733, "uuid": "5a640760-3423-49db-9aaa-0f17a428ec40", "comment": "Malware payload", "value": "c79e84a5fbbca0d42bba836d370dcb98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353733, "uuid": "eb4fa64b-7a7f-4164-bfee-cee266f49252", "comment": "Malware payload", "value": "927265bff149a90837ed00916d4105b7fcbd1673836da5bb43061e174a0e65e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353733, "uuid": "402004c1-4dc1-4c11-8a5f-b25f937d6849", "comment": "Malware payload", "value": "4c164669abb73a3809e84ce8890035d18d463029", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353733, "uuid": "0f869936-d1e0-4c7e-9cab-a2b5c7ba741c", "comment": "Malware payload", "value": "d2729d425066413896210c27bee5f4d233290ff188d10c8bcdffbf80e006a085d7912e37a536bc052a75e5f984b94848", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353733, "uuid": "99db1d19-d989-4e6a-81c9-ef32d2934ed5", "value": "T114A332A676A12194DC260F386B66091ED1BBFEE9BE3DE64F4515F6209B333C90017D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353733, "uuid": "168f3266-a868-4b0b-8269-c68b798094a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353733, "uuid": "a5a52ba0-0533-4ca6-8d5b-4f92f762f856", "value": "1536:0zbsCIFjo7xLFVGy9w04xJXrj9u247trpo8pzUm9W:YbgrjCT9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353733, "uuid": "ffcb1898-8f22-48c1-8099-2e3e3cfc504f", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353733, "uuid": "1c7c4a1c-babf-4e44-b21b-ec8b9518fb7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353733, "uuid": "1019a30b-62b5-4aac-9495-d48caa66b4d6", "value": "c79e84a5fbbca0d42bba836d370dcb98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b42ea57-fcbb-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713359238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359238, "uuid": "99fbd6ae-fed7-44bc-8811-3e80bb55b91a", "comment": "Malware payload (Formbook)", "value": "a8809db6753d21dac4df3e442e7613a3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359238, "uuid": "5a5ee273-61ad-4f7c-b8d7-3a2e3c1915a5", "comment": "Malware payload (Formbook)", "value": "929df96a37cff16af2e74eda56cd14ddf50f5f5edad5f61dfe6fa7b6a429d3fe", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359238, "uuid": "9bec4dd2-5b3e-4570-bd03-328dd4511ac5", "comment": "Malware payload (Formbook)", "value": "52ebd28deccdf7d88253df0cc52ff9662a5f2807", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359238, "uuid": "deb8b18b-b916-497d-b803-683dab08725d", "comment": "Malware payload (Formbook)", "value": "9669110822db568857a7fb04ac84b935d992a498c75f32af3dc51c7f2709ca162d737345c93b20b57774279d2fd7ea07", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359238, "uuid": "188eb6bc-693b-4451-be63-805bbc2db0ef", "value": "T1F625BEE8ABB250EEF752D43D39C68EAD71E0EE3419D6091B757DBF1817322918EC2241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359238, "uuid": "63e0d960-301b-4459-979c-4ac6c18ab58e", "value": "24576:WDgVtWN/pm/avooyRDtwZkz2joXW+rU9kOa:hpoxV+r6kO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359238, "uuid": "96d178e8-82ee-4c81-bd23-25de05c770cd", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359238, "uuid": "4e8f4bf6-a090-431e-8fdb-340afb7352cb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359238, "uuid": "eb1ddccb-c5c5-4702-bb42-f18dd97615ed", "value": "1704202412475.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ddf6c0-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361455, "uuid": "99674d8c-90f1-4288-9b89-7320ccf1e570", "comment": "Malware payload", "value": "7960a00b07d97d54601cdaf0d4dfafff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361455, "uuid": "ec69458f-7a4c-463a-b679-a37089f20770", "comment": "Malware payload", "value": "934d11331525ed854f2482d76ee2e65756d32e286f9a176f9ff65124601dea7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361455, "uuid": "64d845ad-b6e7-40b1-a1eb-a5d59c74fb21", "comment": "Malware payload", "value": "46906b559c1fee02e05a393678423f44254a035e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361455, "uuid": "bad7e8d4-7094-4532-a425-9ef3c996e450", "comment": "Malware payload", "value": "09f1e27033af8376e06c7dea09983f0f722f57815377509ab34e039d8c36a5a142917d9333ecb29d59ced70f52c75d64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361455, "uuid": "8ba55c03-9576-4906-bcf3-99d02b4c369d", "value": "T1EA5627037E18D71EC62922305DB2CAD4672A3C8546DB9613B391F31EB8F11AC696EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361455, "uuid": "9b0f09b8-3ef7-4006-95f3-deb3404efc7e", "value": "49152:H2EpH9kX4nazMqH5Erob6XMv7fn3FuL9idt42uXYfTYetBDa9zrHAMnBHsLFnoeF:WEiAQ8MZudhDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361455, "uuid": "0dfdc0aa-1120-47f6-8e92-2a5112063fba", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361455, "uuid": "b6e0a991-575a-495b-bf1e-c1f63359912d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361455, "uuid": "958138bc-525d-45af-9144-da8fa28669ce", "value": "SecuriteInfo.com.Heur.26843.28836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf794cff-fcd5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713370573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370573, "uuid": "5ea1b634-992c-4db3-b62a-16c57060be39", "comment": "Malware payload", "value": "d8531f2aa7b87fced06771c08c65b792", "object_relation": "md5", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370573, "uuid": "8047ab03-41f6-4372-84f3-2d565e700979", "comment": "Malware payload", "value": "94eb56c4cbfc817ed385ac947d2f2e5812ffdae5e3a669c84dc6001f66625199", "object_relation": "sha256", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370573, "uuid": "73cd5f21-d768-4579-af63-5da97fa37a21", "comment": "Malware payload", "value": "0369e8d245511e30bcfe21fee5656ade2c8365b3", "object_relation": "sha1", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370573, "uuid": "db9380db-0c13-431a-9d84-90b1261ce552", "comment": "Malware payload", "value": "c15da43c920886be553eb17318ad72b807b7b748ede00000c7dda68dc601683fd20e074e3e7f56ce64ef31a42c3b359f", "object_relation": "sha3-384", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370573, "uuid": "048b7d62-a72b-439f-aaf6-7d0f259756ec", "value": "T1B6E5334124EBA7871FC4A54FA3F4341F155E84C14607A14B5EEDBE2A6ABA4C8FE7301B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370573, "uuid": "225e52ef-e29b-433d-893f-d26a0e1def07", "value": "49152:94GoV1/DzmI9l7sgtloOvvfvRQtXUnHaZPozsll9WaH5tOEoBK5Ihrcwgogpz2V:94VmSZYyfOwaZtlIaH5tOBnwwgrp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713370573, "uuid": "9263a9c1-505c-4a93-9fab-f7a9e1966f54", "value": 3301247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713370573, "uuid": "fc02aeb4-562f-48b6-a43a-8c26cb80d183", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370573, "uuid": "f8213a17-7f2c-4578-a688-23c4d96d86f6", "value": "Invoice_818493 2024_18605749.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0607e229-fc61-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713320413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713320413, "uuid": "bdd38b3b-b37b-421b-9de8-c009d52397ba", "comment": "Malware payload (Loki)", "value": "3d56d9ae070f55c37fb785f7091c97d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713320413, "uuid": "df71d719-c6c2-42cb-a0a3-4d6cad4969a9", "comment": "Malware payload (Loki)", "value": "9513ea80cc5dabab23c0069ed1b8caaff8d2d10ae9e842bda19a69eb5140a497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713320413, "uuid": "326d614c-04f6-4027-86b8-c747dea19d02", "comment": "Malware payload (Loki)", "value": "73fec7c52fdc153d11b27f3635e321165dbf23a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713320413, "uuid": "6ccf86d7-5e08-4a40-aadb-0ba6d2e1c3b8", "comment": "Malware payload (Loki)", "value": "4845158cd03fd584b191da9a2f707940cf6bf1a7b9bac18226bdc237957df48c6fb724f77a0460354293ecb7d7abcf95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713320413, "uuid": "8cabaf17-18f2-430e-b8c2-154b212cb4e3", "value": "T190C4121C4BB9DA02C5AD0B3EF17695404371F382E802D6AE68D054FE5F923D1D299BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713320413, "uuid": "33bc13d8-86ab-468e-b3ab-e78a0ef55a55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713320413, "uuid": "f6e52b36-010c-48f9-91dc-c59d415e26f3", "value": "12288:a2CxJV1zVtkSy7RlOnC5OE0CpaFKUp5xmlzfGyJa9xLC4uOxJu0ekR:a2CXjzVtm2C57+KUpCfF4uODu0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713320413, "uuid": "66464e5a-53c6-4c45-8159-99f26044ed5b", "value": 568840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713320413, "uuid": "e43549bd-b528-4c05-a8c1-f47608f21ce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713320413, "uuid": "95c5680e-003b-44a1-b844-45aee59a0f53", "value": "Payment Advice1600761165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae14892-fcde-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713374135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713374135, "uuid": "55b13741-2079-45bc-84ca-0fe2a1685a7e", "comment": "Malware payload (AgentTesla)", "value": "85614b7101c98396ed9fdc14222e563b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713374135, "uuid": "47486a1c-b1d2-4992-9103-5463e60180db", "comment": "Malware payload (AgentTesla)", "value": "98206390a847ef2600f916f0076f687d5261ff98ca02b5292fdf44017ca0e006", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713374135, "uuid": "abd429a5-4942-4725-9799-525932f6b41b", "comment": "Malware payload (AgentTesla)", "value": "cbc9f72d36818e6c1918c86bc56178f92802d7b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713374135, "uuid": "cc5552e7-1b48-4cfe-9e40-96c4f38ce169", "comment": "Malware payload (AgentTesla)", "value": "57c842bea6c1bc5d3ca3d50c7bcbb2d023c4c618692ae0f7aa927314c9544a582f0879f923ca566b773671f9921e2e6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713374135, "uuid": "3add3ab6-7a52-4b26-bf9e-9c7d680d8f13", "value": "T158E42309EBE87E21CCDE0732F43630808B71E5719841E75F3ED454EA1EA27C698696DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713374135, "uuid": "9dc36df6-7906-4857-a58f-bc7d77696582", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713374135, "uuid": "c90a1630-9042-497c-895a-b896c6475d4d", "value": "12288:Wb/1eJ5e7nzXD1uARs1XbQfzQfDKDFHtX9dW323tfZXOdaG9uq3kR:Wb/gJgDsR1r4zVXHtBXOf9uqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713374135, "uuid": "671cc69b-91b6-4a9a-a7f1-5ce773901620", "value": 718856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713374135, "uuid": "68fb3e68-b6ae-47cb-a676-c782546a3fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713374135, "uuid": "45164926-91bf-4e64-9740-b892ef7214be", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7918840-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713367956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367956, "uuid": "99dca11f-cdd1-4146-9b67-766580dc2a29", "comment": "Malware payload (Gafgyt)", "value": "353b63fb2faeeeb5820072ca55b8479b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367956, "uuid": "96021800-676c-47b6-a6ce-e6222ebbe378", "comment": "Malware payload (Gafgyt)", "value": "9a25f440c5522db6ab21abef6692be4ac4a0b35feeecdcddfdac7f5c4d7278f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367956, "uuid": "b78bab27-5256-4591-aa16-212800b835cb", "comment": "Malware payload (Gafgyt)", "value": "8e2c35eb80459683ec360c687d80e35039353926", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367956, "uuid": "717f4281-4644-4956-8de1-0f08ba92f5fd", "comment": "Malware payload (Gafgyt)", "value": "3e0f49c370bc7c8f416af768003a89f810f93896398b1b0b22bfbde9166f54d7abbd7f8fbba17932a0cc1ef16a6d89dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367956, "uuid": "3fc0e00a-31f4-43c8-974a-a91b5463db01", "value": "T1C0E33A02F8004767C2C26BF7B35A538D77765EA95BC73341DB287DB02BE07991A39A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367956, "uuid": "60875ee3-62c3-467d-8be7-af5629d8ecb2", "value": "3072:bhNZCmuydtD9la5X52QuL81uyTnetJ8add9Qzhs4PGn5Eo1YX4ZtQ6WQGoQTQk:bzQMQuGetJ8addQ5PGninX4ZtQ6WjoQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367956, "uuid": "9d53b053-b201-457b-86c0-d8a2355040f2", "value": 154426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367956, "uuid": "f3082685-bbfb-4b9d-ae3f-174b0d27e7d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367956, "uuid": "77f2ea14-66eb-4dd3-b0d7-ed5b231175d2", "value": "353b63fb2faeeeb5820072ca55b8479b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53775eb-fd11-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713396352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396352, "uuid": "636666d3-dd5c-4db5-8dbf-e2a46925b34f", "comment": "Malware payload (Mirai)", "value": "c1266e021f3cf4070cd59a4b7c1a3016", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396352, "uuid": "99a67d7a-4606-4354-835b-d9c3c754b4d4", "comment": "Malware payload (Mirai)", "value": "9a76daf3b1f5b77e50ed7deb59476ca65752993dc2f0e4880ad498cce8ffcaa4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396352, "uuid": "0e8ed932-08d1-45cb-9b26-7fd8fc91a8c0", "comment": "Malware payload (Mirai)", "value": "f048cda4fcea58bf7b3472b2bdbda833536faf6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396352, "uuid": "4239fe76-eb33-4a2d-bb86-0f42e6a0a1c0", "comment": "Malware payload (Mirai)", "value": "7934844434701c679efc930ddf7e2b149e44adcb4b648726f7e5c279254aaa9587301c6579e4dbeccb135f9e9e163abd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396352, "uuid": "4e4b58eb-cadc-47e3-ac4d-6e8b9ae0fb29", "value": "T144F3B536A7614EB7D81ECD7301AA85121C8CD98702D92B6FB274E61CEB6BC4F09D3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396352, "uuid": "fa9bc0cf-ba0c-4a83-afda-3e08d1d92744", "value": "1536:D6EudFejh0ot2T/dOVYnMtC2oJshW0UuMbAmOXchQO+b+KL2GdY99jRwhm8iyh8N:DsO82U35aYz9Gm8Hh8dA5Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713396352, "uuid": "55c53e90-f7cf-485f-836b-389163a96019", "value": 171116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713396352, "uuid": "aaa49c8e-0f37-4be3-832e-a9bc1e37d7fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396352, "uuid": "4c7f5df4-1001-45d2-8c9d-21f1a3362343", "value": "c1266e021f3cf4070cd59a4b7c1a3016", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc02c88e-fcfd-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387828, "uuid": "78eb228f-9736-41cc-9a60-b43e3f172f90", "comment": "Malware payload (Mirai)", "value": "257ebdd052ebdf082f1b986174b20c73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387828, "uuid": "54127769-43e7-40ac-b9a4-1802d4e4712d", "comment": "Malware payload (Mirai)", "value": "9b13eba37e412903be23987a66f3a08de9f21acb18febf87eb4c71df4eae28f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387828, "uuid": "f390cd3f-a9a5-44a9-8944-48a09f383336", "comment": "Malware payload (Mirai)", "value": "a2c15071200c000bdb00aee13428974fbeb4a992", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387828, "uuid": "4c43e11d-f7fd-4df5-a35b-2d3c55590609", "comment": "Malware payload (Mirai)", "value": "3d281b43f351618fa453d42f29fcdc034ccad27c046df8a946a4fed649c8450bae9f4a78ecb651076375b6fbe23b0384", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387828, "uuid": "ff9a5fec-b5d0-43fd-bb5a-5daaff3b23a1", "value": "T1EE533A81F8825613C6C012BBFB6E428D3B2657E8D2DE3217DD226F21778AD1B0D67E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387828, "uuid": "511a6f0e-f408-49c0-91da-bd1410c67b13", "value": "1536:cmJ/tB1bk6ZYrWVLxDrvOfoG9L92DY0d:3J/tB+yOflQ80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387828, "uuid": "5eff5620-57a1-4b3d-8ce4-7c1ddf28da12", "value": 63424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387828, "uuid": "922c61f8-cdfd-4714-acd2-00ee3f43607c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387828, "uuid": "f9457176-6e33-4c20-95b0-08ea3abdf172", "value": "257ebdd052ebdf082f1b986174b20c73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ece8b6-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713368005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368005, "uuid": "9f62d57f-cec6-49bc-925f-6c14d118b2c9", "comment": "Malware payload (Gafgyt)", "value": "96723973770291bf1b1b52a331150f25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368005, "uuid": "40846efd-9da9-4ba7-8844-5bc8f8c41366", "comment": "Malware payload (Gafgyt)", "value": "9b303a4c17667c5ffb0d1a9bed11042131e5cfc4c90a5e10b59601bd76c6906d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368005, "uuid": "a20fe648-29ee-4425-9f49-31b518460c3b", "comment": "Malware payload (Gafgyt)", "value": "a8447d2adf533561566a3d63c35faf9be5a8ae83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368005, "uuid": "124f9df6-65b0-4336-a8bb-6349a18abf7b", "comment": "Malware payload (Gafgyt)", "value": "55d171692090b71424ed1d47cbbc70a55c2a54258e00de90dd98dbebaf930f10b5636a6f4e9cb99b4408ee8ac0aca463", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368005, "uuid": "98c72847-0539-42c6-85f3-9b6f3c5837e9", "value": "T1F0D33CC79501C5F3D4030EB32297B66A45B1BE7B485B5A96E71A7CB0DF328863229FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368005, "uuid": "53b3bb8c-8f8a-49d9-be07-f00b8ed7fc46", "value": "3072:mw4QMfKH/URhOmY+169oDUTetJ8add9QzTsgxD0g47KcX6GcgqBK:mwVj0oTeDUTetJ8addQfD0g47KcXJcgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713368005, "uuid": "0c77728a-32cf-4bf8-93d6-19a41d249aec", "value": 133262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713368005, "uuid": "900132c9-ef7a-448f-b520-629706bb542e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368005, "uuid": "dfbbbc90-ffa9-4b1d-bf61-f013177bf394", "value": "96723973770291bf1b1b52a331150f25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad36ad11-fce5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713377387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713377387, "uuid": "087e9166-30a3-44f3-9c39-91eb57801605", "comment": "Malware payload", "value": "804b1a320ca4610b1e44af97fd9c295a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713377387, "uuid": "fac1b324-99dc-4921-8fb0-9ce3b5034f6a", "comment": "Malware payload", "value": "9b8c538cfaba9cfa4fc75ed96b8846f240d0bf3a7f440609964ad31aaabdcfc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713377387, "uuid": "eed251a4-33e4-46e9-8566-640ec6445df2", "comment": "Malware payload", "value": "5be4e86aa94c00cc0fb69292b71ce2581493b144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713377387, "uuid": "bd687aa5-5f27-4112-b865-cb665bfed6a9", "comment": "Malware payload", "value": "6fe12ff73df521c2b7ecf61bdda89d4259f4b0fbf84ab543605b9266bde8794847b90dacf9455b6cd1e52901711b5765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713377387, "uuid": "227722ff-4865-4b15-9619-e28f73948e55", "value": "T14D94020176D08936E5321D364468DBF59E7EFE300E209DEB334896BA5F606C38A65C7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713377387, "uuid": "6cfdbbfe-df7a-4773-892f-dd7b864e1c59", "value": "82004e1f718cc406824f64c2578845d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713377387, "uuid": "0325aa35-fad1-4b00-9424-f8e21add581b", "value": "12288:qy3q/jkZxUcjAWlwTfTLqREbVd09PSVk4po:LqbkZ3ObiRmd00S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713377387, "uuid": "4b612d9d-83f2-46df-8b45-88448ecaeceb", "value": 432752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713377387, "uuid": "4864c31c-1186-4ff3-9e43-53514c1505f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713377387, "uuid": "6c7bf9af-723a-4913-81a2-9be98f3419b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe94040-fccb-11ee-a120-42010a9c002e", "comment": "Malware payload (NetWire)", "timestamp": 1713366037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713366037, "uuid": "543a0581-1502-4ae1-8b09-373b3113ca6e", "comment": "Malware payload (NetWire)", "value": "6fc817f7c53beea30c55d55779cef31d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713366037, "uuid": "c0ccee3b-03cd-4373-ba59-395b9cffd819", "comment": "Malware payload (NetWire)", "value": "9be6abe91db5212e333a086a8f9db157c08f7cf1eeb9020f6cf13444ddab8036", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713366037, "uuid": "fec0df09-46be-4ff2-a982-880cc3dc7a74", "comment": "Malware payload (NetWire)", "value": "ec9f6005ccbc9b8f3286445e9d071c3f3751d52b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713366037, "uuid": "ee44870d-432a-4470-9ae3-1aae4929aad5", "comment": "Malware payload (NetWire)", "value": "ec6f4ca8602b9077d2e8fe4ebd54d69e74fd518e0a3bf458e1872892c7be7c5d8f72a998cb7980cfb74cc31c05beebfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713366037, "uuid": "3881839c-7df9-472d-beda-1a44e8f351ee", "value": "T168A49E37F6D18437D1332A7D9C5B9368AC29BF512D28248E2BE81D4C5F39781392A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713366037, "uuid": "6cbfdb17-7c49-480e-9782-940c17c2730f", "value": "24be007ce5adafbdc5cb90698c601631", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713366037, "uuid": "b868f4e6-cc8b-4e89-854f-018c39d0a5ed", "value": "6144:j2OGscfKNO6bRDnqY9Nt3o9LresPnp4v26BEWwmJR5QeV3rQCVsOI0XlAU9k:27fKNx9+Wz0OsKVElwLVO0XlF9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713366037, "uuid": "9198ae8d-bc0b-4a8b-8249-0c1e977827da", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713366037, "uuid": "ed311511-8cf0-4802-bd9b-66d943060cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713366037, "uuid": "a5cb11ea-87cc-4fb7-b082-bcb38eac5e4d", "value": "6FC817F7C53BEEA30C55D55779CEF31D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3eaf924-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713367977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367977, "uuid": "bc828dfa-4347-4406-9327-3fd0a64173ef", "comment": "Malware payload", "value": "0ec2e5deabf9751adbfe71c34c576162", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367977, "uuid": "adf13081-465c-4e55-bbea-3a7f582b7bba", "comment": "Malware payload", "value": "9c7f1fd869cf1ab94b4f2e55f3626293de4fd52dcbd52b04b3075e01cc76c28d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367977, "uuid": "fd97d3c6-3693-47ba-99d6-19a112e1dc96", "comment": "Malware payload", "value": "e6f582614d529b3d52d672d47d5bebeca16c5a3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367977, "uuid": "352b65f0-04a2-4316-8620-1a293c4bb272", "comment": "Malware payload", "value": "4e827d1818cd04818b811c57353a50b23643a12dce0c57ad6bce99ad875bebb086c56caafe2812608d6882533f71bb72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367977, "uuid": "f05a6ee7-8d2b-48bf-9e3e-08e24d59265e", "value": "T11F04C76A3921AB7EE158863207F76F70C39529E326D19352E26CFA045F7038D185FBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367977, "uuid": "c6c97148-f846-44cb-ae25-0a49722b8ee3", "value": "3072:zAfnKPGD1aiaI0Jc+etJ8add9QzhsIPLpdfi+8qLw/i+L9k:yKOD17ELetJ8addQVFdfi+8qLwa+L9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367977, "uuid": "dbda8cd1-39eb-4038-950a-c9546dc9cad5", "value": 188134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367977, "uuid": "5700eb1d-bc61-42ab-abdd-64784cd42d5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367977, "uuid": "a95bfd24-c663-4f4f-bb0a-3c1ef2490cf8", "value": "0ec2e5deabf9751adbfe71c34c576162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9e98f1-fcbb-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713359430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359430, "uuid": "62f80839-f503-4feb-a946-91eb9f307483", "comment": "Malware payload (Stealc)", "value": "eca5c416b7b17d0308aecd5ee460884e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359430, "uuid": "a826b213-47e5-483a-ace1-3b3ca8e61646", "comment": "Malware payload (Stealc)", "value": "9d5903667ad215ac4efb3346c2179ac6bf5ca7fa3a9efcb6ceec6c53421434b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359430, "uuid": "e94c20a7-bf12-45cf-b4bb-d7baf0f8a6b7", "comment": "Malware payload (Stealc)", "value": "e4fd9437d9157d4817a3398d8b7321dff3c394e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359430, "uuid": "85529e45-37c4-4646-bc9b-f57a61e3cb6b", "comment": "Malware payload (Stealc)", "value": "ce5b19c380d39d7eef1a019a6a4c9b257e7e0b76ac8e492f97694839e0cf35ce16e2feff1486d692e5fbb803612e8f06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359430, "uuid": "c76b724f-90c1-4a6a-af0d-3a1b120295f4", "value": "T1C2647C03B2E16871E57386724F6DD2A4663EFC714E566B3B23485E1F05B10A1EE327B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359430, "uuid": "2c9c9bb6-a264-4601-a9eb-22b8dcd34404", "value": "82db959f3b3344b845e4c7b707536cda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359430, "uuid": "36ccc8a6-b82f-4bb5-8ea6-924135d98cf5", "value": "3072:YVuBDkfmBxuaaLjbgdi/P9+0Pux0FSXpjbxPSjtP10/hGICdMQ9MDPh/flm:Yh2u9goX9fAbMd2hVXFPhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359430, "uuid": "e7ee703b-47f7-4332-b450-b7487cbef96d", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359430, "uuid": "2a727625-9e20-4c32-9dcc-372a88ad4f1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359430, "uuid": "91ab9dcc-ac03-48d4-961a-3249a16fa849", "value": "eca5c416b7b17d0308aecd5ee460884e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa10fa6-fca6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713350459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350459, "uuid": "a4f6b1d2-e38d-41bb-a5bf-17f3b81ea7a9", "comment": "Malware payload", "value": "40e125942c4785ea1108bc6f01ef3f4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350459, "uuid": "18c64d7c-5ce4-4e24-9165-134508269433", "comment": "Malware payload", "value": "9dad5664f3e53495461efac0267783397ec03a94ba182d15679608531435f565", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350459, "uuid": "cc366f30-b100-4f03-a22b-af988504c75d", "comment": "Malware payload", "value": "98ba9d879047ef97fe6795ae38fb14f9ca854b8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350459, "uuid": "5acc2265-2bf2-4572-a08c-309d3eed8d97", "comment": "Malware payload", "value": "48d0e00dcf310101bbe664725b640745a0d1309703308a4352aca199bfeb35cbd15b7831d3771d6e45e1aa35117a6547", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350459, "uuid": "ec75d220-63ba-4f6f-8350-cd6f118e674b", "value": "T19B15233ABF537E7A6BBA5A0031A5180C0DE4BF678654078EE7C7645066472B0CF17AF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350459, "uuid": "ce537330-b453-4221-a299-6e4cabb8fd8c", "value": "12288:PB10t1HgpOZaaIlW0VogJHwHLvVDuV//0RIxLo4UWoVoRE9jbqo9RdlV3x5kcgya:7qaog9KLvdUn0KpoJWvREpZgn0CCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713350459, "uuid": "bdace2a8-2bd2-4050-9c10-aaff29c09e74", "value": 901199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713350459, "uuid": "d6a5e911-53b7-4182-9c96-726b68d2c5ba", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350459, "uuid": "6ee6dcf9-6b4a-4074-b7ff-d450bd4aef3e", "value": "invoice.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6da5878-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713353808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353808, "uuid": "833d33c1-4551-4ecd-b047-10b76eef0fe3", "comment": "Malware payload", "value": "7f430d6532799a7fb913361427060561", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353808, "uuid": "75f917e5-d5f5-4d5d-97fb-bd5f515757ef", "comment": "Malware payload", "value": "9f17adc59d73fb082f330ae7cfc21633c39da53b69eb6e3ba6ecbaf9dcb35316", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353808, "uuid": "5c2e06d9-4ac0-4c28-8396-ed4706c1934b", "comment": "Malware payload", "value": "dfa34e4ee0769efbb1c36abb67442239f8e5fc13", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353808, "uuid": "b77efc49-522c-47c6-8d41-fb043506a6d0", "comment": "Malware payload", "value": "01546667defff10535315ade5d719972b0df65e520297bead2896ed3633621df63df48501d5c5c41e4b590612352b39d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353808, "uuid": "b22c6fa8-3249-4255-a336-5f87da205267", "value": "T13BD4239AD10205114909FCE1EFF05BD68EAE6A85FD308FFD11B9420AD58B38F9CAD365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353808, "uuid": "16c1473a-0d02-427d-a8c3-4e89fbc1e19e", "value": "12288:jov1C1E9f5bIDnSi2KHjBoq2AvZyxT32pX36xfCai53SPiqVimnuEc+9ra:Mvm00LSi2Kdo4o9mJ2f7iJkZwYu3wra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353808, "uuid": "aa4685a1-cde0-4d29-9391-5e90d8b47123", "value": 647368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353808, "uuid": "7f5734b8-b688-4c8f-8829-84c5e7c09a09", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353808, "uuid": "59225dbd-f676-4f2d-b551-37b89e52ea3a", "value": "NEW PO (YST2403-1012).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6f9c44-fc97-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713343756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343756, "uuid": "19d3dc95-9769-4a00-8587-56dc7a15954a", "comment": "Malware payload", "value": "077e766af6083b03837c88f0b3f46236", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343756, "uuid": "ec8cdada-0857-4211-a4c5-5663127771a0", "comment": "Malware payload", "value": "a08f88dd2301ddb93b519f85b8ebe3b769ce1f29bc2b021534834ed4009bbe74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343756, "uuid": "36ee0984-bb4e-4ca9-aaea-95954bf0714b", "comment": "Malware payload", "value": "94caee3fbc3632a068f457f46a4fa4c6034fbcc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343756, "uuid": "dcaf267c-507e-46ff-a3d1-d915688516b9", "comment": "Malware payload", "value": "e0a3bb910500b88f351ca05b4c28fd37271ab0d89b162f35dfc565d52a35b42a81cc839d3d4005d898bbaa5ed260a747", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343756, "uuid": "56ae9ebf-eb81-4ae8-977c-ca7ae640cb71", "value": "T1C7F53341F3C32472F9360A38CD75C4219D6238FC46F1A06A7CF9C99E517669289FAB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343756, "uuid": "5060f2ce-0c6d-4cee-ac44-15b00418eefd", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343756, "uuid": "30f6329e-9adf-4d8f-9a3e-589d64134d42", "value": "98304:vZGEeuuC92SAfa4A2uAomySOYuZlqLxjK:BG3uDk9jRuAcHqLxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713343756, "uuid": "0b957573-bdda-4c7a-b148-c576f4b594fd", "value": 3448760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713343756, "uuid": "4f46aaa7-7917-4414-9a49-a04ea55fd5dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343756, "uuid": "31cf67e6-ca31-433e-8751-234b81cc17f0", "value": "SecuriteInfo.com.Program.MediaGet.165.18422.27510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48ab019-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713367951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367951, "uuid": "bbfe24a6-8af6-464c-baa6-29a8eccd1faa", "comment": "Malware payload (Gafgyt)", "value": "5cb9ae2976b41fe42ad1396cbe805623", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367951, "uuid": "eb0a0c85-6ca6-4eb9-a4a7-42931d54aeec", "comment": "Malware payload (Gafgyt)", "value": "a15c95eebafe63e75fbb0d8e9ab1e629cfa7d7fd9bc3898a5ae2b911eb0ae4e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367951, "uuid": "cd2cb035-891d-4fdd-ba28-b8a1dccbce8f", "comment": "Malware payload (Gafgyt)", "value": "b3175b68429304f40ce406e7ccc295b5d0c5c03f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367951, "uuid": "ca6aa9f0-9e13-43e5-871a-a3d07f0c5fb2", "comment": "Malware payload (Gafgyt)", "value": "954fa1badfb202cce78b7ebabba2f84b213c2c1d7a7ed1f79f72404d9f989ec6036146f664a6c1c41eb49bd5b58627c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367951, "uuid": "5fa89442-1246-408e-8f14-43d7692cd92d", "value": "T1D0042A02D4104767C6C257BAB75B628D33225FE95BC73312CA287DB02FD17AE1A3DA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367951, "uuid": "fda1a41c-c1ea-40dd-b9fa-ad68a440c420", "value": "3072:NzS45xoVVqwe6RiiQaDwEffGjrnsVV2UetJ8add9QzhsyzYmuL1CmyUQ0LKXDmZ:ui3akEmPsVHetJ8addQpzYmDmyUQ0L8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367951, "uuid": "3650c30d-fb1c-4621-bec3-9a2dcda9ebcd", "value": 173113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367951, "uuid": "cd09f6e1-a4c7-4bcb-aa0a-6487f73fbfbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367951, "uuid": "c66f5815-2a90-4278-ba59-be3f71878b68", "value": "5cb9ae2976b41fe42ad1396cbe805623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c53cf7-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload (VenomRAT)", "timestamp": 1713353704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353704, "uuid": "69e25632-b9fc-4fab-8271-a183b6636c87", "comment": "Malware payload (VenomRAT)", "value": "2e5d5abda2f010c8c2cceeb6ff027cc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353704, "uuid": "2f01c0ee-7d80-47bb-b96d-18d3bc5249ff", "comment": "Malware payload (VenomRAT)", "value": "a16509e5f47dfc723e8ac146aef92046a65551452c9692d443dfa64fcc879392", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353704, "uuid": "cc090c4e-3219-4cb8-a853-3b4301485b4e", "comment": "Malware payload (VenomRAT)", "value": "43b36f81335b342de747e4761af0474dc16d6399", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353704, "uuid": "40e9da7c-ef59-4a7b-830f-fe612becb6f8", "comment": "Malware payload (VenomRAT)", "value": "37ee4ee5a42f0aabfb09d955a2beb646bead1c2909118ad0842f8f182fc4e84b84461ef83a852b7b220e2cca38b8c98a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353704, "uuid": "bf7c57a7-173a-4022-8204-6e72ea67fa8f", "value": "T1AE735B003BD98D35F1AE4BB9ACF2514506F4D29B2012CA5E3CC454DE5BA3BC69A036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353704, "uuid": "1bf3ad45-0c88-4164-8f88-678ba7c89692", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353704, "uuid": "e0c2a379-c232-4b3b-b487-aab89653f8da", "value": "1536:fukUsOSeCX/PMRkYKt2OlY6H1bf/iaVbkzkiLVclN:fXU/jAPMRkYv4jH1bfxVbk7BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353704, "uuid": "ea19f7f4-9362-44bc-b1ab-61a49d5b7cf4", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353704, "uuid": "77e18fd5-3769-4f96-9a5b-eb977b69a033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353704, "uuid": "64f9374b-83ed-47f6-9e0d-429c4718105a", "value": "2e5d5abda2f010c8c2cceeb6ff027cc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8606ad18-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361430, "uuid": "99fe7a06-7932-4a7f-bb6a-0fc7b0d0fe13", "comment": "Malware payload", "value": "22345a4c05b312e6ab4d7ad24841c778", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361430, "uuid": "2904321a-d84a-4417-98a6-a3cd04072f03", "comment": "Malware payload", "value": "a3105a70809bf85ae6ac18eaf34c55ca30adc762700b574ac34d635cea7ca701", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361430, "uuid": "53565585-3eb3-4e60-a2c6-bcfdbeca6f0f", "comment": "Malware payload", "value": "e9744f8cb7bc38038a25acc08e0c5c6e925b24dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361430, "uuid": "03fafd6b-5cb4-479c-879d-580565f254f8", "comment": "Malware payload", "value": "6f7a94d399b49b9aaf6163969b19f60725dcc78a98f0e8fdf54af6a332b4cbc38381b4fbf325bfb2b9fa5ffccf917baa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361430, "uuid": "6c7b55a6-f012-4c06-b2c7-e78c80d7d74a", "value": "T1F6361957B8D28642C0E4367AB8BDC1C433A35EB99B9B62575D04FE3D3ABE1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361430, "uuid": "b2041f9a-7f66-433b-83e9-190ba1f1c979", "value": "49152:QtKY0CdO+kBRx0Tg0qTecEG7meYuhR+lYfQMcU1F1:OKY3U+qRxQ3qKTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361430, "uuid": "1dd78843-3c98-4230-9218-f783fcff6183", "value": 5308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361430, "uuid": "e8945d17-eb88-4624-8e6f-b4ccd2ecb077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361430, "uuid": "5d23b520-255a-4f39-a6aa-cb9251527ce3", "value": "SecuriteInfo.com.Linux.DDoS.2355.14601.14416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2acb6f-fcbb-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713359184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359184, "uuid": "cf91d06e-a4aa-4a07-b94c-793f475f060d", "comment": "Malware payload (AgentTesla)", "value": "2222a02624129789dd29c05a6478ba5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359184, "uuid": "53d8790a-885e-4e60-8c01-c6a91dd1ceb2", "comment": "Malware payload (AgentTesla)", "value": "a35a4d58e12b7c68d26502cee706e06a7e2145eaf3bcf3a1c1ea2668c4da8dc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359184, "uuid": "b3e2a212-e4bb-4ebc-a7b7-5a22d19b006f", "comment": "Malware payload (AgentTesla)", "value": "9518b4926893cf093bb012d691ec6ea0f4f66785", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359184, "uuid": "e9c90449-d0dc-4d28-a1d5-0a8fe09aaa4f", "comment": "Malware payload (AgentTesla)", "value": "5a1f96338b2b74bda852a8c844688d058d4895a2604879d7ed121684271258facd86526b6164f4c94679d2852086acf1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359184, "uuid": "89fba1b4-4ce7-4098-9dc6-b52877127efd", "value": "T14EB38452BECB9D90D5F7C63E0EC8DD798E1E79DB8831463E328CD61E68612405D4CAAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359184, "uuid": "2257f2d9-3d98-495c-9214-69802814697b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359184, "uuid": "33b4addf-6d7b-4a1a-b238-1adf6a6d7695", "value": "384:4rYOf8QD8PJoDpsPNupo0C/K4vL3/ca3PphQUZUx7V9G9rv6vF4bWQ5lDRolLL4f:4cU8QD8vPNuSJhvL3V/bQH7aFWEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359184, "uuid": "86d97058-f734-470d-ad04-7d667bbb0ec8", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359184, "uuid": "2e3743d8-13e0-4c9f-a9bc-d7aaa641b4d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359184, "uuid": "5cd68528-914a-4745-ab15-e6d25de22998", "value": "PO JSC_109117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517ce2a4-fc9b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713345451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345451, "uuid": "78064ea6-d11c-4e1a-ba99-1bbb59648789", "comment": "Malware payload", "value": "0381b6554bf150780f0c8611ba8b166b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345451, "uuid": "fdb69024-060d-4b60-9f88-b031c865d3f7", "comment": "Malware payload", "value": "a5156cd39851151b15650e113796f40934208f2ef5d3c294dbdac4457ea3a6bc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345451, "uuid": "e8596d0d-304e-41c4-a41e-74e2f4715b7c", "comment": "Malware payload", "value": "e3afc417f1c0f93482314fb4d0556240e9a5cb38", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345451, "uuid": "0cd9939b-4ad7-42f6-b077-dba60b772eb6", "comment": "Malware payload", "value": "a3e97d2e73c4e9747da2356d95b5e87dee7452329b04f1c5666e5a74464f491178d288a0739dc0fa3e68a56f6e540186", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345451, "uuid": "eb688647-a5be-4ac6-9e53-c10994a4a905", "value": "T13F53B798A6C0389443E72BFFB72FB0D9FCAE08E83099415BD451FD54B436926E9E1931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345451, "uuid": "4ff946e9-3537-4c94-9456-6e1be7cbe127", "value": "1536:T7AhOOMlP5UWI4C7DC0/9mwTzKodt1k+b4:3yOOmu37Ak3n17b4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345451, "uuid": "77392e29-88e4-4fb6-8151-3340bdb4a9ba", "value": 61606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345451, "uuid": "08f56653-3c1d-4436-ac40-12d4e6b02161", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345451, "uuid": "4b6acc3f-7325-4784-bd65-98c5d70a7ddc", "value": "FRS2904.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf852d1-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361469, "uuid": "9e8f34cf-f858-4f0b-a519-af609a7cd915", "comment": "Malware payload", "value": "97c8f50c73aa57257559d630bc1edc9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361469, "uuid": "9f1e2f5f-9762-464d-ac44-064be5ba1724", "comment": "Malware payload", "value": "a547d1102c6d3c53b2af1519239fc73786c4ed30466c045ca117228be1093c1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361469, "uuid": "acd77263-5ee2-4d74-aa74-2bb836ff456b", "comment": "Malware payload", "value": "c50feb46a49cb2aa9c5ae95860e3600b4df29a46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361469, "uuid": "5fbc7de6-9e8d-4de1-b222-f5465e8bdb56", "comment": "Malware payload", "value": "4ea1e9a9c90e413d90d06b9483e181c62d0d0525583e244abbb073f5dcac7d7cc45100d900879983e4fc5247a159acb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361469, "uuid": "8b41216d-3e8f-4844-b075-f1de6c86d02c", "value": "T1AD364A10FECB54F6D5031D3044ABE2AF67316D064B25EB83EA047F6AF97B6A51D32209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361469, "uuid": "fcefaf94-17de-4269-9f32-407fe9ea6055", "value": "49152:E33d0lGt6UHcFL7Rn2o03wiEhiDmzzd/9sARlBs/00Cpfx9a9uN7p9hW16klbU6V:E33GlbU8FwmzzRDZ9mIqRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361469, "uuid": "5ab37b21-d375-4b62-b4a8-fbce91501084", "value": 5251072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361469, "uuid": "45dde63e-b60f-44fc-97e1-52cc650117c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361469, "uuid": "2b9edfe3-5b9c-4f55-993e-7473ea5338e1", "value": "SecuriteInfo.com.Linux.Kaiji.16.13149.10467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a25ce9-fcf2-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713382829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713382829, "uuid": "1f8fa566-83c7-498d-82a5-cf9b357666a2", "comment": "Malware payload (Stealc)", "value": "6111dea2ea7d3f9dc9a027f13721ae7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713382829, "uuid": "86b5c0cc-f733-4886-a7b4-f75afbf40564", "comment": "Malware payload (Stealc)", "value": "a56642e3313d37349be83eccecbf6b4d41c3b8aaaa1c19d637add3234c68c182", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713382829, "uuid": "4a4b8e9d-bb4a-4709-8bf0-1adf89d30218", "comment": "Malware payload (Stealc)", "value": "16912d076018c341caae35c5964377665a0b1791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713382829, "uuid": "f5bcf8a8-9be6-4070-b7fa-ecf6c8a5a0d2", "comment": "Malware payload (Stealc)", "value": "35dbc454ece8df234de6948fa941b6ff8fa3a4e390bb1b462b45c680671e2e7ba65d38b9afcc07745eb17d153a3a25df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713382829, "uuid": "6c21084e-91e0-433b-80bf-e1b14c29a8f6", "value": "T179647C02F6E3A861F53347364E6D96A0653EFC614F566B3BE3485E1F18B10A0E632772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713382829, "uuid": "1f5bffad-ac65-465d-920e-940bafbebaf3", "value": "f7e025a73ffe1b8974f1e3a5c63f95ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713382829, "uuid": "525ab6e8-b8f7-4026-a465-155a24080698", "value": "3072:BHwPY9WDTjVoE4yxa6PWxNmY6+IMqvWNAMboPfyyBLjRboZkETbyejUnTzb6d/m:BHoDSEA7X6+35I1bomUuejUnTzb6d/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713382829, "uuid": "95b0d516-507a-48cf-82d8-9e0ca9215b78", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713382829, "uuid": "a9740cca-4409-4f5c-998c-5125dbd49135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713382829, "uuid": "e8f5bfa3-b307-49a5-b62f-3311403c6e47", "value": "6111dea2ea7d3f9dc9a027f13721ae7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab8204e-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713353788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353788, "uuid": "83f8f750-9711-4f27-a2e1-39ecc9cce694", "comment": "Malware payload", "value": "a7a1c0213978f0091dadcc76ad911ac4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353788, "uuid": "d5956014-4d83-4b99-86a9-435e9bfd769d", "comment": "Malware payload", "value": "a63b095fcd96002aac355ceb9256a8f33b622b062438b15877beccc31249a08c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353788, "uuid": "66d7944a-582f-4598-bf49-467a8f6667ff", "comment": "Malware payload", "value": "a243d24e63be73adf46122115ef3729aa4f8733a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353788, "uuid": "fa734d46-d161-4970-a8a0-76b9f2512063", "comment": "Malware payload", "value": "75083d2aec4a0938fe8b792bfb067e160e95f5c90605e45613429446432f38f356621aef5888475f3ca8c7650d45b9fa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353788, "uuid": "975e377e-b224-475a-806c-0f70261c5f47", "value": "T1F5D4239AE10205114909FCE1EFF05B968EAE5A85FD308FFD11B9420AD58B38F9CAD365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353788, "uuid": "6d4e4b9d-17d9-4ca6-84f9-6a5b01f38a14", "value": "12288:mov1C1E9f5bIDnSi2KHjBoq2AvZyxT32pX36xfCai53SPiqVimnuEc+9rn:9vm00LSi2Kdo4o9mJ2f7iJkZwYu3wrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353788, "uuid": "38d7df77-7bc5-4038-aa21-c9de194e49b3", "value": 647354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353788, "uuid": "94a521a8-7b41-4e80-82ee-afc13a3aa338", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353788, "uuid": "b551ae8b-2484-419a-8f47-b22aa1df9ad6", "value": "SOA MARCH 2024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33337861-fc8f-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713340246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713340246, "uuid": "8836b1c6-4659-4f0a-9b79-6c140c2c5d11", "comment": "Malware payload (Formbook)", "value": "97167ea57b77e83e709a9bc7b7717501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713340246, "uuid": "96b558cd-0da6-4f88-88b0-a13a02f7e0d6", "comment": "Malware payload (Formbook)", "value": "a775fb3afcf081f27c9c3d1506579009ad0a4d3fd5b1302fb04f99c9c52f76b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713340246, "uuid": "068a7e92-b3df-48fd-a601-7b39b3da9f11", "comment": "Malware payload (Formbook)", "value": "a46f5da86f9812d910e5d5eb9f383df81bc12be1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713340246, "uuid": "3261e20a-da15-4d6f-994b-5910ba5bed8f", "comment": "Malware payload (Formbook)", "value": "a9bc53bd99a79e51d1f1f59b4a0d04ab56f2e1838e7ecbe791d8f952095ce7ae56e6be8b55476d67d23f17a6b02ac31d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713340246, "uuid": "5f37aa46-f857-408d-be3b-e5ad79d19fc4", "value": "T14215AEECBBB250EEEB52D43D39C68EAD75E0EE3019D6051A35ADBF1917312619FC2201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713340246, "uuid": "6997e8df-fb7c-41b2-91c8-9d9a19b4cf3f", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713340246, "uuid": "3387a54a-58bb-4380-a7fb-f721cac87db9", "value": "24576:HDgVtWN/pm/avooyRDtwZkeWnl9Nyu2nh4kN:cpoxil9NV2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713340246, "uuid": "94b38380-084a-42fc-b627-9210b962343e", "value": 923351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713340246, "uuid": "3784e759-2ef9-4eb1-bfee-123633629db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713340246, "uuid": "0d6ef269-4002-4bcd-89b2-d8d4e8035307", "value": "16042024124528724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf534f1-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713367962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367962, "uuid": "d7c69002-2fbf-4798-ad2a-06b8ac3f9ce4", "comment": "Malware payload", "value": "8bac98da6448a1642f22fe5d2d914e98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367962, "uuid": "02f05d41-2cdb-4a7d-a387-ac0df6306d67", "comment": "Malware payload", "value": "aaa80b5beba64872236b060622fda330a7334f4b714a5e99dcd36f5dbf0aeaa1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367962, "uuid": "35514420-fe68-4601-bebc-a86fe09e29cd", "comment": "Malware payload", "value": "a1535f868982776bacd630fba4a6dbe37fe5d903", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367962, "uuid": "074c3f99-a4fb-43f1-a5a0-98b09ddec04c", "comment": "Malware payload", "value": "f08f18cffca4b5c17c04105030410ec18b9e672e7603b592bf681c3d0b8e5f71e03a99f63645389f752895174e9dd0fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367962, "uuid": "55561c19-3db9-4685-800c-5bcc534501f2", "value": "T155D34AC39600C473E00219F612ABF7514162EEFF099795A2E72E7DB09E3189A3275FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367962, "uuid": "2f87e34d-a400-4ebf-9d02-51941753df69", "value": "3072:5x3f8TpxeXCtLM7uLSSHcgih8xUetJ8add9QzTsoxPkqkt47KcX6GcgqBK:/0S7uF+yxUetJ8addQnPkqkt47KcXJc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367962, "uuid": "18541c3c-7e21-4eb6-950a-fb28d84b7b0f", "value": 133262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367962, "uuid": "6b9399cc-09fe-4af9-bea5-9ab600000f66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367962, "uuid": "43bb0d12-cdc4-4319-8a5b-855bc10347ca", "value": "8bac98da6448a1642f22fe5d2d914e98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983c9b18-fc9e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713346858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346858, "uuid": "2fa6de4d-af12-49b5-ae8a-d5fa876106ba", "comment": "Malware payload", "value": "828ffbf60677999579dafe4bf3919c63", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346858, "uuid": "7a36c3a9-82ec-4452-b0ee-4f70530727dc", "comment": "Malware payload", "value": "abac4a967800f5da708572ec42441ec373cd52459a83a8a382d6b8579482789d", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346858, "uuid": "d41d3f54-526e-4447-acf8-424ce570a8a0", "comment": "Malware payload", "value": "a0d159a1b9a49e9eaccc53fe0c3266c0526a1bdc", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346858, "uuid": "080877e9-ad3a-4e6c-a2ef-5adbf45cfe7f", "comment": "Malware payload", "value": "ec6dd94dd4656445d2567ecb8ead96d57ec5b2fe6d985507ef3d8e5712405d22a59817edbce4227d8d96b334e09f5b00", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346858, "uuid": "7fd38019-9d43-4ef9-910e-b3aca7acdaf1", "value": "T100D2AA673E934ACF700BC8DDA2CF50666CB6FC3E51E6B09A4B47312F59B1699B802474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346858, "uuid": "698fa6a4-3466-4291-8820-e06b8ad15677", "value": "192:IBOY7cKQ/CyntVZjpubO0bXWQtagxP2+3o5WIGbfJTAy:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713346858, "uuid": "87bae695-94b3-4092-a323-1548607a4fb9", "value": 30026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713346858, "uuid": "e1045ab6-527e-49ef-8110-e3e90a56c8b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346858, "uuid": "aedec596-dec3-4575-9abf-3b6d60e6c2a4", "value": "KuswuwkrO.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e769e9ba-fccc-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713366748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713366748, "uuid": "626ce850-4c02-4f86-8213-c35a9b545127", "comment": "Malware payload (AgentTesla)", "value": "246e8571ca0dafda114b5ef63c878451", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713366748, "uuid": "f8aae0f1-1916-4fcd-8471-7dfff809379d", "comment": "Malware payload (AgentTesla)", "value": "abd6a08ff7327e729833c6c09bcb23942ea5b59dc542cf487cdaa1e4f4b12a7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713366748, "uuid": "a433605a-7de5-4316-9723-4ce4dd399ed3", "comment": "Malware payload (AgentTesla)", "value": "2c6b1b365028281c8151106a27d23654f66c4368", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713366748, "uuid": "cdf16718-2216-4ff0-9115-060401b8913c", "comment": "Malware payload (AgentTesla)", "value": "dae1031720da5087da5687745ff449422afc4142bbc6b163f57fd09e740840faf718733d477cc92f8f72d54017960903", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713366748, "uuid": "bd3c56fa-12e7-4b37-90db-18a27107eee4", "value": "T193F4012077D82E3FE79F1379A4B805201BB0E557994BDB9F6E8488DE0D877811E22793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713366748, "uuid": "7aeda1bb-036f-4196-9507-188cf2446dd8", "value": "12288:Z7DJKmKtyoay1VzRXLZoW/kPL0unGvqD5ZX6eqETPdtH/Vd9BWJJUUtHU:ZXJKmHoay1JRXLZXkPZnGvqD22LF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713366748, "uuid": "d179b557-c91c-40ad-8f00-c390f49650f4", "value": 793836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713366748, "uuid": "9e0163b7-3cfb-4d52-a826-903aa4595874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713366748, "uuid": "70ccaf57-0473-44b8-9fdb-acf6253ae037", "value": "20240417_28773667376643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a83d9ee-fce0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713375209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713375209, "uuid": "be13ae28-eac4-4038-9d8b-f97145da8f7e", "comment": "Malware payload", "value": "81b11d8dbc404fd185d66df7803cc5af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713375209, "uuid": "b105f01f-5455-4f97-8f4e-d48c8f44e8ec", "comment": "Malware payload", "value": "ac442d3c43342a80e0311e6a7da3072ee4b9242c39dd194d262c87ee68afc912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713375209, "uuid": "986bb3a2-f099-468d-b7e0-f927b817daba", "comment": "Malware payload", "value": "060486f1f63864ff5864a6a2a549e866d1d78189", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713375209, "uuid": "f4351a20-6656-4e83-95b8-dfe4715b5464", "comment": "Malware payload", "value": "d4ae684093f1ced13bc2a43ce3b9049baeaa41d12ff9b6ab23a4bbf45b339a97b2a0a7baa6a1755fade3e5ebcd16cd22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713375209, "uuid": "49704e55-4691-4eec-a7f8-f1ecac25f914", "value": "T199E6335C53E0BBF3C16690B2AF626EEC534C5479C82D1F9E6534283E8FA7D98B05B184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713375209, "uuid": "51aaf176-ddcf-47da-be08-7b70505ba170", "value": "f4d1e4cd7416ef83f79f7c6a038875b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713375209, "uuid": "3c1d1e80-25c9-49e1-86f6-1303a3310b8c", "value": "196608:Woig5xeQWyesxwbBZIWJAe4CLxL/wiSgEH+W5AyNP/Y54scOP0W1qfDXM6/e:WUJg2OfIXObYge913sVMW1q4Qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713375209, "uuid": "d553adf2-5aa0-4399-8e28-81c04f27a53f", "value": 13955583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713375209, "uuid": "e96ebeb7-11ff-4c23-a6e0-83bc22a3d3da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713375209, "uuid": "5740da56-ff38-4e46-b785-ff336883703e", "value": "SecuriteInfo.com.Java.SuspAttach.31196.10450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d36787-fca3-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713348928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713348928, "uuid": "0137ab41-e94e-415f-a9ce-2ffd3c05d6ef", "comment": "Malware payload (Stealc)", "value": "5474120ed18dfff57735020ec276f3ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713348928, "uuid": "34465c40-a473-4c7d-9a49-5ae9192cda9f", "comment": "Malware payload (Stealc)", "value": "ae33e5e830eb9997198b78b50e593332307145000af1a287a7ad7391b81e60e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713348928, "uuid": "35ed91fd-c90a-4a6a-b126-2e3fabc513f0", "comment": "Malware payload (Stealc)", "value": "6069c972b79a5aa28e458f8914ad162ac84e5023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713348928, "uuid": "5271808b-9b81-4288-b8b3-36eaaaa05831", "comment": "Malware payload (Stealc)", "value": "405a5c91e2c1e08620ae323205c58e1f9e619761b19b732794e69cb3744970c44734318e91bf0e50695da43dfe11570d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713348928, "uuid": "2b295063-9e47-4736-9398-69cbcd8801a4", "value": "T17C647C0276D1A872F53347729E69C2A4763EFD614F567B2B33485E3F09B00A1E622772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713348928, "uuid": "272c4a11-efe3-45fc-965d-50c5de62b4cf", "value": "17ccf166284947c6d6cbcd86ca514021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713348928, "uuid": "e2a52802-0549-4f1b-b291-df8ac12b8787", "value": "3072:cChrwyTiEHrOhXTHsglq9LCE+PPuTr2tbRgG3PthgGbi5O08bFYLBlej:SydLOWgYRCEgb/VO5oYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713348928, "uuid": "1ff9d5ec-51c3-4aa6-8704-95f1b3d2a899", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713348928, "uuid": "91fc3885-5a8b-4a35-84ca-bed3efe4c62d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713348928, "uuid": "cc23c418-efe2-41c8-845b-8615e2ade9bb", "value": "5474120ed18dfff57735020ec276f3ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb44bc81-fd11-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713396336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396336, "uuid": "79a49ccd-9f46-4033-b5fd-2318b5fe719e", "comment": "Malware payload (Mirai)", "value": "e0430921164e36df90959de0e02b7026", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396336, "uuid": "6fe1680a-f3d2-410c-9d3b-037571dfd180", "comment": "Malware payload (Mirai)", "value": "afa3a08f29d9f3f60898213906c9d8a2e1695204812c13d219beaf3ebf6a5139", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396336, "uuid": "ef80a89a-99a9-4447-9b35-43081b4dc21d", "comment": "Malware payload (Mirai)", "value": "d8014c0261891daa725f619dd3fa5b355edc2f8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396336, "uuid": "91560d3b-2b6b-4e5d-b53c-0423229a9874", "comment": "Malware payload (Mirai)", "value": "ca2c50e7aa2f1b5ee1575d1d4011287fbb9e3486558a03b4c86c27db58f144a48b5aa7f6a41d40527ce9f6b9f831e827", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396336, "uuid": "f6cdf1c1-7ad4-44f1-93ef-b42c2365ff1a", "value": "T1E9E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396336, "uuid": "a5a4954f-4592-4381-ad5f-ef788a8cc602", "value": "3072:Cv/WwsLgaq353qHiCOvhOOwq1DQHbe1kmhxQwoVSUNu:KPLaq351hOOwq1L1kmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713396336, "uuid": "ef2cb264-60cc-4f31-9711-7fbb8cd85f47", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713396336, "uuid": "832e3231-2451-48fd-9727-4e757785223c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396336, "uuid": "2f5aca96-5cf7-454a-98d6-54d92d617919", "value": "e0430921164e36df90959de0e02b7026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4163d17-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361481, "uuid": "91cfb78e-1035-454f-8741-c353d54efa70", "comment": "Malware payload", "value": "9e935100c7c15c560443064221733921", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361481, "uuid": "dfd010af-43de-474f-bb65-26be36415161", "comment": "Malware payload", "value": "afb83827f6b02cc9f8af865df1872e17d9af1d8d0a19d5a414fa5d670805beb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361481, "uuid": "3a17a2f7-38e3-4545-98d6-b4b07eca103b", "comment": "Malware payload", "value": "8fcbd6d97792e33a094f2ccaecd320a502c8f83e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361481, "uuid": "165b5691-95dc-444d-a23d-85ed77b3af7d", "comment": "Malware payload", "value": "daccbfd8bf6ac595a3215e315f8be2f312cc29c50f7398da881e8e8ff81186e3a19f1a238c6dc25904e8700ec8dbab9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361481, "uuid": "8990280b-e1ea-4857-8de7-104392eb8f41", "value": "T1F856E704ADC56BA6C06C9B7584EBCE9523B06D044AF12B271664FEDAB8762747F07CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361481, "uuid": "df84cfcf-8333-4804-8e0a-abd239d8942b", "value": "98304:yC91hAFxvW6WGVqq7g3JDCg76dAuE8iW5ay5mIOX+aaNcc8pNkxXkz8xBs3K4HUM:yC91hAFxvW6WGVqq7g3JDCg76dAuE8i7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361481, "uuid": "02a08f46-4ce5-48f8-b787-d223f247df93", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361481, "uuid": "9ea5caa2-2b55-4962-bea6-aca1e75c1199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361481, "uuid": "f1e90624-e6e0-46a5-8edb-d4ce67b2de56", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.24482.9771.8238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceeaf933-fc7b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713331917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713331917, "uuid": "668dc3ca-63da-452c-8eb0-6d466d00ed80", "comment": "Malware payload", "value": "921557c2b17618359e49a321117a5917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713331917, "uuid": "0778a2fc-9731-4e86-b61a-dbf4f6ef8cbd", "comment": "Malware payload", "value": "b06beeb0116f23b271122767f0be842dd5c5082b1e585e79ded01985a8fe0036", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713331917, "uuid": "fea4d824-cd49-4866-b3db-797440fa00ce", "comment": "Malware payload", "value": "a2ae5fb4d614f3fca87a42f1fc15800a22d36504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713331917, "uuid": "0c5f071f-0687-461f-89d6-364ec4775c09", "comment": "Malware payload", "value": "16f6f7f1f6a473a1a6ac9fa21654d51a000ca1c72a7a26f787693a6f717c361ff0a62e57bf8e817cad2c6a3d4584767d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713331917, "uuid": "ee07e70d-f1c2-4127-9452-7cc05b617f52", "value": "T15EE6AE02E3FC02A9E5BFC278C5665517D7B278151720EBDF165489A92F33BD0AE39322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713331917, "uuid": "f863d43f-3934-4e2f-ba82-baddd34a21cf", "value": "b819c89ac9b569d0bbb77889674017b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713331917, "uuid": "90cf2903-2b8c-461f-884c-8302c08dd110", "value": "196608:PhCe9IfzJidXDDGSFzaICetJCoabNuOb4:PQeufzJiVWSFXXtJC7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713331917, "uuid": "6f737abd-f438-4226-9578-8d2de7a9234f", "value": 14477139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713331917, "uuid": "b1f48e44-dd21-459b-a5f6-24ea82691a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713331917, "uuid": "fc2affb8-68f7-4cab-ad6b-aa76a1b34221", "value": "SecuriteInfo.com.Trojan.MSIL.Rozena.9214.20581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4243757a-fc84-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713335547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335547, "uuid": "f43ccd60-4773-40bb-bdd9-61530ee3821f", "comment": "Malware payload (Formbook)", "value": "080829053664c4ef0128c3b048df6880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335547, "uuid": "85d10c93-a365-4465-9cec-7f96f7700a60", "comment": "Malware payload (Formbook)", "value": "b146ee56f4ea9be0d7a80fdfe9b030febf1bf40f901d00760231a35990b6a3df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335547, "uuid": "364af6e2-eb8b-4a28-80ad-3d73663fe112", "comment": "Malware payload (Formbook)", "value": "46827f4e141081c08c5b782905440598803ddfc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335547, "uuid": "d39ffbac-28b8-4c70-8f4c-3d8e71c04f2e", "comment": "Malware payload (Formbook)", "value": "f0905defc41f5db24f1b3cf0018aa3058a1f1eaaac4cad4f94c2ce672aedbe9d2cf76448eccdeef26767ae13de47e689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335547, "uuid": "6e47c1f9-1528-472a-a2f4-a7c4dc6eba77", "value": "T128F42311FE64792BCAEA17F225526EB08B7FB5853A23EBCB0DC1640D56D7B0041D2787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335547, "uuid": "27e5c81e-33f1-422e-8daa-cc58339a6425", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335547, "uuid": "ecb27c9a-2084-4483-ae69-a6085ae5658e", "value": "12288:9GL21ILjo2cWjoIfcEIx7v8VXO5VeJmCxwnNWl+ML+NClBSq5HWLlganJEfG:cL21ILjorAfcEis6MmCUNWl+MLWClQo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713335547, "uuid": "9e3c138d-37c9-416c-a642-4c7d28ebbee6", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713335547, "uuid": "07546af0-aadf-421f-aa9b-b77d9c8a4a18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335547, "uuid": "e02bed5e-3c56-42a2-8484-5f2a9010ba71", "value": "SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5078952f-fc9c-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713345879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345879, "uuid": "4b4078a0-e227-4590-983e-9fc26ae6b612", "comment": "Malware payload (AgentTesla)", "value": "c6cfe33cdceab0a6448eaed84aa1b94f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345879, "uuid": "78ec78a3-15cb-4c48-87cb-b006945daf83", "comment": "Malware payload (AgentTesla)", "value": "b2f05c218342514c79062ea36768dbafefaa24894be343338ce934335d32c323", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345879, "uuid": "b92ef281-5cad-43de-b21b-718fa7987b41", "comment": "Malware payload (AgentTesla)", "value": "cff28906e3dc8700a1358042db4bbf561429c0a6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345879, "uuid": "f74d712b-2585-442c-8a99-da3803c67e3a", "comment": "Malware payload (AgentTesla)", "value": "e516af392ddc8c93073bd1a7922460886dcf6722ecaf762ef59bdb582110cd20cc6978150b23caac486ea88cec6f9f4e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345879, "uuid": "fa90d2d6-b744-4e41-99c7-f8ba69771c29", "value": "T1A35423DC494CE871B0BFAD8455479C033FEE41E4BBA54F6BA0845864DBFAB449829783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345879, "uuid": "bb7a6e17-0e36-4751-a508-d703bc3ea970", "value": "6144:unLPXIjd01wleZLrxuWYGltmsUdNLPt5Gd7q7X0PBkQ1HRy:uLPIjWdraGl01dpPtG70X8Ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345879, "uuid": "a826333a-01dc-4409-8ce6-6fa70f319c6e", "value": 297290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345879, "uuid": "993df00f-8ab7-4d3a-8bd7-caff0a68161e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345879, "uuid": "34f65fca-ef4b-4697-9980-0bccbe8bdccf", "value": "RU-A052-2302-2-PACK RU-A052-2302-2-INVOICE.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0947c965-fc94-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713342323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342323, "uuid": "7b782b84-4700-4ba7-beb3-d4197ac6572d", "comment": "Malware payload (RemcosRAT)", "value": "e2b804162dbe6b4a022fc7aa99c1b53d", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342323, "uuid": "a1d2ef4f-91d8-4330-85c1-65dca4d04cdd", "comment": "Malware payload (RemcosRAT)", "value": "b300e18bf2da85f573018efd066241135b68e8097fedf22160cdf9c1eafd47dc", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342323, "uuid": "3992c715-76ac-4639-9d8c-725f0a37ee8a", "comment": "Malware payload (RemcosRAT)", "value": "f3ad5f33d20afb27beadf7e8203d41560717e55c", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342323, "uuid": "2f623af3-f906-4f86-8d03-3e41ad0dc71f", "comment": "Malware payload (RemcosRAT)", "value": "8732f07d82c5165199837422f5f4006bc179a3436c92e6036e1afe8ca8f806fec32b00e4d79ffbdde304c7eae838d1ef", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342323, "uuid": "4f0a3e3e-7970-49e3-8518-7060643ac18f", "value": "T1A7725CF2EE465062880E23AAF814C750CC2454D54D3611ABFE92475F613B9A8E3FEF5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342323, "uuid": "5655b49e-d7fd-4689-ab99-a877e197f217", "value": "384:LuM2XrXpz5toVZoCSsqoC8bE2XKS2DCR817e3xOu2:LtMzvoXlSsqoC8bE2ADVGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713342323, "uuid": "0a9d9c41-8807-47fd-8a19-a2bd89ce5ff3", "value": 16604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713342323, "uuid": "18d6883e-f882-42ae-ae69-d44f9a7936b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342323, "uuid": "ef8ea98d-b4b1-4961-9f06-018c73d90a6b", "value": "PonudaSKMTBH365756867868855766786686.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ec0aa0-fc8a-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713338137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713338137, "uuid": "95142e01-e80f-4d92-b2cf-0a3894325b12", "comment": "Malware payload (Stealc)", "value": "7afa5dd515203626695eeda4606d1c63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713338137, "uuid": "373ea0d0-d1b9-4db5-871c-2c38470b9a36", "comment": "Malware payload (Stealc)", "value": "b30838c7d4ae48e0bd2b530eb63ac920048f044d9ff59766889f753989cce382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713338137, "uuid": "9a973899-8c17-4344-9eb9-0da3e36c8f0a", "comment": "Malware payload (Stealc)", "value": "2d91e4a20ffb26d31c396f64546c68bac9e37208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713338137, "uuid": "3fed0880-7a42-497e-b51e-badf0f80c6eb", "comment": "Malware payload (Stealc)", "value": "66a9fd23431feb1f94ef63748d8b7197faf415c40a3998289cdb4c258c07e4ecfce0b238081122a728e59d90cb246ca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713338137, "uuid": "dd806823-3b93-4740-8909-db6ddb6f6cbb", "value": "T1A5646B0272E1E862F53347725A6DC2BC767EFDE14E565B6B2348DE2F09700A0D622772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713338137, "uuid": "2f7446af-fe08-45ab-93d3-0368e45e1117", "value": "17ccf166284947c6d6cbcd86ca514021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713338137, "uuid": "32e4b638-2606-493c-8134-0ceb186a5eb9", "value": "3072:4mhodyTiEb28g2o3pTg/P9LQKi+XPb1Kj1QUsl0XwARbNsWuxfTBdk8kBfUse6S3:Cydi82g3RQKiswsl0XwAP4lcPSoGn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713338137, "uuid": "3a342786-fe44-4add-9b6b-c0c18ee457e6", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713338137, "uuid": "8951812a-a76d-41be-9531-20486e5377f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713338137, "uuid": "117f851c-15a0-4916-8388-f1f2eb7ab6ff", "value": "7afa5dd515203626695eeda4606d1c63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0652593f-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387845, "uuid": "f3d29e87-a9af-4c11-acb0-c042bb75dbc5", "comment": "Malware payload (Mirai)", "value": "5251c97bb23649461515b4576521fd32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387845, "uuid": "435fc0f6-7e5d-42c1-81ac-8ee06fa864b7", "comment": "Malware payload (Mirai)", "value": "b3da0161ffd4a885d733dfa06bf7d094d600d549cd24298b851d721c256e2f6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387845, "uuid": "44c88645-92ea-4959-956a-6254b6659a16", "comment": "Malware payload (Mirai)", "value": "adc8136e733e190a2b53e7e9c8a37bf01ff8b8cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387845, "uuid": "9a745484-1482-4b59-83c1-761a59dbc502", "comment": "Malware payload (Mirai)", "value": "149e8fcf9131e82fc22f9bb14fc2092419cf9cfd09144fcdaf32333b1daff6adcaa56efe685e7e9f675524870ffc8c3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387845, "uuid": "e995ba67-fcfc-4ff7-acb2-ccbf99dbc4f2", "value": "T1E4739E77DC279E54C08981B474B58F781F63A4C142826FBB2AA5C27A5083DEDF642BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387845, "uuid": "2512e186-25c8-4b2f-b226-e06c5dfe1bce", "value": "1536:b+6wtxJqiCoVyshX1GeKOP+lqokDpSCn8S/z2PwOSio:b+6gqiCkl1GRU8kDpSfSLIwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387845, "uuid": "18a07424-8f96-456f-82fd-7541e16d36d5", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387845, "uuid": "30ee7eca-7fe9-423c-acdf-b7853d389936", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387845, "uuid": "d4c690b5-6c98-4de9-b25d-9895729cf314", "value": "5251c97bb23649461515b4576521fd32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1248871a-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387865, "uuid": "d7959772-d15e-4199-bfd2-9764b630d497", "comment": "Malware payload (Mirai)", "value": "ce22ca3990271926f6c74c1402d45a17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387865, "uuid": "2053d20c-88aa-4bb3-b3dd-506f55fc9fad", "comment": "Malware payload (Mirai)", "value": "b5c23c8c3ff16addf37d54d3fab67ab3e1f06bb3987ff5a49b27e7a631f1de58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387865, "uuid": "6086de64-8643-4bb7-98a7-7ed6947627e0", "comment": "Malware payload (Mirai)", "value": "c673a79ded420df2738001bdd9957d562dfc6bf6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387865, "uuid": "b7c19802-d75f-4c72-a5ed-b8df88514ca8", "comment": "Malware payload (Mirai)", "value": "1e7f08281a1f9382670960556bf42a8c26b464593460840d19cf22d2bd5b293cb7baaeb881c8c9fe036b865e12b26432", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387865, "uuid": "e29b9528-9913-4a2f-bda3-4443a6e0a284", "value": "T167934B32BA751E2BC4D1A47A21F74B25F1F247CA21A8CA1B3D710D5EAF646403643EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387865, "uuid": "d8a8b5e3-fd9c-4ed8-9999-5b188bd09c0f", "value": "1536:vUaSo7kKDcfW5JtmKMLpQ7mpn/oj1UtczNk5Pc4REmZ6tO5ciMF:8zOo4dMNPn/izNU0IBGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387865, "uuid": "c5dce5f3-0dcf-4d2d-a7ec-b4e45dc7437c", "value": 91716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387865, "uuid": "e61c8ac2-58d4-473f-b460-35f4bb319a9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387865, "uuid": "d2ef61fc-d7fc-4210-80de-9b8e10dc1300", "value": "ce22ca3990271926f6c74c1402d45a17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a916dd-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713367986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367986, "uuid": "b47b6aa9-ddf4-45fb-bf2e-56daabf9a0fe", "comment": "Malware payload (Mirai)", "value": "615e39f5e09205729e447194ea1c52de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367986, "uuid": "73edcf09-1b97-4313-9df8-85c827e848b2", "comment": "Malware payload (Mirai)", "value": "b5df5c4bb3ab7673392a4666d76f8dddbb2dabe3f07d6374527dd4bc6efe63ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367986, "uuid": "d0d40042-a6e8-4de2-a350-3c60260dd2ed", "comment": "Malware payload (Mirai)", "value": "23da304e00f33132d06c634306a1f193813c58ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367986, "uuid": "6317782f-f7a5-46c5-a8fb-6001c406c71a", "comment": "Malware payload (Mirai)", "value": "590be65318038bac6f37b7d8e586aa13d2e2f5b810db5d21bd6dac7df05fb9359645bcc01602966cc4ad061cc68e4c11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367986, "uuid": "4ba97053-0400-4c15-91ff-70c9684362e4", "value": "T11E434A85B8829A22C5D112BBF66E458C372927E8E3DF32079D212F6177C681F0E77E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367986, "uuid": "e28ab366-ba56-43b5-a697-0d05d3a93aaf", "value": "768:gAUwoD2VNPyk2l3+KjiVz/hXqgbuJOpYPnSuT2X2ntuhJG8EnaB1Q8tUBWO1shV2:Ew7NP/2l3Vm/h6BOpwKzZHuM7Wa10I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367986, "uuid": "65707e6e-bdf0-4cc8-ac40-0bc71499cdee", "value": 56800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367986, "uuid": "8128009f-3bc0-4623-aaf1-1521746ce3c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367986, "uuid": "e5595f8b-e3ee-4115-9670-62f525101b35", "value": "615e39f5e09205729e447194ea1c52de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1613bd5-fc9b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713345665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345665, "uuid": "5fd4603a-ecd0-4d6f-971f-2295b7047f16", "comment": "Malware payload (AgentTesla)", "value": "3496ca6e6d0888fa6095df2544ed7778", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345665, "uuid": "5e2284dc-237b-4198-a7c5-1a42df8cbc8f", "comment": "Malware payload (AgentTesla)", "value": "b6e30cedc03219af2ac73375cbffef0583f6e1bc9da2fc2600e95fdd1440392e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345665, "uuid": "00d218c3-6bf3-4425-88ce-452ebbb21580", "comment": "Malware payload (AgentTesla)", "value": "bb4ea9a813d14c6cda60a607f936731bb3681a71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345665, "uuid": "d949310c-003b-4351-b55e-eb084e16eb73", "comment": "Malware payload (AgentTesla)", "value": "55dde4a8b16f9db7483a16e87219d8f93ae80da3fe80ff155a5e2a9a7f701dc03ee2f87cabcbef1ac89a60c76fac0d53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345665, "uuid": "6cea81b8-eee7-44a5-abf1-32c6e1178737", "value": "T105F4233B0B89E13D0CEDFA11ED8A1895EE6903A30C234F6D1E586C397D144FB79E64A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345665, "uuid": "6a4618c0-88c4-4a5b-a4f8-407b8b256687", "value": "12288:6+7Qs1hc7QSBRVG8NokhcyAoPrdznMqA/IQ1DvrTdg0XEmpjztqw:n3m7QSM8NBhzvrdznMqAw6T32Iltqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345665, "uuid": "d0d5a5ae-d494-4479-b7f5-f8f447e080e4", "value": 735270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345665, "uuid": "6410cc6c-dbf3-4581-b3b7-e04bbcba1be1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345665, "uuid": "1bd46fac-4496-41ce-9309-fce6aca2de67", "value": "DN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56b2a70-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713368033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368033, "uuid": "3045bb56-da31-4717-a6fc-31fcea1af185", "comment": "Malware payload (Mirai)", "value": "f1f97a1a0d60e7a50bea21eff4582bdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368033, "uuid": "0a08c46a-fdcb-49d8-a7fd-0bc4a211e94b", "comment": "Malware payload (Mirai)", "value": "ba8b3afe83468260b5a948d909357c375f459a13f52a412d2b229483995addd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368033, "uuid": "456541f5-ce3c-4731-95ca-86e48d43b1e3", "comment": "Malware payload (Mirai)", "value": "caec5464e19fab8ab4a753fa1311ac2c06548d01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368033, "uuid": "01f447aa-f1f0-4873-b8dd-bcfe36e03610", "comment": "Malware payload (Mirai)", "value": "661fdaafcc02e378b13150d54f94319464573a3b3c31499f1779169498e81d58817c5446f747e4123da376763b68cf06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368033, "uuid": "91d1f18a-d5a9-4fe1-b13a-559ac00b1c81", "value": "T1BF231A96F8829B2AC5D022BAF57E995C375467E4D3CF3227CC601B207A8650F1E63F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368033, "uuid": "20c422a0-e638-4afc-bd86-ad3e69759eb1", "value": "768:lGg7wgy62tyWWEUgpdYNlciq5HtfA/EEQYHpYPf+QskU41JpXJxhoajXkQZY10U1:v26EUgdYNlGS/EEZHpwr5Rjba10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713368033, "uuid": "aa4db3e6-925f-4eea-ada7-340a75fa13bd", "value": 47728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713368033, "uuid": "c53d1c0e-9d8c-40c0-82f1-61be6d56beec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368033, "uuid": "0fca1cc8-cfe3-45ca-b03f-deb76f89a155", "value": "f1f97a1a0d60e7a50bea21eff4582bdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad11198c-fca4-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713349470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713349470, "uuid": "068be58d-498d-40dd-9886-61a1993e052d", "comment": "Malware payload (GuLoader)", "value": "2f6fbd4dd3ffb23e86b8fe0c092d4d59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713349470, "uuid": "e871ae58-d69b-4db6-a0b3-3bb4c45ff542", "comment": "Malware payload (GuLoader)", "value": "baa364ff2127d6dc7cd49fddc9fe7a3e1c4b93173d8f7531d172a38285115ea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713349470, "uuid": "9818488b-149c-4d79-ac40-e25cc0b2bb0e", "comment": "Malware payload (GuLoader)", "value": "a093d228d0aa8769419ef25153d1310e826aec79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713349470, "uuid": "d12b7bfa-bc20-42a6-a3fe-980178ccecfc", "comment": "Malware payload (GuLoader)", "value": "08c9e881cedfba17e72bb66a29b1d3dc853aa8d477c76097e644fc4097e40d3dffd068a72af1ac825f8db83264d1a4cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713349470, "uuid": "1533d767-45fc-4c5d-9c63-974b05d6c125", "value": "T123C4E12627AA8843F2D945F087B3E37427365D981A1B4253AAF1FF6B386C3D15D3D242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713349470, "uuid": "142f6d49-d982-4994-8beb-69b17b8872eb", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713349470, "uuid": "a3672399-47e0-4af6-b222-002af8ad4d22", "value": "12288:29HJyccI40lhH3k07aii3riCeYUG+PcuU:29HJZcI4gJGQAdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713349470, "uuid": "edaf90cd-f85d-41d4-9977-8d2474d197c8", "value": 558880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713349470, "uuid": "3b001fdc-8b89-46cc-a986-52a61eb8ed9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713349470, "uuid": "84c0ed32-0ad7-4424-b87a-03e69a1444f1", "value": "UMOWA DEV8759 - pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc28243-fc96-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713343569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343569, "uuid": "294088ea-3447-48a7-a1d3-3e0287545d2d", "comment": "Malware payload", "value": "50b5582904fe34451f5cb2362e11cb24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kapeka", "colour": "#D2EB38", "exportable": true, "hide_tag": false }, { "name": "KnuckleTouch", "colour": "#2565EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343569, "uuid": "ef8214d9-209b-4f44-864c-3dc24292b4e2", "comment": "Malware payload", "value": "bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kapeka", "colour": "#D2EB38", "exportable": true, "hide_tag": false }, { "name": "KnuckleTouch", "colour": "#2565EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343569, "uuid": "7a0fbd00-9cd6-42be-a033-f04da1cfb8e3", "comment": "Malware payload", "value": "80fb042b4a563efe058a71a647ea949148a56c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kapeka", "colour": "#D2EB38", "exportable": true, "hide_tag": false }, { "name": "KnuckleTouch", "colour": "#2565EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343569, "uuid": "6c7dd084-bbcc-4fe9-a141-3c2509a6e73d", "comment": "Malware payload", "value": "06c2e2fe18ee76d0226721ba6b9ff3844e9923490b2b7a157e3dd2453ff16dfb388dffa9c4ecba2ea54ea8cb92fb772f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kapeka", "colour": "#D2EB38", "exportable": true, "hide_tag": false }, { "name": "KnuckleTouch", "colour": "#2565EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343569, "uuid": "cba7b5a8-7b92-4793-96ca-965f0f636723", "value": "T1A144F123B4C1D433E9B6493148A0D9A6AA3FFC210B629D7B7B98177D1E740D02D35E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343569, "uuid": "97482b5c-069b-4c21-ac5f-77a86183790e", "value": "ee10a91e683df57757f5df69b3171fe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343569, "uuid": "87f6d397-7291-47c7-a79d-fcfe50e904d8", "value": "6144:X0alEVRVmnwztE0b8VyvBK+jrdqhbyCz3jDjsoB:X3gREnw3bmIjshbhzz0oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713343569, "uuid": "5986555d-4f62-404c-944f-0e887c26a975", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713343569, "uuid": "eeeef2d1-ca71-4640-a1bc-251f67841893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343569, "uuid": "90d4aa23-a34e-4928-91b7-c6723932c07f", "value": "crdss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0891db6-fc76-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713329719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713329719, "uuid": "9b30ce63-bb9d-4695-9a0f-6fcdd80a0ed5", "comment": "Malware payload (Stealc)", "value": "e2d45c465fd698e29d05ce3401c01222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713329719, "uuid": "3e26be86-1ad9-4fc7-b8a2-171322f054e2", "comment": "Malware payload (Stealc)", "value": "bf64f0b89179c564e2ccac32d33face7727c828421044c6c132dece09c026aa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713329719, "uuid": "b811f82e-d6ec-41bd-872b-140d1343f78e", "comment": "Malware payload (Stealc)", "value": "519160fc2c2b822644e37d1ff9e65a869a2c8278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713329719, "uuid": "55765c7d-8976-4d95-9f64-f56e00c44aba", "comment": "Malware payload (Stealc)", "value": "80ae8cad58de90500c16e0249b837da3eefa6a81607b4f6542d356b62d79aa5f4ac0fd19db0fcdf85ae316ba35fb133b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713329719, "uuid": "9e310212-966d-4c49-8b0f-1f78a0d304c3", "value": "T194647C0272D0A872F57347724E69D6A4763EFC614F7E6B2B23485E2F04B30A5D622772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713329719, "uuid": "94dbdeba-9629-403a-8571-95934e6b79db", "value": "15d4342385ed3590f2f3489674cc6c48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713329719, "uuid": "20da7340-a8be-419b-a8e0-df5439a1a9ee", "value": "3072:oi3GcRMXNeNhTROfvgPUVfk+rh1qURq+eLR6apNWKELZRdylkvvZqC5fyEQlEN:Pu8h8gsFkORiRRpNLELxylSRqYfys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713329719, "uuid": "39bd3eed-a1bf-484e-846b-4bbc17a25332", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713329719, "uuid": "f7760f53-3761-42b7-b1dc-c0379c57ef9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713329719, "uuid": "23955de3-c19d-45a5-9fe1-702545bb90cc", "value": "e2d45c465fd698e29d05ce3401c01222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2cf43c-fcbd-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713360152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360152, "uuid": "a5004e41-1b3c-433a-b83a-0a1afc706746", "comment": "Malware payload (AgentTesla)", "value": "bf3d308082112e4d96c76c2d50ad649b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360152, "uuid": "c068bee6-956a-4b3f-a425-00028006a5c6", "comment": "Malware payload (AgentTesla)", "value": "c4b35fb2d8ec524243250e12129f45b62c8ea71b0f181615fff82bae29769768", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360152, "uuid": "f8407b36-6594-428d-9a06-649f1d2325ba", "comment": "Malware payload (AgentTesla)", "value": "bacf48afb576fdfb7158c3ea68d652b0ae0674a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713360152, "uuid": "c67de17c-f9ea-4f98-8f3f-7707b6d5e8cb", "comment": "Malware payload (AgentTesla)", "value": "d79a2de60a7ff8e908feb468cb7864b2c2f80de3380cc82db5e02c90656007e58548870510c56c9b335c8d659ec12c8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360152, "uuid": "b3de353c-a64b-44d2-b839-1a1ab9bac5e2", "value": "T106D4E1262B9A8803F2D905F087A3E3B427369E942B4B835265F1BF2B347C7D15D3D256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360152, "uuid": "5d1513f7-51f7-43d7-b63f-69b655355ab3", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360152, "uuid": "d1f1f371-5cd7-4ad3-97e1-81c23abd162d", "value": "6144:gDSoIyuQUcJEPBElE2oRqXGdArqUB81V9qIFeKSa1XxY3HzdpJ73FjVmynTgrVYQ:i9HJEPOeE4AeUBarqIFWx73FjECUYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713360152, "uuid": "13e6febf-3699-4d89-a640-b477087b31b5", "value": 599288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713360152, "uuid": "b9c984b9-43a3-408a-95b6-cd368f9fc558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713360152, "uuid": "5424ff24-dfb0-429b-a9ee-620bedd7b261", "value": "CONTRACTUL DEV8759-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3930f5c-fcd5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713370607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370607, "uuid": "c0321481-4f6a-49b1-9bde-8720c4a4dbe7", "comment": "Malware payload", "value": "c1f3049880a57a1267fece829b587cce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370607, "uuid": "0b942543-3d6b-4b34-a4c7-0fdef5060d4b", "comment": "Malware payload", "value": "c605b5adea1737158cbd8b02ffe102eafb9575ccef3bcc88b7bb18c517fd9891", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370607, "uuid": "eb11fa56-d8db-4b66-b990-91129734ddbe", "comment": "Malware payload", "value": "22dc6289e2f32ad4a195b6e1bfff99449c384c2b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370607, "uuid": "3c089644-2f69-4764-ab68-c3f326329dab", "comment": "Malware payload", "value": "f32966c325f37c792d2d70de69ff1a74154e5bf6e13a56f8d44591339b7198f6de7849b363a87ad9efa14d96a6d96c54", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370607, "uuid": "d7414b70-5573-4bce-ba86-7d6361e0269e", "value": "T1C596138A8A234EFCE9981D9C1CF91ECD1EE47D723960EDD59C3B20430A716B510F696B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370607, "uuid": "95daa94c-16b8-41d5-9172-5796fe76f1a4", "value": "49152:kQAdbfQAdb3R9BTZTAQZIMuEs190N+90Nq90NKD0v4dwwwwsguXj5PxiYJstCzWW:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713370607, "uuid": "81d9402d-cd42-412e-a106-8134e421acc1", "value": 8958598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713370607, "uuid": "148daa08-838c-46aa-b77f-674995ee75f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370607, "uuid": "99812257-4c40-4cc3-8762-d2c95934c61e", "value": "out.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b527c435-fc73-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713328438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713328438, "uuid": "78ce4829-1db9-4c5a-9cd7-aeb985b19b4b", "comment": "Malware payload", "value": "a10aff228a835255b89419bebf24bdb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713328438, "uuid": "e5b95d73-99ea-43ad-b05a-9e382f8f3812", "comment": "Malware payload", "value": "c673e00e0e5c771f2d146c07d656ba6c3ea2112146e5b382ba7391e513eb8160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713328438, "uuid": "aeb89774-98c9-4520-90c3-43e69489c3fb", "comment": "Malware payload", "value": "959e432c06de820e4778461befb789bde41ebba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713328438, "uuid": "8212f13e-bca3-426e-a70d-8caa89c32f51", "comment": "Malware payload", "value": "85132a6942621bbef1ab78d5f1b674822e2db16c4446a2eb0f67617ccfe5c53ff718c3c3ebc7af364619795aa762fba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713328438, "uuid": "a9aa236f-4543-4d21-949d-f27476fe366a", "value": "T1FB55338CEA48032BD02B4A7C4C4119E57E7F7C25153655827342FBAEA5BC928C727B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713328438, "uuid": "fde33a14-1708-4465-be87-a93e5ced9f20", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713328438, "uuid": "52d11285-b684-4811-ba65-2f40e9c284b0", "value": "24576:14GHnhIzO6YYXsf9vA5eNizYpnjfONnXfoMBtyfuzRODhXym0Iwzl7DDEb81O:Cshd6YYXYNA5L+njat9ROEJNDEo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713328438, "uuid": "d8ac23a5-dd82-439a-b28b-0644d3875c5c", "value": 1375744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713328438, "uuid": "db3434be-f94f-4885-8a47-d67e8e835c98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713328438, "uuid": "d07a7411-f4f2-49fc-92bf-0ee23547595d", "value": "SecuriteInfo.com.W32.PossibleThreat.5771.17792", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd67653-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713368017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368017, "uuid": "5b6b4840-10da-4761-b94a-e9a3ef26b466", "comment": "Malware payload (Mirai)", "value": "49bc8f48961b0fc02aa77a8e13bd2605", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368017, "uuid": "eb0e0cec-70ce-49d5-8ea9-2d82bd4c36dd", "comment": "Malware payload (Mirai)", "value": "c69ce647d2425f934eff868634fc49b0ccd91b7d8b63a6d3abbe94f9a1fc93f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368017, "uuid": "2044fc6e-8c32-4fd1-8c43-7bd2700c8483", "comment": "Malware payload (Mirai)", "value": "441c8b4022fd3ca8fb55a72467c3bc78a084632f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368017, "uuid": "d563023b-9db5-490e-8fa7-9995576ccb62", "comment": "Malware payload (Mirai)", "value": "a1e569d54a43c482f59522adaa8af39bd4bd00dcc63021ef9a0b028babae464931119bc6fa245495ce245e79d4164070", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368017, "uuid": "2574364d-6662-439b-b5b1-9c3e95db8728", "value": "T15C334BC4F143DBF9D84900717036EF369B33F1FA226DD997D3995A32AC92502A906A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368017, "uuid": "a4d18b37-11bd-49d7-a5e3-14eb710318a9", "value": "1536:vbxZ+QmM0P+IWFWidh8dsrtQhoQuQo0iIBIF0x5L:dZ+QmBto9kzB+Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713368017, "uuid": "cc216bcf-0217-4e90-a46b-2feca377811d", "value": 51508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713368017, "uuid": "a438979e-9334-4fdf-b5fd-03d40b2129ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368017, "uuid": "b9fd3bce-0248-4272-b986-df690b6c8237", "value": "49bc8f48961b0fc02aa77a8e13bd2605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01f03c0-fcb3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713355944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713355944, "uuid": "bf61d66b-8672-43b0-8270-5e2b6829787d", "comment": "Malware payload (AgentTesla)", "value": "9488d6b411539fd82b92b476589ab31e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713355944, "uuid": "0823e7ef-75eb-4390-be08-3cd795e5376e", "comment": "Malware payload (AgentTesla)", "value": "c6eddb234b3f2f3d99a2f2080e416020fac1fdf124dab907606cceade3f8081a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713355944, "uuid": "b3cebdbb-f8e7-4388-808b-60974b19e0c1", "comment": "Malware payload (AgentTesla)", "value": "d7c89be195f61a5e839fe2b18a6973bdbe1b6a07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713355944, "uuid": "31f1183e-bc71-4828-b885-68005a7b8210", "comment": "Malware payload (AgentTesla)", "value": "2486e5b75ca1a215106004009946b331c7e7493c6342717494547c7cf21dd71c91dd65f03b00bfaf1266c914b277c4a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713355944, "uuid": "d0a1b140-8a7b-4633-8154-43d58ab1aa00", "value": "T176D4232AD8B50B788F4F941F0E188C443DECDB1CA550E92DD3A8EE885EFB55C5544B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713355944, "uuid": "2b9905f4-5c7b-436f-954c-28b23dc93d5d", "value": "12288:XFNJyfv7NtUuOL6k1qgx5a3duQ2GnsWzUxlqq4eRIb2Om:0t5OIIA3bn3eqnUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713355944, "uuid": "831109be-7f78-4fe1-9b26-1aa3098ca7d3", "value": 640362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713355944, "uuid": "e389c566-9b85-4dbf-8fb4-ad0865807896", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713355944, "uuid": "1e1c67a1-0e21-49a2-91d2-7bb9cb35421f", "value": "Documents for shipping.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bc2bff-fc9c-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713345773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345773, "uuid": "f6959369-f25d-4138-b7e5-a0712b75ff12", "comment": "Malware payload (AgentTesla)", "value": "40ece1efdce9476425214d407d606fa8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345773, "uuid": "f1174655-1672-44ca-8ff3-db0a79e7c1ee", "comment": "Malware payload (AgentTesla)", "value": "c7f74a4a8f3119dd1d215487647368730869660f30225e0166b101662e45a1d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345773, "uuid": "da7ea47c-b830-41f3-b6d0-b437c2e5b997", "comment": "Malware payload (AgentTesla)", "value": "d155959d78d025eb5aa5a134abb7bf4bbff1ecd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345773, "uuid": "1e0f4781-b2ae-48e0-a6c6-b9f212e4e48c", "comment": "Malware payload (AgentTesla)", "value": "7c2f408fefc04a0f57f34854270bbcde76e440373f14718f0771d91ad1bfa04969cc9a673a5f0c620916eb2402c3d6ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345773, "uuid": "615c9cc5-d45b-41c4-9b6e-8f97bc60de59", "value": "T187E42340517D9B67ECF9AFF48559004843F2F23D3D62E3A92DD651EA11AEF848C26A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345773, "uuid": "f6cc0f3d-24e9-4561-8fed-559953d91f17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345773, "uuid": "a90f7e70-6970-415c-bb1b-9640f327682d", "value": "12288:zyAmmu7JgstNTImUN09f/2GodDEfUNORmcMZQCXv0+gF/cRL4Jx2cWjoI:1ru7FXsNkf+GSDPwmccXv4K0jrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345773, "uuid": "31201de1-db51-47c6-b9cf-fb234358f761", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345773, "uuid": "36edd780-98fc-4585-bbee-7708587c4fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345773, "uuid": "f679b56d-a7cd-484c-a8b7-2a86692e4df6", "value": "Quotation 22001625_REV001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1978fa-fc8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1713339237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713339237, "uuid": "d06cfd90-4b3c-4231-8ff7-9e29b98e08c2", "comment": "Malware payload (Adware.Generic)", "value": "35a00ae36ee03f200bad5a922afacd04", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713339237, "uuid": "c25b343d-9c20-4fc6-9fea-8007ea7b3d4e", "comment": "Malware payload (Adware.Generic)", "value": "c99b0aea44483bd5145b0bd811ad6b0fe4b7aa5867a4f12e979fbbea9648ad02", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713339237, "uuid": "4862d942-38bb-41bb-aa99-1f355fecaba3", "comment": "Malware payload (Adware.Generic)", "value": "05dd9e5eae8378394d9426fd97e18d2d485db3fa", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713339237, "uuid": "1ef3d902-6a71-4c8d-822a-9dd553f6c1a3", "comment": "Malware payload (Adware.Generic)", "value": "ceda81e2611f7bf51759aa21f9e46de11d2e275a8f91c258992f2a49bcc790276b8f1c86fb6c51c77c165e645bd44ca5", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713339237, "uuid": "f37cf47e-86ec-450d-b907-7353ad83e20f", "value": "T12BB5D03BF268A13EC56A1B3245B38350997BBA61B81A8C1F07FC344DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713339237, "uuid": "d8055237-66cf-4f94-8757-30f96e322cea", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713339237, "uuid": "6777b285-2cfa-4a2a-a511-f0063ea54592", "value": "49152:bBuZrEU4IQC1zVoxHUmQ+KIy029s4C1eH99:tkL0C1Box0mzt29s4C1eH99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713339237, "uuid": "12a4a16a-14dd-41f9-b467-33a8bc40f140", "value": 2341000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713339237, "uuid": "4cd9e326-901e-415d-bc36-889b56a9f3a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713339237, "uuid": "f5d60e6b-2d2b-4ad2-82f5-af5eb48bc544", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1319028.18822.21071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba2457a-fcdd-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713373949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713373949, "uuid": "3d53e766-a8fc-44f6-99b6-eb6176ef10ab", "comment": "Malware payload (AgentTesla)", "value": "83d5996cdae805e2caaea0c087163700", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713373949, "uuid": "1da57269-e31e-4874-8334-8c3e392d5b4a", "comment": "Malware payload (AgentTesla)", "value": "ca444d4c1eac0d3464e99f59a3391aa587572814d5fbecfe1d02ac9bf84606e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713373949, "uuid": "28fadf27-15e2-46df-a238-a3233f12180f", "comment": "Malware payload (AgentTesla)", "value": "2b69f4a9e66cb932f695fc0b004c81d34f3684d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713373949, "uuid": "17a3d4fa-c7ed-408f-9246-d8629e501264", "comment": "Malware payload (AgentTesla)", "value": "c179b15ae79791e27edd06fc72e11a5257223dc1c7cc728dd572a6760f99cf34848e26b51287eafb36490ca4e03a3e95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713373949, "uuid": "32cc3a8b-e006-4110-af51-74ba8cf24cb4", "value": "T14DE4234A31A8FF77E4B5A7F2046645211BB4B253687BF3A01ED4A4C907FAF424C26B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713373949, "uuid": "3d0ad359-7b61-4567-9331-d5720ab51e1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713373949, "uuid": "ab9a15e8-59e6-46de-b1ed-2122e4fb4a7f", "value": "12288:TSWPxnsANqcSezgcDlgGZ9d5bzNmBorZpOaAXmne+Sdq2A2cWjoI9:fsWyytDl/bd5biorPAWnrSdOrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713373949, "uuid": "6f43d03f-cf2d-403a-9e35-53bc02d44599", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713373949, "uuid": "7aedfd0a-2940-4e16-8255-322378015dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713373949, "uuid": "42568d38-9071-4cc0-b303-5039342fca91", "value": "Bank slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e983bee0-fcd5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713370617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370617, "uuid": "329730b6-e745-4f95-9ae8-1ff4d32a4644", "comment": "Malware payload", "value": "2bf7b316ba201c859d0e0b21722ac551", "object_relation": "md5", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370617, "uuid": "88ea9d5f-a3f5-44a1-a15b-4b0230873e2a", "comment": "Malware payload", "value": "cade322bf1c5f58f44d8970de70ca83cf53d2d6ab5e43f53a8ed26a343c95309", "object_relation": "sha256", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370617, "uuid": "0bbd4739-cecb-4da2-82e3-66c5330742f9", "comment": "Malware payload", "value": "602407aa754ef29b76d294922a83f320de4b19d5", "object_relation": "sha1", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713370617, "uuid": "34b2f03d-a599-4b3f-87ed-c0297cdf32e3", "comment": "Malware payload", "value": "6a56ab83461c0516668033f3c1b6ec2b9224f0357eaad464d887cfb7556568b06dc2666a8106ebc2c777fd93fe56848c", "object_relation": "sha3-384", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370617, "uuid": "b1e7de13-fd18-45c9-9a61-96c537ff6434", "value": "T14D963347E91F3A90DEE3E63E3E968305D6D2845CAA79C073395B21900E4F859CF8B791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370617, "uuid": "0c346e0d-634d-488c-8816-ff6654c53ae4", "value": "196608:bzmu7WKqkGTSOwUDLMpvM4KBCmbhOj+UIs1mkSA1IND3RA:bznb9Ownp/0lTsUxND3RA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713370617, "uuid": "ef973f5d-cd13-40bb-a55e-4b987aab8596", "value": 8875329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713370617, "uuid": "77f0a90a-82b6-4244-969f-14fe98d0014d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713370617, "uuid": "114f0052-9952-4074-86ef-d5f85fd5e286", "value": "1_npp.8.6.3.portable.x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e40ffc-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387876, "uuid": "5b3b0ebd-bc24-4b33-bc7e-19000d112d3e", "comment": "Malware payload (Mirai)", "value": "38e8a7ad78afc948164bae1f1cbbcd26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387876, "uuid": "1ad67098-3a3c-4745-8748-d84c4bd501ae", "comment": "Malware payload (Mirai)", "value": "cba079fbaa1ebedbb75d9c0dc4e013c63c7ff0a62aac7dde7cb605a4324b5d56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387876, "uuid": "b5220f29-527b-40ab-8af8-6e9869afc222", "comment": "Malware payload (Mirai)", "value": "b363ce25f3cf549544252cc51122d8bbbcc9b8f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387876, "uuid": "5b4a16d1-d20a-4353-8a12-d7579841c227", "comment": "Malware payload (Mirai)", "value": "58e5a6175cb5af0ccfc6147b093da7e4fdbe19df1b80bfd2b09762ec173c4d6fdccf91222067280bb569f10a42f3a31a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387876, "uuid": "5895da6a-725c-43b2-bc98-2f1fb00a15ed", "value": "T1C5F33B56F6418B13C0D6277ABADF4245332397A4D3DB73069924AFB43F8679E0E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387876, "uuid": "835791ef-7dee-4a38-8549-b5d9110b56e6", "value": "3072:5gM1ZS0Tn3PiTuavNCpw0UcHYZwrhWfCm28ANX/meFsM/9DVI/:5gMegn/iuavNCpw0UGYCWad8qX/mXM/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387876, "uuid": "ab29e2d3-70bb-4bf5-9860-0730b0d52858", "value": 166169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387876, "uuid": "93503372-4ac4-4341-8bf5-59d711a90b57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387876, "uuid": "201ee8d7-1356-4e88-8131-d114170f4300", "value": "38e8a7ad78afc948164bae1f1cbbcd26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb49f4a-fc9c-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713345765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345765, "uuid": "b74f2214-78ca-438e-8503-ea1acc4e651d", "comment": "Malware payload (AgentTesla)", "value": "acd4723d53c941b6468dc28e0ac4621d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345765, "uuid": "683b2a67-05b9-4f6e-9472-95913e56609a", "comment": "Malware payload (AgentTesla)", "value": "cd55e3b04ee2d643c68d158d80393b418a46f903c08dcc6f23085b12fa26d38a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345765, "uuid": "22d15275-2054-45b6-949d-616efc5c0a57", "comment": "Malware payload (AgentTesla)", "value": "9ad9e5279a7707103e158ada91e62216aaebb355", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345765, "uuid": "9941bcda-7435-4153-add4-5ac4b61faa93", "comment": "Malware payload (AgentTesla)", "value": "53070e6cb28ef06840f4d59f18d690dca3db2a8add31facfde0dcf84fa781df4911ad10168a27964f71015c666c93a9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345765, "uuid": "02cc0d39-b93d-4a0f-ad84-0eb0721f35b5", "value": "T10AD423F3969C839A6CFF6EDC85540BD81B93E228E80793896A58814DA34FEF4DC0D475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345765, "uuid": "2cf044fc-b4aa-4d52-941e-b0f0df4b6440", "value": "12288:jxfnwZDmu71OHIUUN09NRQTSgodfQy1X5pT3XF0+gFwUQHSkvyBGiX/4DLTJjozm:jF6au7QHANkGSfT1Jd3XFSlGCGiP4DL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345765, "uuid": "26bd5c4c-dcb6-40eb-9587-254b4cfbabc6", "value": 644101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345765, "uuid": "bde4a1c2-2f42-4499-a53e-597cb7696a93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345765, "uuid": "26abf1b1-ac08-4666-8b6e-57dee1735d37", "value": "Quotation 22001625_REV001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7b7077-fcf3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713383397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713383397, "uuid": "f300964a-b06d-4dde-8329-e399dcf8f6e9", "comment": "Malware payload", "value": "b8e2d7dc379d9ef000ea1459f40039e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713383397, "uuid": "3555342e-9778-4517-8d52-0cc461da186a", "comment": "Malware payload", "value": "cd9b44d9f713acc1d24fca49e4f59b9bb242a9693f9b73136fb1c5edd70e4862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713383397, "uuid": "2d5d9723-465e-4b99-8708-688d383cf98d", "comment": "Malware payload", "value": "8cf89592075e42af2c4eb3b1e97b0193a945b1f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713383397, "uuid": "1ff15914-0f95-4163-bd85-e631c825abe5", "comment": "Malware payload", "value": "98567c9ea4b64e4e40d15343d4b4e77f4b1097ee7cd2dc9ae4cf32a36010421c3b1b0e4a379f81a77fc565a86200c2a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713383397, "uuid": "00d0e228-f6c6-4855-a7ae-b3901b4a8e55", "value": "T1AD8733FB63424859F159AE3BF4948BB13460F0451AF23707ABB59F364DCE9E2AD34620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713383397, "uuid": "f59d5760-e445-4f28-981d-7f3a99d908d1", "value": "a3d629f5a29590a5e3c40a85e9084e58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713383397, "uuid": "295100c1-1937-48c1-a5e1-9bed2310e185", "value": "786432:+GyeCRQIbXUJKb0ct2j6+s7LWB75zuROoOpOW8QOd97C7:+JPQ2XlbXt2qHWB75iBOpOW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713383397, "uuid": "fae51afd-8ff1-4df2-85aa-135400261a49", "value": 36339961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713383397, "uuid": "6ef77279-5a6d-4ccb-a239-2be823d4ab81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713383397, "uuid": "de1cfc2d-088e-4f8c-9748-c4192d939b57", "value": "cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8779f74-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713368011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368011, "uuid": "df22d0cc-84aa-438b-acb3-b9a93a7a78b5", "comment": "Malware payload (Mirai)", "value": "b41b9a4ca6671244cd25a010a1c81daa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368011, "uuid": "bd47a0ea-3d7c-4825-93b6-f45fa6704073", "comment": "Malware payload (Mirai)", "value": "ce4357a58c8b76d6177bc7c679ce85f07a45aae51c7549211caeb9bf88f34c0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368011, "uuid": "bb60bd89-b565-4276-8106-e4b87e66cda4", "comment": "Malware payload (Mirai)", "value": "0b9dc9b6103585922b4862753dda3706db5f8945", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368011, "uuid": "a3e88802-06c2-41bc-b385-0cc1ca4d21fb", "comment": "Malware payload (Mirai)", "value": "c4cae93fab4c4426c52f463e13e3122ac4a0a93e84493e94f1141051b2af3608d96a5b1f110772d697a1b07070f46ab4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368011, "uuid": "f4e89146-30b6-4182-bc09-de5acf23dc47", "value": "T15773D815FF651FB7D89BCC3309A81B0628CC665A22B93B367E34C918B54B15F19E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368011, "uuid": "c76dae53-4cb1-4fe4-88a3-9ce05d912578", "value": "768:lqwATxpQ5e+y4rsv5Y6ZDSP6gSOee2etJeGa7N/kWjrXilvo2KXZY10Uw7:lCTxq55BADSP6X/74JVSN/nJ26a10P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713368011, "uuid": "c1373505-f1e3-4ef4-8ff0-410d1281f5c1", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713368011, "uuid": "e675da57-b8a9-4e84-a9bb-2658d5e7939f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368011, "uuid": "b865b4de-bbab-4d55-8a97-99013df07c67", "value": "b41b9a4ca6671244cd25a010a1c81daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd57452-fcb7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713357635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357635, "uuid": "e3174485-38a5-4f46-9ee8-01069a8dfacc", "comment": "Malware payload", "value": "d549cfb2ddd8ac5b72e8157e61189cad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357635, "uuid": "6a5a8012-c592-462b-9ab8-45ecb3a315d1", "comment": "Malware payload", "value": "cf8b0984ffa1634f4da8eb0ed8f3fb86854fe1433a1ca7c7fc303e0e47223747", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357635, "uuid": "310ce50b-49c4-4cf7-b528-7db623dffab1", "comment": "Malware payload", "value": "4118cdfe33c25a717731057ac9c06007def37163", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357635, "uuid": "47ba3395-90d8-4dba-91c1-60bf1e185e9e", "comment": "Malware payload", "value": "f1a3732ffe3bc3a30908e69a6d0a3ac58437ea1dce54ea548f6283c069e883c15ce60f6db962f33a084248d50b932c85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357635, "uuid": "c96aafbc-0379-487b-9311-f862535d92c2", "value": "T1B3C5D7D0F74C127CEE9F097685271E70A795628390F8C8BD870A895F02B09F7964FEA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357635, "uuid": "6675c388-e2c6-4e88-bef6-3324cacd6ec4", "value": "49152:UbfIMWeDTyKn8Nrwtt56e3JLxKYzYR2iLHwOng/KosjiwH:MgMWeDTyK86t53txKSi21S7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713357635, "uuid": "55dab993-8ba4-489d-b7a8-4eb295a8a54a", "value": 2526323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713357635, "uuid": "523b688a-709d-48df-8bf1-0c35923a9b16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357635, "uuid": "abed4a49-4dbe-4bb6-b540-551014a093d8", "value": "SecuriteInfo.com.Linux.Kaiji.130.23768.17418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49930440-fcbb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713359181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359181, "uuid": "1e4b6096-4b76-44dd-938b-f27ea5c38081", "comment": "Malware payload", "value": "23962b3265bbda2430aedf29c3e1ea40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359181, "uuid": "134f184a-1292-4c10-ae16-b243e482e0d1", "comment": "Malware payload", "value": "cff573aed914627539de60f6e9a52a48f98d748196a5ede78e1b22bd53262f80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359181, "uuid": "7d1758d1-05f2-4153-8f36-3f238f78b1a2", "comment": "Malware payload", "value": "edf8f73ea8263b652ca42259fff53cde0f268e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359181, "uuid": "df14196b-0dee-4e47-a09a-88cd46dd5e02", "comment": "Malware payload", "value": "79d5329862cf565d7571c88cee91fa225e043ca2c3f833d11b950bb7212ab15add8aa4cfd230ca26edcc03d32d20d7fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359181, "uuid": "f74f71f6-3719-48b7-b4b5-b5e755287211", "value": "T12504C9467ECEFD14DDE686BE0D858FBADD1E78EE446001F931C8B22A6531B605FC814A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359181, "uuid": "0ec58bfb-09ab-41f7-97e8-9a9c0f1cd83e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359181, "uuid": "a8a4df28-0a81-465c-b549-3ea4a8387bb1", "value": "768:RGBRVhPPJXr0ibuPM0s+/euuuvuuuuuuuDnLD9tYHpn5D:R+RVhJviPP3/euuuvuuuuuuuDn9t4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359181, "uuid": "ba198166-9b31-4e4f-b270-111ec75affb2", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359181, "uuid": "ebf1d5bb-3370-44a5-84f7-91fb2d0ba931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359181, "uuid": "aac52598-5ed4-40e9-bc26-25e7b2e9fd03", "value": "24crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b76786-fc6b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713324867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713324867, "uuid": "e5d664ab-4665-4c41-879e-82d9f23232b3", "comment": "Malware payload (AgentTesla)", "value": "8ccdf88e1aabc883233a2893675f2035", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713324867, "uuid": "a6ba1859-0050-4334-954d-0c88704b0bda", "comment": "Malware payload (AgentTesla)", "value": "d03bb14b3852574a34043130102a04235da51cc6ccef5f9204df2d671e840c1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713324867, "uuid": "16720afb-98f4-4b01-9142-ddca312877a7", "comment": "Malware payload (AgentTesla)", "value": "fd8d3032ac384e136630d82e7733610a95a67d9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713324867, "uuid": "b696ade9-b892-4367-b141-21dc8d713678", "comment": "Malware payload (AgentTesla)", "value": "5dafd3fd78e8b987e87c17421649df3cdedea64e12006da6495467e8ffc6854504afb4c042119f68f6d9b6fd3a20e09d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713324867, "uuid": "8332c737-e2df-4726-bd03-4c7835e8ca6a", "value": "T17854482ED34B02698F520372AB1B1E95A6BDBA3EF39051B1342C433533D9C7D52266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713324867, "uuid": "67c2c47b-f47d-45d1-90c7-d30b7873b9ff", "value": "3072:IsXvKMEesXvKMEesXvKMEesXvKMEesXvKMExa7tOYx4SQK1:JKMeKMeKMeKMeKMRNxB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713324867, "uuid": "7451eaee-fa30-4aa7-a423-3296ad1220c9", "value": 293130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713324867, "uuid": "5114686b-a7d1-4b9f-b457-7a2d1908d091", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713324867, "uuid": "eaa068d2-1678-4ed8-99b6-0731af6af45f", "value": "8ccdf88e1aabc883233a2893675f2035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cbdfc4-fcb3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713355950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713355950, "uuid": "a6bfb62a-4d58-45f6-a120-b201d7ed4051", "comment": "Malware payload (AgentTesla)", "value": "9efe3a01db7c6a78d6cce5db681d2422", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713355950, "uuid": "b655d628-4bf5-4092-aaf6-efe578853319", "comment": "Malware payload (AgentTesla)", "value": "d0539e8f11cef371e3eaea5818978eb76f401db9a17c388a9459c41b96ea20b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713355950, "uuid": "2869f8d3-ef0f-46c0-8646-7357306cdbcf", "comment": "Malware payload (AgentTesla)", "value": "43e9c09b989b86dfd869210c8adf75fd2ab67d17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713355950, "uuid": "13d6edef-a17e-419b-a545-1a332cee92e9", "comment": "Malware payload (AgentTesla)", "value": "78b792141b9166804ca88c145bd4dbf4a8e7b6b31b02d8e9b09d7352200991a821c6d86a47b67438279d5ab863141d6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713355950, "uuid": "0ffa4f5f-714a-47ba-aa1d-44892550e6fb", "value": "T1AFE42301A6B82B63CCBD8BFA4D1548201BF6E6269499EB1D5FD075DC44FEF404AA0F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713355950, "uuid": "f9ace72b-e686-4a43-8f4d-97c60d86f7cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713355950, "uuid": "95976c1c-193a-4769-82da-66ec39904bc8", "value": "12288:gmg8ytvWnONCkDyOr5alduQkGrsEz6Liy+l2cWjoI:6hOnO0SAlNr/xy+lrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713355950, "uuid": "c370b0d2-7005-4fb3-ad3c-98880ee5737d", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713355950, "uuid": "6c2ecc95-eb22-4449-9a49-a642517c2426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713355950, "uuid": "567562da-fe49-4c28-84d5-4916651b8939", "value": "Documents for shipping.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb9738e-fcf6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713384503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713384503, "uuid": "5769785f-5d15-43f4-a448-1552708a127f", "comment": "Malware payload", "value": "8bd528d2b828c9289d9063eba2dc6aa0", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WINELOADER", "colour": "#6FBF95", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713384503, "uuid": "b33c6afe-1eaa-4aa3-87c1-ae38b056122e", "comment": "Malware payload", "value": "d0a8fa332950b72968bdd1c8a1a0824dd479220d044e8c89a7dea4434b741750", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WINELOADER", "colour": "#6FBF95", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713384503, "uuid": "d01a4f17-d6e5-4902-84b4-7bf74ab98d7d", "comment": "Malware payload", "value": "5d3f3113ef76af7c1a2447d35e8b09bd270b461e", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WINELOADER", "colour": "#6FBF95", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713384503, "uuid": "ff9d297e-b5f4-4d4d-8632-5d90450ab6ab", "comment": "Malware payload", "value": "91f25c38dce6c5d6b43dafa2cbfc434eb56855908ac63babd9915d6f3eccb593aadbbcb9f6dd5b4d215faac6088ba3a2", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WINELOADER", "colour": "#6FBF95", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713384503, "uuid": "ba959364-9905-4e79-9ab7-49f993591fad", "value": "T107A3AD0A73344097D0AFC6B880639A4AFB71B921872167CF17B4C7599F53BD4AD3A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713384503, "uuid": "5ced6f59-473b-44cf-89ef-1444812aa4da", "value": "7f07fd94e5bb907093556781cc464017", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713384503, "uuid": "b6a4a024-7c47-4e9a-b76a-7ed1b8d3c1a1", "value": "1536:VxhUIePlHhR8PUo2dXlJr9luLMR8qc1InnshQAD4AeDuXVycecb8i10DWZz:VvcCUoqlJrPuw86YD4AD1ecb8G1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713384503, "uuid": "9cc18238-987c-4ac7-850c-b707dbdd433f", "value": 98736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713384503, "uuid": "cb1b2ea3-66a9-4300-954e-5889460414e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713384503, "uuid": "937553e1-eb83-4a52-a64c-4dcc9d34beb6", "value": "vcruntime140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b688217a-fcb7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713357646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357646, "uuid": "8f4da735-908b-4b3a-a6b1-e8e1559fe4ff", "comment": "Malware payload", "value": "18195e8d4fbebbc085a7c09658bebfb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357646, "uuid": "701f3829-6d02-40b3-9878-ca37fc07a073", "comment": "Malware payload", "value": "d1a6e9249affa678ebdf7acd4ed9a43c94c809bdc98b7309816241f554dcaec4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357646, "uuid": "54eb25af-9d12-4f70-8c0b-e7f04159e293", "comment": "Malware payload", "value": "624e2ae15ad8e7d1239bbb87cbc780dd5a940399", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357646, "uuid": "14242c63-dd35-4a29-9624-9fa35d864118", "comment": "Malware payload", "value": "503f115be74afd41465e4f61daf2fbe2e66e65dd923076e2ad01bb18dc0b3a8adfec4baa45bd687f4b540c6677c454ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357646, "uuid": "ac83b91d-78d4-41dd-8d7f-a9ca5b5920ef", "value": "T17F36A5AB74D24682C4E43A7BBD7D81C432970BFEA39F60A59D01CD353BBE59A0938714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357646, "uuid": "ea219a91-2459-4ea8-b9fe-0f5a2c14bd81", "value": "24576:/htrChMJz8J1opPALUoqomCgIgw3Q4pFbrEd67F5u+5Kock3UgfJLhs+gnjR+usQ:PJzG9XxZPF773LVPN9GnMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713357646, "uuid": "2534b328-24f7-4f94-b862-1cbd7074ed0f", "value": 5308416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713357646, "uuid": "ad216f96-5994-44c9-82ff-f283fb03f5d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357646, "uuid": "b17f01d4-0d01-49f2-a826-0024c72dd3ba", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.24541.30318.12083", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca2ca6d-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387855, "uuid": "3e7cab9e-81b8-4c53-bd95-d26dff5f6dc5", "comment": "Malware payload (Mirai)", "value": "c65bae60afbc66685e7794992337cb65", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387855, "uuid": "0e0a6955-7b3d-41b8-9682-bfa92e6d2a92", "comment": "Malware payload (Mirai)", "value": "d1bef23d3ac3f09d9a72f65b3cba4fe60a0c75ea3b2fafd577a7e4e5531c8c09", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387855, "uuid": "c0f8ac7d-a41c-4c7e-b5fd-f1fecc7f3301", "comment": "Malware payload (Mirai)", "value": "0a4b8ff184729e02ed380626ada1e20ecab02d39", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387855, "uuid": "e91e6ab9-2e5e-4a73-8efc-3d95ee3dffcc", "comment": "Malware payload (Mirai)", "value": "8516624b8fd85329136fc83d1acde98a9d49f97ad4e314ea2670ea0f918b9187f129bb293b51eb8171c97c2f7ec53ffa", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387855, "uuid": "aaf5266f-8e7a-4afa-8916-12f0460adee5", "value": "T113834B07B5C090FDC18EC134471EAA37DA32F0AE1376B2AB27E0D9253E5DD710E1A999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387855, "uuid": "7db5fa81-16c2-47c7-b9e6-31c4f03fe1a2", "value": "1536:r/6xRAOM+j2jNmLtp4YWfUb+y9B41QawjTRLKwMTmO25kZd2EMj0Ywa:r6xRAOMM2jNccffUb+uy7wZLKwbO25k0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387855, "uuid": "e33c21f1-2896-472d-846d-52e414a64031", "value": 84112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387855, "uuid": "6918f2dc-0142-4ed9-8ae5-6fc94ee640dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387855, "uuid": "b3f91505-493d-4cbf-a1a9-2d5242e585ad", "value": "c65bae60afbc66685e7794992337cb65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962a049d-fce1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713375631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713375631, "uuid": "400af5ea-5109-43bd-ac89-eea460be333e", "comment": "Malware payload", "value": "984baef7d7222f28b80a868c5748505f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713375631, "uuid": "d98300b8-54fe-4652-933e-735a59fa2041", "comment": "Malware payload", "value": "d318debebe45471d91a5a0f7ce27ee3335f929f3a724f00751b3db4692631480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713375631, "uuid": "0543ab26-0917-4739-9b43-42d2e267b550", "comment": "Malware payload", "value": "b0ab3d37ebbdd7377b9d9612b55d0930373a8efb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713375631, "uuid": "339036fe-0c9a-4bcf-8e74-db7928ac64ac", "comment": "Malware payload", "value": "396e23143b6acada51f93279bbb022d2bc4a45b9d7e9ca980dbf7c7d057c153ef996f437ba20b5167b7a2a226985174b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713375631, "uuid": "378350a2-4c92-4e18-927e-ffef978e330d", "value": "T1CAE423152B44F97BE84707B1B432B473A983A13092390B5F87947ABDBC4E5C7B42BB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713375631, "uuid": "59e9486f-16f7-4924-9c3d-39bad7eaf754", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713375631, "uuid": "2ab36127-f525-4690-8cb3-95e8fc2308f8", "value": "12288:+bq0tXpe8yDh3Ec0o4hDT1RCyqozV6XJTnT6tpJLmxKne/hJ:+bq0NpeZ+c74hhq66ZrT8ppmye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713375631, "uuid": "4a797ea1-1194-424b-82ee-00a63f27d94d", "value": 693891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713375631, "uuid": "e8cbaa11-7277-4e46-a7f7-0759094081cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713375631, "uuid": "1c15d424-1fc4-4a08-99b3-2009943ee795", "value": "remasdasd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ae6fec-fcd2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713369156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369156, "uuid": "f7dd3cf4-ce14-4dec-9154-8881efb5c5a4", "comment": "Malware payload (AgentTesla)", "value": "57df46df6f1828f8f910d1f67889a6f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369156, "uuid": "2bd8a233-930d-43e6-910f-eb0e4afa1ae1", "comment": "Malware payload (AgentTesla)", "value": "d38b60251fc60c8100b31321735a3c50fc3f5692fbec18e6cebc03511c129a1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369156, "uuid": "382b7397-05ce-4f2b-b483-053e2a2312f1", "comment": "Malware payload (AgentTesla)", "value": "2c2c98d49aa0a0d2e3e3dc9f25bb6a94aa3425f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369156, "uuid": "67e3ecaa-7e9c-48d4-9ca8-e84a193d0c03", "comment": "Malware payload (AgentTesla)", "value": "59fe14ecd2d97237c53f9fa7aec72811e924fd999d4f197ff615ff72f6f3fd381d31f84cca4bc2445c1c6bf0be3732aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369156, "uuid": "2add4f31-237e-4886-bee2-3434db078104", "value": "T18B2419F0CF0B36199F4B3EDAAC6845924AF84195051638B5AAD817EDB283D2CD3FDD14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369156, "uuid": "340d9a53-d2cb-48c2-8495-fa523d90162f", "value": "6144:pYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfoqye:i2dO2M9N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713369156, "uuid": "be561f15-17b1-4e0d-8ba9-d464ff69ca0d", "value": 215730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713369156, "uuid": "da0c6e32-4698-4319-b398-f0f1a43c8f99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369156, "uuid": "837caa2a-5fd3-46dc-b45c-30a9514fc42d", "value": "FACTURA2402616 - BP.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e718c4-fc57-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713316522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713316522, "uuid": "488e1400-c9a8-4ccc-8279-f51e22b728a6", "comment": "Malware payload (Loki)", "value": "8864b52d242037414b7c4a230c390ab8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713316522, "uuid": "5f5bf63b-b2db-48d0-818d-729655e0099d", "comment": "Malware payload (Loki)", "value": "d405284f75cde4b8c45e3d5c3b41c7bbd6db2c75788cb6d0b1deec5ea60559a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713316522, "uuid": "88003db5-77f7-402e-8ae2-61f24acc6154", "comment": "Malware payload (Loki)", "value": "47680d0f0d286097f7cdda37947aaaacd7226ee3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713316522, "uuid": "93a0939e-c5a1-40a2-9ac9-2537afccd476", "comment": "Malware payload (Loki)", "value": "ef4763b74613d687a78d0ae8a35b392ebb737b9b4fb3623e32b468d826617696fbf8ca2880e301b6ff93a946245bbb99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713316522, "uuid": "cbc84f74-d010-4a44-8503-4ac4fe7f1e60", "value": "T170C4120C9BAD5826D0DC0B7C9172509C8336E2E2F947F75A6EA088DB0E13781D59D2EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713316522, "uuid": "48d76fbb-048a-40db-bc6f-16b6246f9ec8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713316522, "uuid": "a88ce572-19a3-4902-a050-3ea09ab31582", "value": "12288:/AogULNdQcE6lIi6TckYyD1WoO3wjcuuC4KU3f3uWbF:JgadQ1iYcSWNwjHuC4KU3f3uWbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713316522, "uuid": "d3be8b14-a23f-4678-95c5-4400b8c0e499", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713316522, "uuid": "9b30abb1-69c5-45dd-84da-2cdfab8a7d72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713316522, "uuid": "ba447aaf-24d1-4340-aeef-2cfc981a7110", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c954e4cf-fcbb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713359396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359396, "uuid": "1c588907-b891-40be-881b-25d5e4bddc6f", "comment": "Malware payload", "value": "d0e692e9fd731170a037b45facabada6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359396, "uuid": "f2bbaeb9-9588-4342-99d5-dbc939da7448", "comment": "Malware payload", "value": "d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359396, "uuid": "67032dd0-8779-42c8-9dc1-4df66d9e08cf", "comment": "Malware payload", "value": "091a50a287e73283c64e9d5c269ea52595b3cc68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359396, "uuid": "4c25e201-13ea-4b8f-b97c-a68baa1770fb", "comment": "Malware payload", "value": "5e1d5a637fb37cc52218ca61f0be04afb0d797d927c0c3565cce2e3678145d3d9bc18b70221fbf7acd5b7fadeacd2952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359396, "uuid": "a391b63f-1d73-4d45-ba41-f35e1cc199bf", "value": "T1458733BB6342849BF199AD3BF4604BB13021F0451AE23716ABB89F364DCE6F1AD34711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359396, "uuid": "d9849971-4a1f-4852-bfb6-af053e9ac010", "value": "a3d629f5a29590a5e3c40a85e9084e58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359396, "uuid": "497eae2c-b96d-42a3-9214-5a7abb1e15bb", "value": "786432:GM/eCRQ8pXYfPOb0cH2j6+s7LWB75zuBOoGkVW8QOd9+zDZe:/PQkXeObXH2qHWB75ixGkVWjZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359396, "uuid": "b24246e6-1585-4906-8363-546728c7212b", "value": 38445862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359396, "uuid": "5e2b4348-4b16-4f12-bc0c-da4c3e3cbe79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359396, "uuid": "7913a3fd-968d-4d86-8128-c9626827213e", "value": "cs2aimwallhack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f340c8-fcb1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713355065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713355065, "uuid": "de195d6d-d46c-4625-a87c-542a882ca4ad", "comment": "Malware payload", "value": "a2d8ef56207bbdbc6a43d4d409e76698", "object_relation": "md5", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713355065, "uuid": "8d587064-c8cc-4c2b-8421-125a59d54f59", "comment": "Malware payload", "value": "d4990f7bcb35710c9a38dfb8c6cb324e43c47c72c6bb9c48d16d6b192fae4957", "object_relation": "sha256", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713355065, "uuid": "c8282632-a37d-40ba-81cf-035ecd144bb6", "comment": "Malware payload", "value": "7a136a06591efd719bf9df7eb0dd3db76f846356", "object_relation": "sha1", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713355065, "uuid": "3b1d8fe2-edbc-48ba-910e-271525ad0427", "comment": "Malware payload", "value": "5e893c9c1ea7771ac9bf647caec8942af3b0299677cbbed953c15ffc5b0c87a1fb070a0eb07f744f4b31bb780855c7c6", "object_relation": "sha3-384", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713355065, "uuid": "f4f00912-e82e-4620-a065-33844f4bdbe1", "value": "T16CF73313F7ECD64BCA35AEB7607F43F37998521527B3E1D32368E30158AC48A660629D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713355065, "uuid": "0c6a321f-3a37-406e-8f75-5aee3d4ad431", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713355065, "uuid": "cf0725be-9ae7-4040-89f3-9739b35b8564", "value": "1572864:F45L25PHO4M3bnAm1O0iv6sUX7yfcqjfeLIjGSBR6nDygoIgk2SIMY+mWsRo4nh:fPu4AbAD066VX7ucqjf1GSb6n27I52Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713355065, "uuid": "bb6d7c7b-1590-4636-8b21-c17a99d043e2", "value": 72886967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713355065, "uuid": "bd009de2-78ab-41a8-8620-f3147f98e0aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713355065, "uuid": "c973b966-4166-475a-825d-8a9f41ae3478", "value": "BetaUnfrated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00a72a6-fc5d-11ee-a120-42010a9c002e", "comment": "Malware payload (TiSpy)", "timestamp": 1713319061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713319061, "uuid": "d2ab6670-d973-44cd-9dd7-580ee5d5f505", "comment": "Malware payload (TiSpy)", "value": "d46259cc21634bdad5be18d4ebb4be51", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713319061, "uuid": "28cad73e-1605-40b0-a874-eac8450a2e11", "comment": "Malware payload (TiSpy)", "value": "d61f465d9c05e4bd97dd456d8f64671774879dca754c2617d1e67832a86d2560", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713319061, "uuid": "20df0ab5-05c7-4ea9-b655-0aa3e36008b4", "comment": "Malware payload (TiSpy)", "value": "4191a02c23a8aacff6caf2369e49ddc6780c3f24", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713319061, "uuid": "52df34ed-2e1d-4d1a-b99e-3105562347d6", "comment": "Malware payload (TiSpy)", "value": "d3232b89348e71e45ad6575bf5106c1d462fc62ca1e42c5d2eb2ee942391802b44da80f0ab0c2181bebc6c489f995ad7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713319061, "uuid": "5dc39750-7a14-4e72-a5f2-c15bde51c947", "value": "T125E51203EA629767E4FAD3311A61612920365D201783A396792C3BFF637F4DD0F96AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713319061, "uuid": "0874c2a3-c671-4aff-87e0-23c88c176671", "value": "49152:tpZh+nAniPeNY7Jw3S9E7n6Bs5Hpj8CppPdRL2T69mZka8SBnWFr+aw:tpZcnSiPpNXO5RppP7STnZP/BnWFr+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713319061, "uuid": "989b00b8-c76c-4a03-a716-dc7354dc281c", "value": 3259319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713319061, "uuid": "66ff2559-043c-4666-8bac-515048e05eb9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713319061, "uuid": "4757d284-6a2e-4a0c-bb8d-007767472e7e", "value": "WiFiService.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c67b75-fcf5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713384087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713384087, "uuid": "a46a9bda-6031-404a-bbdc-f2f7b2736018", "comment": "Malware payload", "value": "bb23dde1e3ecef7d93a39e77e32ef96c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713384087, "uuid": "4b51b942-1d25-45c6-9dcf-6fc02a5f28e7", "comment": "Malware payload", "value": "d63060e61c98074c58926a6239185e8128fd0fbc2a45ccf60f3c831bb18ffc93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713384087, "uuid": "4a16a6d8-7d52-4214-be02-74b5c1a2e12f", "comment": "Malware payload", "value": "d29b4588a3b20e371c56ae6e1d68e6021db056e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713384087, "uuid": "344b11cf-08d6-4e50-a62f-4e09e2da5ba1", "comment": "Malware payload", "value": "01ea165d442ddda38038624c1e9b3fa5dab41c449be03d62be4e5237c9fbf54207417086de36256386b00798f84560ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713384087, "uuid": "671a2e51-7b97-4a04-a881-c4451bc69564", "value": "T129A56B4F6081512BD27322BD5AF3CCAF9C59EAE70F50E0792FD5AB097A25348B521933", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713384087, "uuid": "682793ac-43fa-4f44-bf4e-2fa9019dcef5", "value": "54eefeea1b6ee5690f19384e423dec20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713384087, "uuid": "781ab179-5d67-48ca-a1bb-bda3bd154d33", "value": "24576:OuoA7I61C25C7F+mDnMQl7edMCPFm2xHFYf:Zk/y82xHFYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713384087, "uuid": "1a2f4e11-5f6b-4849-bc25-5a95fd4a642a", "value": 2234880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713384087, "uuid": "0fa4c0b7-d8ce-41e8-98b9-6ed06607d641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713384087, "uuid": "b2a506c5-4a86-48c2-a7aa-eabf6110140a", "value": "WsTaskLoad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dcd955-fc60-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713319989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713319989, "uuid": "119f37d2-4765-4282-9326-c4fef3366134", "comment": "Malware payload (AgentTesla)", "value": "c9a7e7adc4e2054dba4dff3dc190f65b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713319989, "uuid": "0b01a76d-092a-46e0-b29d-40c7255d79c4", "comment": "Malware payload (AgentTesla)", "value": "d6e165b127f88b60636959975f143221c8de8bef290f662917f9f61e55f2bf33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713319989, "uuid": "ced6ff4d-f0a9-4d7a-b45b-00afb89bfc4e", "comment": "Malware payload (AgentTesla)", "value": "f18dbc13e02c268d74ca73a9ff3427106256157f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713319989, "uuid": "df585b41-597b-4504-b352-1ebd5366aa53", "comment": "Malware payload (AgentTesla)", "value": "32db9a0704867283c88bbd460d0331aa3ecce3e78fb818ee706968eb7b8eaf25b48b94404b341ea20af2b929f78ed0f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713319989, "uuid": "ad45bc2c-042a-4ac9-b61d-68cdd8e94bb0", "value": "T195E4221CAFEC9E02C2ED47BC75A924901337D5A5D40AEF0FAEC924BB5D92384C7449A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713319989, "uuid": "c6113383-0efc-4aae-8024-9914321b61b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713319989, "uuid": "f1dce8e1-bef8-440a-a581-6bbf0caf7c23", "value": "12288:Pr4rr3errxgTkjggyFvqdl4kzA1kSyblQTpNgcr1rAecx4VLgxLtyvaJWJGaY7ux:sIMgTsul6HgKMrx4VsxL0va97ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713319989, "uuid": "f0dabf24-7054-494e-9106-09200a659a3a", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713319989, "uuid": "e4d16478-c8e7-45c9-b80f-52ece3374e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713319989, "uuid": "a35a9747-f414-468d-b80c-a3581c19cdcf", "value": "NOA, BL and invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfcf138-fcb6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713356961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713356961, "uuid": "2355dfbb-65c4-4ceb-b9b2-3ec1e7c49f1c", "comment": "Malware payload", "value": "03adf71656a53398e72bd7806221ba72", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713356961, "uuid": "02368a4d-0d79-4554-acbe-046877a5783b", "comment": "Malware payload", "value": "d72659338761e856187d7cd131aff4539ba0a334cc63b8fe87465568517ec743", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713356961, "uuid": "643ba79c-a72c-49f2-b3ac-96df472499b3", "comment": "Malware payload", "value": "84a6c8236c325cee22425da9879eafd1b9f67e3c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713356961, "uuid": "7e22e21f-d8d5-4a05-bfc4-02a95603eae6", "comment": "Malware payload", "value": "c7ff2a085fc4b7773a3f5fc1de25ff3c6a675a025153e51e4faed07d24dbd37a7eec2bb313f9fe975c91ae2628988cfc", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713356961, "uuid": "22dc06cb-3c2f-48bf-b235-8733e53a97ef", "value": "T133C53341F72E4461FD1A8133AA0A47E22473187A1E438F073388DF6D2676EF95B49DA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713356961, "uuid": "4cf15a30-081f-4ae7-95be-a69a1e0284b0", "value": "49152:U529ml99KMTSHh5dAS9Y9IUALpaBnp+DeMW25l3wo4Zjecn/54Q5:7gZTSHh5X/UAL4Bnp+D7WgJ4dn/5x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713356961, "uuid": "b6f0e125-79d5-4028-890c-0a9ef0500faf", "value": 2541431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713356961, "uuid": "2ff143c4-bbf1-450e-b0be-7c4069ab51e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713356961, "uuid": "cc2a1855-2840-4c8a-82f3-ade29df591fc", "value": "KosLands.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7158bb56-fc81-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713334337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713334337, "uuid": "f1d30efb-3b13-4594-bae4-2e788d779fdc", "comment": "Malware payload (AgentTesla)", "value": "58bc73ec78ca87e9fc1b1a39f6b2148c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713334337, "uuid": "6fb4416b-b74e-425d-a228-c1c45f7eee28", "comment": "Malware payload (AgentTesla)", "value": "d7e484c20f0341e35945ad2a6f803fcd0829a68b7dedf05430c0be06d5392ed5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713334337, "uuid": "d62a2de9-9c32-448e-9500-cb5523f418bb", "comment": "Malware payload (AgentTesla)", "value": "6b7ee6fa1970350afafaccaa5205c3ea68d03868", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713334337, "uuid": "9e129e7e-104f-4f58-8ad4-96f818cb4260", "comment": "Malware payload (AgentTesla)", "value": "ff2abf45b14186c402b7bd30c92a977c3c63316fee31c03a77e57a7d434369dfef028d61fa2279f07a0b6aa8c799932c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713334337, "uuid": "0be56c4b-47c5-4ed8-9248-5ab0a32a7b4e", "value": "T170C48C85EA8465A0ED59AB346A37CD3542237DFDA834A42D29DE3D273BFB3D30021257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713334337, "uuid": "7d21db2d-8026-4070-b0e7-c3576d352f15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713334337, "uuid": "1dce4072-794c-4236-9a8d-373140d1b2d1", "value": "12288:aT6D4xSSas/isvlcmAfW8FP7r9r/+ppppppppppppppppppppppppppppp0G:aT6D4xSBsZbUT1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713334337, "uuid": "8eb9c54d-b85a-4641-a9ab-f115b13694f8", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713334337, "uuid": "e09599bd-6958-4584-a7ad-1b14b1574064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713334337, "uuid": "6e66a9a4-3120-4159-8759-41b62a65fe9a", "value": "SAMPLE PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045672ef-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713353482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353482, "uuid": "4fe96720-9d39-4fd7-b9b5-f9d2c7bff683", "comment": "Malware payload", "value": "e7c614f4eb6aa532c189c76d87a8862b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353482, "uuid": "c7e37ea5-cf19-4572-883f-406a1f74771d", "comment": "Malware payload", "value": "d86405130184186154daa4a5132dd1364ab05d1f14034c7f0a0cda690a91116d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353482, "uuid": "ab7b2f67-183c-4e97-9ef0-ad4a72b580de", "comment": "Malware payload", "value": "191eda0c539d284b29efe556abb05cd75a9077a0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353482, "uuid": "cd821414-edf3-49b4-abaa-22f859344910", "comment": "Malware payload", "value": "ef6e9a26d5df530ac696e80a43a5af53a0dc0296083227513f91aba8d427a5d7ce4eb0eb1b93e5f3e22705bd6abd569d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353482, "uuid": "b96cbdbf-e410-4b97-a9e5-e97eee6360bc", "value": "T16EB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353482, "uuid": "f643977f-4184-4b92-b24d-8907a60d2844", "value": "3072:e2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:ezxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353482, "uuid": "670aefad-1b5e-4efb-85d3-dcf4920e2982", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353482, "uuid": "bb376c93-c246-4fe4-8bbc-fb341a15e0f2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353482, "uuid": "fcac1bb8-30b3-4c6f-95d0-8570bac89c06", "value": "d86405130184186154daa4a5132dd1364ab05d1f14034c7f0a0cda690a91116d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83c0f47-fced-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1713380842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713380842, "uuid": "6f931a99-e6f9-43a4-82de-4e1873107d93", "comment": "Malware payload (njrat)", "value": "b0eb1186dec29582d7c86d211e2addf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713380842, "uuid": "e80437ac-5421-4429-8174-eb61bae7f64d", "comment": "Malware payload (njrat)", "value": "d88a3e728153a059a398e01b451767e0fccf2eba9dcfeb6a5fe014363984a1c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713380842, "uuid": "b4571921-c49f-4d4e-86fe-05e605c36802", "comment": "Malware payload (njrat)", "value": "f8edefa10e35a0434bcb56ba45fcc265b4da6c52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713380842, "uuid": "b4cf3dc8-73fd-42ae-9446-f1f83ea4011f", "comment": "Malware payload (njrat)", "value": "43acd3f6403667c52cb909f5704dde9b9053bbf0446bdad4e5a692aff0ce833ef12d5de280be95c5570ae8717f1422aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713380842, "uuid": "df9f06a8-7010-403c-b5a6-f499e111112b", "value": "T1E2E2084A77E58215C6BC16FC8CB313210672E3878572EB6F9CDC88CA5B676D00651EEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713380842, "uuid": "84c13514-225d-461f-b075-15c13867cce8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713380842, "uuid": "30536bad-6660-4f75-9fe2-61b94f00f547", "value": "384:e0bUe5XB4e0X0gONpQq1pvmufCsIs6WT2tTUFQqz9A+ObbE:PT9Bui/Qqvvmu6V/bE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713380842, "uuid": "d67639dd-00dd-4b92-a4ad-333834054f72", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713380842, "uuid": "bc116338-efb2-4564-badf-8d010b055d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713380842, "uuid": "be35e64b-3156-4bdd-8e48-31002901f599", "value": "bUBD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4816df0-fcb7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713357643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357643, "uuid": "d5d908ea-f2e3-4a25-bc4c-a103440b13be", "comment": "Malware payload", "value": "e445b0ee7d6793af5077cf82e42a7b2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357643, "uuid": "9dc17e0d-9aab-495b-b83e-64eec4d47da3", "comment": "Malware payload", "value": "d96f17e47adecaaac39b45b412dc5ad640771a8b01eb69af8bf51d619f86d7da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357643, "uuid": "62f0a494-2ee6-419e-ba44-427b6e71d27e", "comment": "Malware payload", "value": "318b0dfe18f9a359f0ec93e7b76459a9afc77129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713357643, "uuid": "01ec2393-14b9-4d12-b6ed-0465eda3451f", "comment": "Malware payload", "value": "758ed57ec8884d60014388ddc8f94578d1397abec7b7eed0714dfeb6e89ddb7836d1a15ebd7fd669601ab296c0d71365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357643, "uuid": "a6eddbfa-28a6-4ee9-99da-643aa9b7696d", "value": "T1FEC712B1518CCA98DB930232C896F6F78126ED39EA68E0CF99C53E0DF7391F71525606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357643, "uuid": "79d815ec-3201-40ef-9f36-bec12e56a568", "value": "1d7c6a6bf6e60e9e3d2eb632c6342fa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357643, "uuid": "c54dd612-3485-462f-82fc-87bb1253a4a5", "value": "1572864:O0ftYnxgQ4gRWTDqxvhnZ6uXGF7+SKd2rEeitB:9mxOLexJjStr8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713357643, "uuid": "f86ef241-b708-4f5e-90cd-d71ad1c6441d", "value": 57594680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713357643, "uuid": "5fa62657-6759-425f-8baa-fbe34790ecb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713357643, "uuid": "1fc560bb-729a-4f3a-867f-c394454aef24", "value": "SecuriteInfo.com.Trojan.Siggen16.43571.24558.29997", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204eea06-fcd8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713371568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371568, "uuid": "d94a0073-f62a-403f-b30a-31f9f0c77561", "comment": "Malware payload", "value": "6a5e53cda82dd4dcb0f9312bb9d70718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371568, "uuid": "2c6dbe79-af0a-4818-a7e9-0b558775dea1", "comment": "Malware payload", "value": "d9957033e0c39d8b6ff8153376b097a1090e5c60a2a4e6931741dc1a66fb5c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371568, "uuid": "4824fd2a-642e-4252-9472-86be700dfb4d", "comment": "Malware payload", "value": "0eceeb987206961b61e4979383a24f32d24171f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371568, "uuid": "c5149929-38ba-4813-a92f-7bd2970f1b81", "comment": "Malware payload", "value": "995e6f325255399180061ce7e82639f9f946f5eb83e7485b5faebd370706924536154b971528a920732986a02fdd2d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371568, "uuid": "2b6a6f15-4343-42ac-9b06-8aef56e6349b", "value": "T1CA16013BB268653EC4AA0B724573D270997B7EA1641A8C1E07F05C0FFF364611E3BA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371568, "uuid": "c9838cf5-343e-414f-9741-ccb326aed43a", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371568, "uuid": "947c3743-4573-4453-815b-9b989fc4814e", "value": "98304:AkLMtpdcLQiJD7Qkx7YmU+nEJj5dYJ0VDy183R+eD/mJQv5uS4MBZ:fMHdcLQ+Bxu+EJI0JH3RvjmU5uKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713371568, "uuid": "83505957-a494-4b10-b83d-0940ab15de80", "value": 4366864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713371568, "uuid": "25ef962c-ff36-415c-a926-2d07eb8b1542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371568, "uuid": "26ba9150-c5de-493c-95ce-4b535ec180f0", "value": "SecuriteInfo.com.Trojan.MulDrop21.47437.9997.15961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d6daea-fcbb-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713359093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359093, "uuid": "a83c6928-98a6-41b5-9d13-415b6db99a22", "comment": "Malware payload (GuLoader)", "value": "5ceea969dd70cb1bdd77ddb8cfc4d801", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359093, "uuid": "4866da0c-4d8a-435e-bed1-ad3c2302feb6", "comment": "Malware payload (GuLoader)", "value": "dc21cd0bf3eeeb464624f8249e809267c45929117da1da3769a57a0f0b8f31d6", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359093, "uuid": "ca662ba3-e22e-4d83-8974-369fb0777e1d", "comment": "Malware payload (GuLoader)", "value": "e14c12305f0c5c884e6cc91f8f358023d2d142ae", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359093, "uuid": "d2b88ec7-c296-454c-80d4-da4626075eaf", "comment": "Malware payload (GuLoader)", "value": "8d925a357169237ef0fcf63bd2147ff7787d202535e01ff0321c8b3b599859e127a24e5b34bd1b7303cb20d5034a1088", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359093, "uuid": "65f5268b-e2e9-4433-a5a9-5de897528f0c", "value": "T137947D60EE68065A0E4B279AFC911A92C5FCC219462710B6FEDD074E61079ECE3FE71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359093, "uuid": "f47d70d9-d6d9-4e49-9433-7f3a95ede8a5", "value": "6144:ltrc0iH9QXg0IC+lUnFNWtBVkm9tgNZq3M8FD3ZGZBXMV3:lFidQ0YMzeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359093, "uuid": "a91c0b9e-8e58-476d-9a00-09730e38209d", "value": 412999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359093, "uuid": "ac88b3cf-4336-4dc9-a7d1-5bb8ff010c8e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359093, "uuid": "d7b2cbe6-a912-42fb-8085-8a234aa3f3e0", "value": "Shipping_Invoice_xls_AWB_pdf_0000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69326bd8-fcc9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713365247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365247, "uuid": "42dfd55c-b36b-42f4-aa03-12226d6b0701", "comment": "Malware payload", "value": "4d81be09c23e02fab7364e508c21c111", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SSLoad", "colour": "#9E91F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365247, "uuid": "ca357ed4-6cc5-4f66-9628-5c63c3367016", "comment": "Malware payload", "value": "dcae57ec4b69236146f744c143c42cc8bdac9da6e991904e6dbf67ec1179286a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SSLoad", "colour": "#9E91F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365247, "uuid": "2a0fa400-8581-4305-8f56-e2deeb8a9180", "comment": "Malware payload", "value": "52cae521d7a808c8206f4b5afd6b037bc573b50e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SSLoad", "colour": "#9E91F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365247, "uuid": "4b298106-a123-47db-93a7-2a0d755df184", "comment": "Malware payload", "value": "b4a554357b13d798fa29ecf4f0b31b72a211f7f3833ebe5bc4450f3c233041d9daee330b3e34df960923df25cc0cd1cb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SSLoad", "colour": "#9E91F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365247, "uuid": "ee498b46-6669-40b1-9ec1-4c750ef40898", "value": "T1D465E0223386C637C9AD0270361A969B2578FDE74B3180D7E3C9291EEDB44D1663DF92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365247, "uuid": "4aac9b32-9ce1-4ceb-b14c-3bcfc6ee3b94", "value": "24576:BqKxnNTYUx0ECIgYmfLVYeBZr7A9zdfoAX+8UhxcS:Bq6TYCZKumZr7ARdAAO8oxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713365247, "uuid": "262b6a1f-abec-45d9-859b-ec202849560e", "value": 1427968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713365247, "uuid": "6b190f72-92dd-4b66-8c72-9e145f62bd14", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365247, "uuid": "8063d9e2-543a-40d0-a2d8-94c39c6fdd27", "value": "avp.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940a3ef0-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload (RustyStealer)", "timestamp": 1713353723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353723, "uuid": "6777dbde-092f-42f6-9a4a-88c6a969ddb6", "comment": "Malware payload (RustyStealer)", "value": "531e894e882d36d0b68ddeefd16a45a4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353723, "uuid": "dc94ace8-6147-47be-8e79-4fe2dacf8266", "comment": "Malware payload (RustyStealer)", "value": "dd0a3ec32bfb425ee68f89e189697e351acedf8e88259054013458ffcafbabd5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353723, "uuid": "67ec6f17-36b4-407a-9a1e-2ec728c74e71", "comment": "Malware payload (RustyStealer)", "value": "d9825fc3d8caaf3d2f99d28d925afe5e22445c17", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353723, "uuid": "964b4ae1-f14e-4f7f-b196-67fdfee0ff0e", "comment": "Malware payload (RustyStealer)", "value": "fc4c3883610defe9d55b4241db033751f07514e97d6d43784a9ad229e022bb30f040c43b1a651469a4c4c6c6a6b889c3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353723, "uuid": "fbac880a-4780-4421-9123-b774e9c88941", "value": "T160D518117B4A99ADC05AC4B082478B626A717CCA0B35BAFF4584B5343F7AAF51F3C358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353723, "uuid": "d30d64cc-60c1-4342-ba09-321b08ce9ceb", "value": "1d589303777bbaa8685babdc003b2dad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353723, "uuid": "4d9a0e25-924e-4e05-a633-b1339557255f", "value": "49152:Tq1Zn9CoABRrO7y1GCJQdpQBRgad2cOrpO:mUXqpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353723, "uuid": "e6170a68-ac7c-4900-b3a2-a0ba4fa812fb", "value": 2910208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353723, "uuid": "3aef757c-4738-4c59-b204-d654b98ed6df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353723, "uuid": "c24ce822-58b4-44c8-8440-32ef6f1aa278", "value": "531e894e882d36d0b68ddeefd16a45a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c4831c-fcc8-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713365059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365059, "uuid": "e999a21e-9a4d-4cac-ac45-242facc0e71e", "comment": "Malware payload (RiseProStealer)", "value": "6a888dafbcc80262412479b034325e9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365059, "uuid": "6c37fbde-5c33-4977-9f4c-1446d21ae53c", "comment": "Malware payload (RiseProStealer)", "value": "dd597382fa2346db39334557fd3eb8adba3abde583ce12d6ee496be7fd8774ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365059, "uuid": "320b6edb-445c-428c-a1c2-d23b1df4e5b9", "comment": "Malware payload (RiseProStealer)", "value": "d12a2f30ae4c6e8df08be67ac0e416d8f4dd5943", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365059, "uuid": "e30095ac-0d3e-44c2-b050-e55bba79c080", "comment": "Malware payload (RiseProStealer)", "value": "a17ef32b78737c1d77b4f73a46dce1ea06c634f13e5525dabd629622e876cdf98da5e03244b86fc853116e5b1e0b8014", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365059, "uuid": "62d0091b-3f7c-47e1-b805-b5fa06129711", "value": "T18215F10272D0A8A1E53347328A6DF5B4663EFC654F556B7B3F885A0F09710A0D6327BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365059, "uuid": "68c9a5d1-d1af-46e1-bfcd-5d46ad5ab934", "value": "82db959f3b3344b845e4c7b707536cda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365059, "uuid": "8f5aa4d3-e422-4776-9259-780162d1e831", "value": "24576:5Rm+Qa6RmEGY+bIS+XS3ZJ9UQGXkIHluq:PuRBSUS+X46dkHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713365059, "uuid": "ec3a0e29-b788-475a-bb85-93491deae481", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713365059, "uuid": "274201bd-8a9f-4695-801f-4c75324325e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365059, "uuid": "4332160a-6890-44cd-8356-b36d498deb70", "value": "6a888dafbcc80262412479b034325e9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d88545-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713367998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367998, "uuid": "77873324-ae29-4e20-b90e-934d3898c401", "comment": "Malware payload (Gafgyt)", "value": "7b992e2a1572360070343b03fe00db4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367998, "uuid": "f01e3db6-f07a-448b-91e2-8fda723d8ef6", "comment": "Malware payload (Gafgyt)", "value": "e04bddc99a7ad90ec1f7fcb9218618e0c541e9dcfa8df2b54aadcd44b84426d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367998, "uuid": "f8cda8ed-3e79-43b5-8410-37faf7b475f4", "comment": "Malware payload (Gafgyt)", "value": "d6e1f573795207e47350ab7d7371850c31a67486", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367998, "uuid": "0e7e2225-7e90-4b8a-8454-ca9197fc049a", "comment": "Malware payload (Gafgyt)", "value": "c9b8b823d9675a9339202056e88452a4c338c25042ff62e12b850f115bb4059245fea61425bbdd71d21c8689a8bc3831", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367998, "uuid": "9213bce7-fede-4b6a-95db-d413cd061c46", "value": "T106F33A02F8004767C2C26BFBB35A538D37625EA95BC73341D6297DB02FE17991A39AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367998, "uuid": "1818eb71-f8cc-464e-b75f-c802535b5b58", "value": "3072:V9ZCmuydtD9lk5p56zXDDp4kG8jetJ8add9Qzhsqdn95vNQ48DXLqCQSUfWvQdok:VVzTd4khetJ8addQLdnD1QVXLqCQSUOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367998, "uuid": "110273c5-eb96-4a9c-82e7-293ca6da124c", "value": 159396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367998, "uuid": "5ce03dd5-3e3f-47d2-9d52-10f9503b635e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367998, "uuid": "e3d5b49a-9908-454d-b719-c7f2a4b04c7e", "value": "7b992e2a1572360070343b03fe00db4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7f061c-fcbb-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713359243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359243, "uuid": "b86c85e6-691a-4caa-a70b-2cb0b2fa211d", "comment": "Malware payload (Formbook)", "value": "77b7c892e7ecb18d7ed6670b8d7b8b1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359243, "uuid": "8ae19a19-fb78-4b6a-a2ad-e79541a4f6cc", "comment": "Malware payload (Formbook)", "value": "e23ae98f0454da76075f89eef1e4808d62c0f7e4b5c191e4d40a8bd3213cb1a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359243, "uuid": "92308d9e-45b3-4b7e-82e4-6ec075c221a6", "comment": "Malware payload (Formbook)", "value": "df3107b0adcf9029045692067a65892fb8f4b3d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359243, "uuid": "899bef68-e49c-4bdb-81b2-015c32b64f42", "comment": "Malware payload (Formbook)", "value": "9a610391863969276809f80d89797a09e42d3ae28fd9e8fc019f934d10ee420bb5c6836fca2c7c84151baaefe3a972bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359243, "uuid": "27c44832-22c1-4c09-b642-e08ddf0b961c", "value": "T17015BEE8ABB250EEF752D43D39C68EAD71E0EE3419D6091B757DBF1817322918EC2241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359243, "uuid": "abaa4600-6b62-4f97-a5fb-54850242fe35", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359243, "uuid": "00fe6c03-5cb0-4373-8b88-a92ea39943df", "value": "24576:HDgVtWN/pm/avooyRDtwZkz2joXW+rU9kOa:cpoxV+r6kO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359243, "uuid": "4352aea5-46f5-4c2a-a014-648f498d446b", "value": 942516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359243, "uuid": "3087467e-44cf-4e7e-b873-76f2c43623e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359243, "uuid": "895a35a7-6700-4cb1-b811-e42bf1bd3512", "value": "1704202412475.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906d0806-fce8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713378628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713378628, "uuid": "7afd19ea-0407-4b26-9d59-b9deeffc39ae", "comment": "Malware payload", "value": "546456c9cb74bfe6dffbd63738591cd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713378628, "uuid": "358faacf-1791-452e-94cf-47f2d2281253", "comment": "Malware payload", "value": "e27fe8380a2642aef8d52caf142be73f956961cc946777cf625b2c2fd0b94773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713378628, "uuid": "c203c994-c6d7-4df9-bfc0-4c87fec39e87", "comment": "Malware payload", "value": "aa2a1e0aeb7423447a8d7b01d57193adab770525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713378628, "uuid": "0b92b715-b7ee-4bb4-a827-d82e5d32ca7f", "comment": "Malware payload", "value": "685d53fa455225cfc8fca3dc8d23748cd22bbd1dcb36c9fdcc89d43d95b4ba2ca052bf6cbe23aa47a25b199a2f3d3571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713378628, "uuid": "dfb76287-a6b5-447d-9b17-27be349736c3", "value": "T132364A91ECDF44F1EB03093455A7537FA338630A9725CAC7DA981F4AF8236E21A77216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713378628, "uuid": "a7288f4a-0ef0-4bef-a12a-6ed29b222cac", "value": "96c44fa1eee2c4e9b9e77d7bf42d59e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713378628, "uuid": "9fca9d87-9e4a-40f8-ae0d-4b89f3c8d2b9", "value": "98304:JmwpPP+BMSB4lMy/bLtDAPdT8BmMdFxw8Q6n:JxpPP+GSB4aySPdMmoFFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713378628, "uuid": "532128ff-2db8-4a0d-88a3-a69c6cc13846", "value": 4897792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713378628, "uuid": "d7b62006-79f4-4293-8f05-05bd8f22ecfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713378628, "uuid": "ea5b53f1-c051-41c8-8094-261ee619b22e", "value": "SecuriteInfo.com.Trojan.GenericKD.70961358.12812.25354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44cd5ff-fca7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713350851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350851, "uuid": "61c438e7-95ef-4fae-8f8e-b44f2aff209b", "comment": "Malware payload", "value": "b06e16b8fb05c5920291b14bee44cf6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350851, "uuid": "69efef06-661d-4073-815e-975499389809", "comment": "Malware payload", "value": "e34c7e40ad49d585f438c46312a2360866391c4c6c9e11a759e67fa892f48edb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350851, "uuid": "eed84854-7e85-441f-8b31-091aa856326f", "comment": "Malware payload", "value": "fb4d7435766f0539ba510d4f5e53c17ab2717ef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350851, "uuid": "1fdd7d44-f928-4337-9ab5-bd936e1738da", "comment": "Malware payload", "value": "b734f1e68a81f55b6f16d98caf18f6637b48ddc957e0c62fe039d01748c6af06be8a87854c8de228b7fc479141b376c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350851, "uuid": "935bd5aa-2cbf-452d-a424-623d5bed545a", "value": "T11EE7330C3D1980B3D9876775B6097F69A43E8E1353635D680AD9B3C3A339325AE06E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350851, "uuid": "a3ea30f4-29ac-4371-9790-909d2de09e8c", "value": "b1acf33ac5d2d07c82422095772ab92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350851, "uuid": "3540639f-5ca0-4824-b5a9-c5536d0f8b20", "value": "786432:0AvxqSeY83w9+gw21eWRvIGU+lVBPeCV+sxJ0S8Ys5qDTg2MK4gq65VkE2gElS:0rSb83w9/b1epGUKBP5B4Cc2MPgZeNlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713350851, "uuid": "d9778909-b081-4e9e-8c44-d8c013a2825f", "value": 65519800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713350851, "uuid": "d6cfdf9b-8c29-4800-8259-76ea894c5414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350851, "uuid": "510af533-da91-4005-a96e-d42dcb1f5bbc", "value": "SecuriteInfo.com.Trojan.Siggen8.16025.3712.2960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a511b5a0-fd12-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713396701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396701, "uuid": "286b6bff-f10a-4159-8434-1decef602dac", "comment": "Malware payload", "value": "301cc407abd6736140ae0df3c53aec64", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396701, "uuid": "7f1f55a6-4a49-46f0-bd90-6d79248926eb", "comment": "Malware payload", "value": "e3aab908800cb4601bc4a87ac9ac48d816ced57cdb409b6e2468956cc50bdf04", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396701, "uuid": "abbe2204-5a11-42de-8a78-c37548e3a478", "comment": "Malware payload", "value": "e611be05f66ae77beb53328e98217f89af449096", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396701, "uuid": "5f4dac8f-dc50-4505-be05-3ed35ea16506", "comment": "Malware payload", "value": "3d2df28dbbd0a05014365b67f319464fdb0bbf4899a1fc00263e517d1c8fb16636cc6cf8a1626db945f72c83c3635a5e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396701, "uuid": "d866df23-098b-402e-9bfd-a9f7b0a3a0be", "value": "T14D6523D6C05C1DF29135282BA46A7BA13E111D6B2B3E38982D9FEDC3CBB80E54D556CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396701, "uuid": "e8616b96-a166-4b07-b881-dbe27ec9785a", "value": "24576:nAHgTVEYTG8g9dnGU3XNqW+E8C73G+xY3/My4c763Gheij87uptkuLpIXEfsxp:n2E5g9hbXUjHQ3G33Uy4+zj87rcpIXEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713396701, "uuid": "6a2ec16b-3ff7-4551-bac8-8d2d62450041", "value": 1441224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713396701, "uuid": "6cb0259a-a430-49f8-a866-345f11bfccaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396701, "uuid": "94274f4a-62f2-4709-8a3d-bd98a5e11aaa", "value": "301cc407abd6736140ae0df3c53aec64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bcdc06-fc93-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713342071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342071, "uuid": "ae2adb1a-9f9f-486a-a388-85741f1d79a3", "comment": "Malware payload (Mirai)", "value": "0fe4f0fb4c4ca8e779a19c6d0f07db68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342071, "uuid": "6f815f55-b8d0-44fc-b8ff-331afefc8177", "comment": "Malware payload (Mirai)", "value": "e4504f9329e03f782a75dd10cc4f849e17ef9a116b3b05dcc82e5d82c846ef68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342071, "uuid": "a9deb817-6585-4c0a-8a68-04c11c44ea6d", "comment": "Malware payload (Mirai)", "value": "98bc56ebd56f3edc3c3d1a0a1e26ec309e963395", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342071, "uuid": "93257d31-3f78-4973-9273-7ddddc035260", "comment": "Malware payload (Mirai)", "value": "4ee6ca4f35022ecf36a0b0c24c6d19c974cdae748f56eb72f2dcab20fe0b4d9e93c611f93a56aa6bac16203a61f8a3f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342071, "uuid": "b7c47f55-9940-4f16-9bc7-9befcd3d29f9", "value": "T149243B46AA408B13C0D727BAFBDF425533339B54D7EB63059528AFB43F8679A4F62102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342071, "uuid": "54fc3f50-f687-47f9-ae7b-d617c6d57c4e", "value": "6144:kXzTbjiXMaNLjIP4730Q48gXGMInbTXM/Ragf10t:6iXMahjIP47tjsGMMTc/4gd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713342071, "uuid": "8c1e9ec5-f043-4ea1-9b7c-7b6798950d97", "value": 209815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713342071, "uuid": "71507502-7c7a-4145-8416-91f7737e9810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342071, "uuid": "0440016f-991b-4261-8286-0ef824a3f003", "value": "0fe4f0fb4c4ca8e779a19c6d0f07db68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15bda32-fd08-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713392427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713392427, "uuid": "f6577382-fc35-42cb-8cfe-035500d390ec", "comment": "Malware payload", "value": "e261c723ea0d09584221be5ea667faa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713392427, "uuid": "e3657091-38fe-45a4-8db1-05b2fa39e744", "comment": "Malware payload", "value": "e51d70e025e061bfe852cc6f9c8b61d725b0f69ef3ab895ec7d25847b4033527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713392427, "uuid": "22382bc1-f748-43ec-8904-146bc36522bc", "comment": "Malware payload", "value": "aea5a527e95a5cb8e702acb15eaf97e72af17078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713392427, "uuid": "2ffb78e0-ba60-40c0-a119-99f82e1abebd", "comment": "Malware payload", "value": "67407893cc996f0f691ff6e7eac61abc26ecee272a1448e8a8b9b32e7a89f2adb5f3601734a09b57c13b01b73da016e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713392427, "uuid": "9a56dd9a-c596-42f2-a3bf-05fe7124fd50", "value": "T18516F1317642C173E56202B1ADBEAB7B497CBA240B6455D7E3C40E2E5D701D32B363AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713392427, "uuid": "bff39ca3-6dc8-4b98-98c2-93b797a7b056", "value": "6cc397f4564f95892a68bacc5f0b9fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713392427, "uuid": "ee0c5ce1-8773-40d2-a7a2-2f024f9087a7", "value": "49152:DQiSjqeAOuRYHwgWzLrMbZT29RrflwGWQ4B/vFgG8La5BdXKshIIFQfK2Nkt20g0:Tmq6gvrMbMZzmHFgGTLlKshIBKSQpg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713392427, "uuid": "e0a84d41-cdb6-483b-9cba-40dd883b4fb1", "value": 4092104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713392427, "uuid": "aba0d1cf-bd6f-48b0-8503-0b0b54c0ec97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713392427, "uuid": "344c39f6-4250-419d-9014-f40a97974aa1", "value": "SecuriteInfo.com.FileRepPup.24194.30525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f55d8c8-fcd8-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.EasySpeedCheck)", "timestamp": 1713371566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371566, "uuid": "7fc06c51-08b5-4f38-a90c-e830c072365a", "comment": "Malware payload (Adware.EasySpeedCheck)", "value": "f302aa292b7fb737a9f2e04a251c2c88", "object_relation": "md5", "Tag": [ { "name": "Adware.EasySpeedCheck", "colour": "#F0CC8E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371566, "uuid": "1b9da6ed-ea7f-4ea7-9cf1-013242d0f7cd", "comment": "Malware payload (Adware.EasySpeedCheck)", "value": "e5410fa6bc9682354b94fa6aece1efa1bea04f2eb677aba9e55f9d3db66d4d62", "object_relation": "sha256", "Tag": [ { "name": "Adware.EasySpeedCheck", "colour": "#F0CC8E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371566, "uuid": "a122a35a-f509-4c2e-8712-53b725efffa1", "comment": "Malware payload (Adware.EasySpeedCheck)", "value": "49501970c20fa9ce34bd192b28d0b3aacfd7d975", "object_relation": "sha1", "Tag": [ { "name": "Adware.EasySpeedCheck", "colour": "#F0CC8E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371566, "uuid": "ac6b353f-1e39-44f7-b872-c5f8e6f31c6f", "comment": "Malware payload (Adware.EasySpeedCheck)", "value": "2f44b531cd74700f096dd6da4f4779c2ca7596140899691bf63add7052bf6bc675be76d69a1e611d0c3692091406a710", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.EasySpeedCheck", "colour": "#F0CC8E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371566, "uuid": "fad1711c-9b46-47d2-bc69-315958cdb5d5", "value": "T14AA52313A3C344B0F5A85274C4F88064AC27BAF919F1655F2EB4DD0F46F9B914C76BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371566, "uuid": "ee47aae8-156c-4067-b4f3-5e35fd5207ba", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371566, "uuid": "0f446373-7724-4471-b886-ce473251a0cc", "value": "49152:UdIOrYThNwWrJGpInzu5jqdnMqRu3YpV9u1R:8YdxRz6jqdJ9pV9u1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713371566, "uuid": "f606954f-51f1-4aa3-acde-a2645e7e29cc", "value": 2107056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713371566, "uuid": "065e77d1-b068-4d97-ad83-5d8cfe794f28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371566, "uuid": "a96080e4-6a8b-4182-bb1b-4ca34238c7ad", "value": "SecuriteInfo.com.Program.Unwanted.3981.17253.16925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7cd6d8d-fcce-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713367527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367527, "uuid": "50b8b9a5-585f-4b82-a522-f8f628e4a35e", "comment": "Malware payload (Stealc)", "value": "16e0c2adf45ee2b3f189a49f3509a9a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367527, "uuid": "ff1e3a16-c690-4784-acd9-18328f7cbebb", "comment": "Malware payload (Stealc)", "value": "e61a1c0e47f6e5606ae0df9b2e8b41d26e2cc4b7d8a77c67032bcd0ad32b4d5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367527, "uuid": "0a3c676d-28e1-4dc1-8e33-0dfea1632734", "comment": "Malware payload (Stealc)", "value": "750b5ee21ceb0aca375ee37a0be4557a9d624d28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367527, "uuid": "f5000ea8-2e5a-4932-a014-2a5427a593ba", "comment": "Malware payload (Stealc)", "value": "8d76afdc88d66a1aebc71726336b0320a3c5b6174b05a5749a171d23a4f310f6c2ca67091e9b8a7f6211829e84c49ba3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367527, "uuid": "a14c144a-1b83-4fb2-8e65-e37a0b74b925", "value": "T190647B0272E0A871E77346324E6DD6B0667EFD614E665B3B2348DE1F09710B1E632B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367527, "uuid": "2b55fc39-3195-47a9-9b72-4628e2062a2e", "value": "82db959f3b3344b845e4c7b707536cda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367527, "uuid": "45f31825-1854-4dd2-8050-669351bdbc14", "value": "3072:gCB9Kfmm7scinT9gqFXPF+kPCNN6KGgkuReCyzEeQ0r5Q4vv+w+084rbm:q/sRg4fFdOUwj0bK0hrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367527, "uuid": "c1c57db6-b106-4378-925a-00afb416dae5", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367527, "uuid": "65fbd5ba-7ca0-49b7-a100-3bafe5b4cb1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367527, "uuid": "d35b3e64-45b9-46bf-8238-da4cf2a78f3c", "value": "16e0c2adf45ee2b3f189a49f3509a9a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9c3a7d-fcda-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713372607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372607, "uuid": "8676ae7a-1d5e-4cb7-944c-2222585d938b", "comment": "Malware payload", "value": "ba80d0fad7e6692b7dc02fdd27630415", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372607, "uuid": "52becc91-d6d8-44d4-b14a-0600384aa3d9", "comment": "Malware payload", "value": "e8a90f6a7f3a6fa6991bad78fbd9cf392003bd7a3b143e6bb445e38230d9e234", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372607, "uuid": "a4826368-1a65-402a-9338-195abcd7af6a", "comment": "Malware payload", "value": "84cd7c5b13937fb95863d2374a15c94a75525c1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713372607, "uuid": "42c3800b-50c6-4d23-92b7-2c8752f20a01", "comment": "Malware payload", "value": "9e9e6bf3dcb0f82144e8964d4ff8c0341265f8ba860b5fd786a8c11f8f7feed670ddb2ad17fd25372a681e47830bfe99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713372607, "uuid": "0a92f7a8-cf8f-402f-b3e8-66fe5bc61454", "value": "T16D753303D626D5BAEC4FE0F7D177B801E18473047CD5E9987A8D5983BA6CE8AB0B1847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713372607, "uuid": "4d3ab6bc-15fc-4aae-a210-1ed5baff0417", "value": "24576:JC/VnHbRg/ZbuDVB/eNDZAB145qWGxRfWyIGi83HPxwvyrPY0ixpmuJ5ogpyNcct:Jl/ZbuZB+muWuyIYxwvBvB0ZcjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713372607, "uuid": "6bde147e-29ef-447c-aa0e-55c6e5135c24", "value": 1598628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713372607, "uuid": "f4d2e2f5-33cf-4b88-9a3d-55c6494973b4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713372607, "uuid": "5c6e094a-037e-4b58-a5df-1c4f5c6316af", "value": "aac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a85dac1-fce6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713377759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713377759, "uuid": "99572d22-777a-44e2-8036-86a50f83ae66", "comment": "Malware payload", "value": "972c9ea0e66cc32de5538d06a254982c", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713377759, "uuid": "c10888e9-906f-4206-8a4f-b1846c54b86c", "comment": "Malware payload", "value": "ea13d6516f8495adb58f5aabe1961be79833696c6172f71d02885e36b8b01a68", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713377759, "uuid": "cf6236d8-1f4e-49d3-b957-708773ff75cb", "comment": "Malware payload", "value": "b75f48301203517c0bd400601fd79144c82b9f5d", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713377759, "uuid": "01c05980-ada3-40a8-a60e-5c97dc5061d7", "comment": "Malware payload", "value": "d51c156084e5ec59bffe10d15acd51fb771d4781e2036b23c8d7f280db969201b3f560762c90bd9d924f23b46480fa66", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713377759, "uuid": "020a8ff5-50cd-4a1e-932c-0c1e5b171296", "value": "T17C0178685D566464C47333B8E8AF840AF83221732A21D4913CACF1C06F71038137AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713377759, "uuid": "fb88e282-1080-41cc-af03-ff2ae1a425e6", "value": "12:Um6GTeEHjdR5ka4uMxvKPMPDJZyB0dzX4yZatJqfCNHyR0:Cov5kahMk260d9PfyK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713377759, "uuid": "8d0bac95-5c74-488d-b459-b227befdbac4", "value": 692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713377759, "uuid": "c4bad561-6608-4304-a554-42c77c0ecf61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713377759, "uuid": "7757f116-1253-484d-992a-65fce8f6cdaa", "value": "deobfuscated.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142e10d0-fc9d-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713346207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346207, "uuid": "8e86248f-a85d-406b-bc2f-c2cf746e8664", "comment": "Malware payload (AgentTesla)", "value": "21567fdc35f2e2b1267e2b05ef93c1e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346207, "uuid": "4cf45a99-28f0-44d5-80bc-ecd48d94a5e9", "comment": "Malware payload (AgentTesla)", "value": "ea661c4ee89a3ef8597d369c559cce65600681f93dc4e7a2902e27ca1edca20c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346207, "uuid": "0550a33e-943a-4966-b105-c19c12b281b7", "comment": "Malware payload (AgentTesla)", "value": "8c0ae287dbe41eb30070981d110268865ccf796f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346207, "uuid": "2f8bcf32-f9c7-408f-94e9-efa15216c2ad", "comment": "Malware payload (AgentTesla)", "value": "37502a4bc8366701495e9c0933ee22e72e8ebbe99ad4e186d8a823da096297c5721aae04f1a27f24e3ff600bfab442bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346207, "uuid": "a3b59e30-897e-417d-9b97-efbb6e2760f1", "value": "T1C3D4330C6D345A7C4D246E029BB9389E89A8C85A7C92B05F58CE1FF7AAC3C05D2FC4D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346207, "uuid": "009dc454-e274-4bac-ae1c-5494da836dcb", "value": "12288:DfnNfhcTH+PlIDPTHPAlyRMoAF1erM9deMr4ukXcMCN9QGtolbfb2rffA7dHd:DD7+DPT4ya5Fx9deM0DMfpWlqfA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713346207, "uuid": "0b548c3d-3822-4fb0-be27-954e0ad5de4e", "value": 643436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713346207, "uuid": "493e951c-4dff-4683-beb5-792ba22bb2f1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346207, "uuid": "911cc6fe-6e7d-4c1e-b4c7-2cb1b831691d", "value": "P..O PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55246d6f-fcf7-11ee-a120-42010a9c002e", "comment": "Malware payload (RaspberryRobin)", "timestamp": 1713384971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713384971, "uuid": "127a5b93-2368-45d2-8226-c355e401a776", "comment": "Malware payload (RaspberryRobin)", "value": "626bc2db203ce8a9ea8088922e31ba51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713384971, "uuid": "f69e952f-331d-40a4-8ed6-0a45356fbfe9", "comment": "Malware payload (RaspberryRobin)", "value": "ebe3df1700d539b39c23a9c5315f3a89a0fd2b926cd74f3cf83b32085f7d8c44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713384971, "uuid": "908ed559-5aaf-4ca4-a6d4-b37789167f67", "comment": "Malware payload (RaspberryRobin)", "value": "4175eadd3536f55fc8fae3bfd8abfb6b9bc4a6d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713384971, "uuid": "120966cb-53a7-4ee3-9309-542030250dcd", "comment": "Malware payload (RaspberryRobin)", "value": "891dc33784221a36e7dd5751fe56ea2e67e75fdbe456b23bf905b78fc8d20c2eed7f9c32a5cf8c0fcd1c936351fcb0c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713384971, "uuid": "f3b0926c-e036-46aa-bf05-864095f6e80e", "value": "T112A52221B7C89871E262053B49F046616E39B9720F238AEBA3F83E6DDF745D09435367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713384971, "uuid": "2510d081-3155-4314-93cb-f625b92a8ee4", "value": "10b73c5f7fc148e21f974da703236659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713384971, "uuid": "46ab6dd1-ba5a-4c1c-b1c7-d261971cd20d", "value": "49152:1monDUd2s32ybGQ7RTztybczz9edbTGx+u8Onq6QGCp:1mooZnbG+1ybeZednlSqFGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713384971, "uuid": "303a817a-fb57-457e-b7d7-5b181a35d6b9", "value": 2231615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713384971, "uuid": "bdbd60a0-0f3a-428c-830e-62070ae089c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713384971, "uuid": "8e6e57d9-e7e4-4873-85dd-59c0d4def841", "value": "626bc2db203ce8a9ea8088922e31ba51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f01b7d-fc9b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713345671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345671, "uuid": "b0b0a1c4-5c12-483b-b046-b01d79743998", "comment": "Malware payload (AgentTesla)", "value": "e73cc6a9e8f8d97de0aa0d5a53cfd0cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345671, "uuid": "b883adb0-7a5d-4504-aebf-a2e4ac901c10", "comment": "Malware payload (AgentTesla)", "value": "ec20774a0a999b7f231404214662eda2697ea5dcee82139d22430e7f06e47792", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345671, "uuid": "737718b1-f8b9-4a46-8b4b-137356a83e8e", "comment": "Malware payload (AgentTesla)", "value": "fd6bdddae9926d789abe85890216cb5b34254b7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345671, "uuid": "87449ba7-9cec-4d4a-a8c4-7c8c52286866", "comment": "Malware payload (AgentTesla)", "value": "3529b629594ea4d5f029605628ad72b6031773223ccee782afcc5ba38f8d4010249110351d6da26d9a51a761f89495f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345671, "uuid": "395be436-2574-466f-8d78-ef8a33fbbdb7", "value": "T10815021372C4192FCC2A5A7984D6401427F9AD971553EFCF3EC0B56DA8BB3C84D8B89A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345671, "uuid": "936ae598-d514-4e7f-b216-a2c68b27b995", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345671, "uuid": "c9ae81fa-28cd-477f-86fa-dfbb2e9f52a4", "value": "12288:agL9q2cWjoIkcQ855VG8N+kxccAexr7VDMq6dGs1b3rFzfEY4Cd:BMrAHQ8M8Nzxf9r7VDMq6Qe7hzfEYDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345671, "uuid": "5fede619-6fbf-4e73-b1fa-b3dd2579e79f", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345671, "uuid": "aaacb30a-5a1d-41f1-8b60-c4d8bf311b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345671, "uuid": "3b35a14e-99c1-492a-a02a-38822d3c4d23", "value": "DN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa83284-fc69-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713323919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713323919, "uuid": "7bf51c20-dd5b-495c-8cd6-6cef964959f7", "comment": "Malware payload", "value": "3d025bef37dbdf0733e915b621ea20e1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713323919, "uuid": "f70aa1b4-0fda-42ca-b936-ce79c6aec05e", "comment": "Malware payload", "value": "ed9e9efbcf6b8cf981f808be10435db5aeb27d1c7671fe5076a669b19b4fc8fd", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713323919, "uuid": "a909a1ba-61f7-48f2-a533-1a8c573e2aee", "comment": "Malware payload", "value": "bfc76e74a4ad7ffbbff2093520f652ef6c2fcc5e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713323919, "uuid": "85f0e1bb-89d7-4f2d-a30a-06306ee76b6c", "comment": "Malware payload", "value": "ead36f28be19349e4b96ef88c8b0ff893c3b1dd0c210df00c170672283409bf3ec1356c81b43594f1d7e2639bf8227f7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713323919, "uuid": "f1ea5c92-3c14-457c-bb46-7c1acc930b27", "value": "T1B0F51283E346586ED9F3833A46BA076A45874C668743D3538AA5B73C6CBB9C44F81FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713323919, "uuid": "11cb7a7e-9ce3-4812-a275-b86eccf38c31", "value": "49152:WRj4qCml99KMTSHh5dAudMMz3ZOrXmslJftF3tCMuUCY/H9q:WZZTSHh5fN3ZWXDJftFdCvJYf9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713323919, "uuid": "70744c77-ec35-41eb-8bab-3e79a81adb0b", "value": 3543849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713323919, "uuid": "5fb1d9db-5078-4ba3-a8d0-8a8ec1b9daa9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713323919, "uuid": "864a66ff-57b5-4972-bd75-6c02da51739a", "value": "KosLand.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e3fd34-fcbb-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713359202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359202, "uuid": "07b35611-2df5-44fd-9c0b-9ddb80193f0d", "comment": "Malware payload (AgentTesla)", "value": "55f1ac48448acac667d92f0eb5de3b7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359202, "uuid": "bdd1e041-49d2-4497-b271-5fea89cdfd48", "comment": "Malware payload (AgentTesla)", "value": "edba3afe3fedc9e2ef23525c676755c2bdb76836cd4946eb4d97b22a535991be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359202, "uuid": "486aaaa0-cdb5-4bec-9ba8-4b0282ae6f8f", "comment": "Malware payload (AgentTesla)", "value": "0adf1f6c44cc0952f3f65f9c4252c24aadcc5ea2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359202, "uuid": "51bc14b0-0939-4226-8f00-b06131621d7b", "comment": "Malware payload (AgentTesla)", "value": "033895311e1240112123af18dcc10302c0f8b722500cf9069c9df242024a1f65b345459931c93e3b69102f3230bb01e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359202, "uuid": "28f149ff-b47a-4174-a5ba-4a09336905a2", "value": "T100E4121C47DDAA09C4AC037ED4235884037AB342E04BFB5F6AE421FB4DAB7949E846D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359202, "uuid": "0d919d3f-31cf-4c03-ab8b-1d00cfdf4679", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359202, "uuid": "782e2e0a-b70f-4b5b-848f-2d39c87fd73e", "value": "12288:srfrrPwrrvN+nw2YTap1f9gYnp9+VOjHtHzARtjZ0ISl/aRgLXApAojuv:jQw2YT8f9xnCOjH6RtV0F/dL3Auv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359202, "uuid": "4dc81859-d869-4622-9fd0-cd6bf487e5df", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359202, "uuid": "9a991ec6-8328-407d-8802-02e41437f36d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359202, "uuid": "1bb49748-1f96-43ad-b526-fcdc9cb2da0b", "value": "67002314579XX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff60b15a-fcfd-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387833, "uuid": "901fbf2e-580c-41c3-8eff-0cffbbb17dd5", "comment": "Malware payload (Mirai)", "value": "bd1ca664ddfaa79a6c5afc41667e3d76", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387833, "uuid": "e5df2a86-5d91-4ca2-ba1e-ef5b310a8cf0", "comment": "Malware payload (Mirai)", "value": "eded83d4dac73de26dfa26d89518adf51418f883990ef7a9e53e93cd402bd7bd", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387833, "uuid": "faeab017-d919-48bd-a543-317529f966ec", "comment": "Malware payload (Mirai)", "value": "1cd1c6dd7218be3b9644318dc8f64603589b929c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387833, "uuid": "455ef6b9-f27d-475a-be8e-e3bc6dd14dc0", "comment": "Malware payload (Mirai)", "value": "382e1ca6fdf32ce9bac30cf2b07662ce9fad3fde17ef14f9d6362a617fbd06bf7815722b7d633e14adaf44987d42f50f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387833, "uuid": "3e1ae6e6-95bf-4356-95d0-7f6f1d074184", "value": "T184530817F95180FCC08EC174266EBA3EA93375FD1339B2A673D8EA2B3945E614E5C844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387833, "uuid": "304900ad-cb06-4087-b6c4-3184b0f2e605", "value": "1536:f+9L52SkIPtRQewxUpgyLlJDI2pEipHLRN/qQw6GYUvW:qL5NfPtN+/yLlJDIJiBRN/Y6GYUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387833, "uuid": "5746fcf2-cb8b-424c-b660-8181fa7eeb36", "value": 63360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387833, "uuid": "c0021f3c-5a68-4353-89af-acc7cc270c73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387833, "uuid": "4c8d32cf-8395-4f07-b345-72785ff7aee0", "value": "bd1ca664ddfaa79a6c5afc41667e3d76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a028d629-fcd3-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713369635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369635, "uuid": "e4b5d14b-6eaa-4a63-9470-4a640c81fe04", "comment": "Malware payload (Stealc)", "value": "b072a0fc0d889fcb1e47d087537e9b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369635, "uuid": "930a3ca9-9419-46eb-947c-f5668f802491", "comment": "Malware payload (Stealc)", "value": "ee7217ad15c2331e7823adc7a9af7d647c412fb2df03ca7a1caeb9432c9ce2f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369635, "uuid": "2521f543-d63b-4dcc-88ed-dca4faf82c11", "comment": "Malware payload (Stealc)", "value": "475ed8f71cf2ed8b0c4eee43c24fc6f930f0712e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369635, "uuid": "cba22255-77c5-4262-a17f-db4c1062e0d2", "comment": "Malware payload (Stealc)", "value": "e0b783d41e52edd84ae1850685539b3be01f44949996acd3c0de60fddfd6d02a1e5b4162b5b1099b6594872224f3960c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369635, "uuid": "31a80c83-7195-4b7c-b055-c7c2e625eb0e", "value": "T1CA647C0372D0B96DE67347324E6D96A466BEFC614F596B7B33486E0F08B10A0D632772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369635, "uuid": "1f648fca-e521-4f60-a416-fc36ef55ed88", "value": "0fcd65e7119513450cc779be2a5d516f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369635, "uuid": "d00280e1-0915-4ffc-8b6e-4554624c8508", "value": "3072:yAuYeTG3I8UpvBWkv1zHXSYp+gPkSoMWNJ+JPmM8tg85bZfThw5FMGJ3m:yNAURzrpMGNmMGpVtW5FMGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713369635, "uuid": "5883ed94-dd32-4841-9f46-20ad45602486", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713369635, "uuid": "3aa749a1-1da3-4a91-8fec-358bbd193c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369635, "uuid": "f93a679c-4657-41fe-a2cf-72413f4b24d7", "value": "b072a0fc0d889fcb1e47d087537e9b9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb96ea7-fca7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713350842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350842, "uuid": "a4a85375-c871-457a-9f25-d8edf21ea6cc", "comment": "Malware payload", "value": "94ec90b4bb4524d6b786fc39c37f5b29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350842, "uuid": "33469615-ba50-464c-85fd-8add4b47a2b0", "comment": "Malware payload", "value": "ee752159c0d2da2861e8db46d974db6cccdd4bff4bfce259a2019c362c2d53e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350842, "uuid": "72a28ba3-6258-4ccb-a53c-17e90ec6933c", "comment": "Malware payload", "value": "ef606ffa9c029abe75e8ac51d126abff398a63e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713350842, "uuid": "7d1a3a2a-d6f7-4ac5-9838-15fc57e20ac8", "comment": "Malware payload", "value": "301c6f12c3bfc457af0fb296681c94b1336b14b6c5f431f1d25c64d43ab757515914215c52cfec7b0ba2235f337fd31d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350842, "uuid": "2a24440d-2515-4ed6-b08e-d21bf75167b4", "value": "T141E7330C3D1980B3D9876775B6097F69A43E8E1253635D680AD9B3C3A339325AE06F3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350842, "uuid": "7947e410-5871-4e65-be5e-4879eeb74621", "value": "b1acf33ac5d2d07c82422095772ab92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350842, "uuid": "997ba142-e493-411f-95fc-0ca0cb4212fc", "value": "786432:0nvnqSeY83w9+gw21eWRvIGU+lVBPeCV+sxJ0S8Ys5qDTg2MK4gq65V+E1gElS:0iSb83w9/b1epGUKBP5B4Cc2MPgZwelS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713350842, "uuid": "c85bb573-ac3f-468c-9623-6c847c54e680", "value": 65586616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713350842, "uuid": "15bbff1e-e42b-4262-8f2b-0f4851f608c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713350842, "uuid": "49dde06d-c322-4b45-a172-291259508443", "value": "SecuriteInfo.com.Trojan.Siggen8.16025.27633.23133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a93e2f-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387901, "uuid": "2876391e-9fd8-4a6b-94a2-69219031a302", "comment": "Malware payload (Mirai)", "value": "e1d44bc6111278af4f31a7c324af0ee1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387901, "uuid": "e3c2560e-364b-4e42-82ed-4218d4647282", "comment": "Malware payload (Mirai)", "value": "ee752222618e6beaa0d4ecfb7357af87082268ea3ca6611663a7f5da445391b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387901, "uuid": "6e8ac941-a6c4-43ae-ae7c-d4cc4f10c428", "comment": "Malware payload (Mirai)", "value": "9dfba52d304084f13ac1dfd638864e9abf3f56d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387901, "uuid": "ae68a283-c98b-4537-ac0d-a1adcdfffe81", "comment": "Malware payload (Mirai)", "value": "0aac2979592b4016472c66a66013609b60320458ff5a0b95bca915ca30b77b001b6234f30d8ff9bfc7d6302159380b81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387901, "uuid": "77b1d00c-7254-4a69-bd4d-93e52f0d268a", "value": "T1CAE31A56F6414B13C0D6177AB6EF42453323AB9493DB730699287FF43F8679A0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387901, "uuid": "a39a5e2e-c16d-42e0-bb4b-a49485813dff", "value": "3072:XZ3Y01DlHB8aM3zBSkizaMvsE+D3/VuZM/9D7JHaoMO:XZ3xZh8aM3zBSTz3+D3/VYM/9DN6ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387901, "uuid": "aa9d9818-aded-4167-b497-576b2d13320d", "value": 146238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387901, "uuid": "d7147ed1-cd06-4aa8-842c-d64144a267d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387901, "uuid": "9ede324a-b95c-41bd-ba92-59d7a6bd9e08", "value": "e1d44bc6111278af4f31a7c324af0ee1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0742dfda-fc95-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713342749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342749, "uuid": "61fbdc53-f1e0-41a8-87c6-f8d22ebd0084", "comment": "Malware payload (AgentTesla)", "value": "34031e7ac9f22a385c824d54357d1b7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342749, "uuid": "399a33f3-7678-4bd6-bfa8-8cd216794ab2", "comment": "Malware payload (AgentTesla)", "value": "eefaf26c525b46aa2b6c27d5afe3b8134b2ac8cb232c058c233a4238eadc1f18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342749, "uuid": "f534f033-949f-44b9-836d-692d888173cd", "comment": "Malware payload (AgentTesla)", "value": "7d0d36d201a7f122f595e40c2b2347c3315cc753", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342749, "uuid": "a473f5e4-2a3e-45f3-aa6e-c59d9aa67a84", "comment": "Malware payload (AgentTesla)", "value": "fe098a8460e2d43d433094a02a3849b6566988537cf5fe5f0eed4ed3aa0466120639d4750c912da7ab97970724ddf203", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342749, "uuid": "4e1f0da2-8435-4b23-bb4c-570c400daaa4", "value": "T172E423DE8AE69C3FB6F7029704DCE490E0B8DD7B966A8D181832EDA8037D041B795D71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342749, "uuid": "ec8bf4fb-9b7c-4564-8d81-e93d6ec293d5", "value": "12288:OJk/biZlnHczDbnSBxBhC3aeZDHJBZ9KNtMvtt6gGBTO095DKgYjXJ:ulHcLSRs3ht9bTHunDKg0XJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713342749, "uuid": "baad84c0-3cf7-4c84-b870-e0d59e476d6e", "value": 663936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713342749, "uuid": "bcde5c6f-68d1-49e7-b181-762ac67cddf8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342749, "uuid": "035b4517-3b03-49a4-9f25-a20b1bca9839", "value": "Statement.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9faf9917-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713367916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367916, "uuid": "2e26d7df-c37b-461f-a3fe-b4d23a8e8d50", "comment": "Malware payload (Mirai)", "value": "7088533019f9b96efe2bc9eb500a6c3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367916, "uuid": "e9362595-d762-46ab-8a16-2be527c9a166", "comment": "Malware payload (Mirai)", "value": "ef0886f29bbba3be342977635d9a4278050a7afdd40563488d34c69d83817149", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367916, "uuid": "e5df0a14-b3b6-4f1d-988f-3fed1213f564", "comment": "Malware payload (Mirai)", "value": "3d0222c784a82d9188a34f6b58abb0c4975f61ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713367916, "uuid": "e2a3f8cf-e1eb-48c3-9a24-5f2ae7e4fa87", "comment": "Malware payload (Mirai)", "value": "44f1021bc8ee8a0ffaf1fa7655669e41eeeb7462b6a776a591490c101d6415e84ea7753981705396f64333ca10680349", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367916, "uuid": "fa3c065a-cc98-4a93-b934-7b4ae43540f8", "value": "T18F43289BF8019D3DF40AA6BA94264D0DBE3163C113830B2767B7FDE3AD721695D12D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367916, "uuid": "c4eb3aff-d393-44c4-8b1c-b2d9762c9318", "value": "768:O4eVrrJ3QDpu11Jkb31+yZ7Cy8Oz2XG8SlIW3a9M68N6AWSA5WoHFqk7oeoQLDFb:pp861N7j8Oz+G8SKWJN6AW5WIdckLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713367916, "uuid": "36f3d1d5-d37f-41d7-8d0f-406204567bd4", "value": 56468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713367916, "uuid": "2c72c38a-b941-4851-8c33-6f5acf920a94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713367916, "uuid": "26565de9-9636-4894-91ce-b9ae989a26a6", "value": "7088533019f9b96efe2bc9eb500a6c3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7477279b-fcc2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713362260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713362260, "uuid": "7e8fba4b-b749-44f1-85f2-fd567e1ec06b", "comment": "Malware payload", "value": "62fca2d45c6496e89a45f3def56dd3e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713362260, "uuid": "c01cfe1e-477e-49a3-9624-4bf66517d5ba", "comment": "Malware payload", "value": "ef2d827fd47a3c4f8c8b293b0e075e11f1fc0dd73756d67184eb4471a13822f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713362260, "uuid": "ea7886ea-8d34-4a6a-84a2-6c3b7c39588e", "comment": "Malware payload", "value": "3a25f285a77253001c74dac602be69ed5e5589f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713362260, "uuid": "64cc33ec-2c80-403b-a464-c96c76dd8ca8", "comment": "Malware payload", "value": "9bab39cfd4879ea4da2df9b8a72a12fcc00138602ba4aecbf361187fe264d4940aca01449ae01e8e7115ec053f0ae419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713362260, "uuid": "ad2c94ad-7e32-4e9c-ac40-d2feabdea6ee", "value": "T117D53323FBC75872EC651D3944A68085AE3B3DF401F9643A1DB8C70C9E7BE526A74362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713362260, "uuid": "b442bc4b-3406-427c-9b6a-17cb46b3a541", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713362260, "uuid": "678e8a33-1dbf-4957-a276-9c19b6525f93", "value": "49152:ao5VPIgFLxK6oOmzZTZl2NhVz9Z+5kqapyni8qTpm4yMHYx4bYKWDhmxs+Z:tSgFLdoOKt6hQ5kqabTpm64Y35xDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713362260, "uuid": "749880d8-64f2-4f27-8779-043675d234f4", "value": 2940584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713362260, "uuid": "5d4bd1e7-d320-4e49-ab3f-57be991678fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713362260, "uuid": "5fecbc2c-6316-4b3e-85e3-e1aac42eb24d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f72f52-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713368007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368007, "uuid": "69088a9a-f4d5-4463-b924-bb58e76c7cf1", "comment": "Malware payload", "value": "ee0513a80a58ed0fc91e30c06090b5d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368007, "uuid": "ac517ef0-55ee-4830-aef0-bafc368ca071", "comment": "Malware payload", "value": "f00e32729c625a2fd9cba96a87180cc66b590af66515a361f086efbcff8d20ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368007, "uuid": "98853bc9-e88d-40c9-9e43-7322f911566d", "comment": "Malware payload", "value": "7ba8e3531bb8c68de5f9f1b1b86be7f2f5b33ccd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368007, "uuid": "fdf69391-fbd9-4750-b4c9-5803f3c2975a", "comment": "Malware payload", "value": "48a6f35d855bbb8c6629cab2fdb1bd0a5a6d4035b62f7d03baf8bba7be5764311c84c20b47df948a181774ebeabec9bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368007, "uuid": "81c96002-3b69-4562-a88f-b10d0a78975f", "value": "T1EC85C06ED2D8C032D63356386C4AB3A585276E307C5DFA072AAC36D85A32775171B3E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368007, "uuid": "8dd752b7-21b4-480a-857f-3c23f1025aa5", "value": "03a8b274728e9c03817126fc92f23512", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368007, "uuid": "ef264773-331e-4987-ad5c-78625c8e6cbf", "value": "49152:7RBxLiIxxZrm0UZu0LCi2wcc/Z9n7DGxxZrmh7:dBxuIxu0UQ0LCccaZ9nPGxuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713368007, "uuid": "dc65aaa4-f94c-44c9-82c3-a2e2640eb91a", "value": 1751552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713368007, "uuid": "2a8be2dd-b1f3-4cc8-9f63-c85e632ce4a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368007, "uuid": "a890db8f-7c97-440d-b41d-84debda3d5e4", "value": "SecuriteInfo.com.Win32.RATX-gen.12024.12837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba3aaf5-fcab-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713352528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713352528, "uuid": "f15b8c27-37b9-40b0-aaa0-b9ba9bb7a3dd", "comment": "Malware payload (Stealc)", "value": "319eca52b8a29fb6245840415071b707", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713352528, "uuid": "19546459-2ad6-4c6a-9915-bca7b92fe06a", "comment": "Malware payload (Stealc)", "value": "f00f1ab406a347742ab2f7bc17cfe46111a4d64cee105cfd7ccf14986ed67886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713352528, "uuid": "3a3bc829-a020-4d88-ab29-a3c4ce5acb6e", "comment": "Malware payload (Stealc)", "value": "c1a8139b3bf1cba893438c249ddd30b80aca59b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713352528, "uuid": "4e724512-b8c8-486d-8a81-99046bcc281d", "comment": "Malware payload (Stealc)", "value": "1a1d3f0b03c20f065f24b9c8321b6a406e49a6896bd800b69c6b610f6a4d3acb4bb7f0b0ff03ada83a148cb0f444aa9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713352528, "uuid": "bed50a65-aa57-4183-9ec2-6d21b40585b2", "value": "T123646CC2B2D0A472F53346725E69C5A4363EFDA1CE5E5B5B23785E3F08700A1D622772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713352528, "uuid": "a09a06b1-9aa7-4010-b2c4-86427c2feb52", "value": "f9963a225f61513c7541623aa0db2a94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713352528, "uuid": "a83c7ad6-f0da-4b91-b64b-ffbd88bcbb39", "value": "3072:1K5gDfBkUcfGyR0Fg37lvh5+kPbGSzmYYtlhGlMZDUhGqMINSIs8cM4vBV1rOPqz:vpc+FgLNh5vCMmDSMuSIs8cDBf6P0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713352528, "uuid": "80bef17d-d9b8-406a-89c2-4fc3fdcbf457", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713352528, "uuid": "4789cb44-8b06-462b-9bfa-31e958ed623b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713352528, "uuid": "84d82fa0-90b0-476b-bdb2-562636ef2c46", "value": "319eca52b8a29fb6245840415071b707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c856f0ef-fd11-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713396331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396331, "uuid": "478cf250-84ec-46bd-a475-5adbc156de45", "comment": "Malware payload (Mirai)", "value": "8eee0d6ebd5d06dbde04e633fb58d937", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396331, "uuid": "e47d0fd6-0525-420b-b515-02ee7f0e749f", "comment": "Malware payload (Mirai)", "value": "f06db16fb157381052263e68ef7931a4808dfef46c703e1b4dde3082fd831aac", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396331, "uuid": "a90369f2-c49f-442a-89e6-819fe90b9ea0", "comment": "Malware payload (Mirai)", "value": "82968c483828450dd130976bd114143c1c4f202e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713396331, "uuid": "db2c7e28-2c63-442b-bb77-98c4314499ac", "comment": "Malware payload (Mirai)", "value": "31b9d7722470696b17246c85a3fb6c65ade79d7ce49db46b833e66cc87b33f9b2923a89bc3f224bf74a1615a3cb2e0c6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396331, "uuid": "4f9462f0-dd8e-45d8-88d8-8d27cc2a90f3", "value": "T124D31A33D664847AC08722F51BEF8632AD63BCFB0331215763947E605F3349A9E99786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396331, "uuid": "f003aa93-ee94-4324-8038-322ff3e72eb1", "value": "3072:dOb/vg7g31/h918+YxtK3OS5zW9i4zbwywmr1zwTdWNn:H7EVPErwmr1zwTdWNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713396331, "uuid": "a4c23cf0-15e7-4efa-b358-19cc564f8753", "value": 133028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713396331, "uuid": "74c0bbcc-e0fd-4e49-b057-f885ae856301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713396331, "uuid": "109403fe-04a3-4883-85c7-d9b70f2d3dc2", "value": "8eee0d6ebd5d06dbde04e633fb58d937", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66fc9ec-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1713361485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361485, "uuid": "fc740494-fa89-4ad1-adf8-19a5dfdd7e50", "comment": "Malware payload (Adware.FileTour)", "value": "a665aa5d659fe996cf654cebb1e73fa4", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361485, "uuid": "d28f98e5-725a-48dd-ae82-544190067a26", "comment": "Malware payload (Adware.FileTour)", "value": "f082b3d46adb5bb3a7aca15811072c6557a9440fd370519d8cdef3a7a13de0cd", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361485, "uuid": "8564bd87-7f40-422d-8519-273a74b1f23a", "comment": "Malware payload (Adware.FileTour)", "value": "59ff218a45bd07f8dcb01f817a33f96aebb71494", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361485, "uuid": "47a6177e-aacd-4513-bc37-736fc9496435", "comment": "Malware payload (Adware.FileTour)", "value": "288ec5a6c82e80bb5ffb61118f1e628f83b82dd140471db9e7fd096c6d3fb256f003226d772e75fa696904bae5237a01", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361485, "uuid": "5a1d7376-d383-4c45-ae32-a6782067ef54", "value": "T1ED2733568FD28DFADE60217008213409AC6F5B3868C15E352E7CCF4D4EB46EAE8B55B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361485, "uuid": "cd1ef2c2-b396-4aaa-b035-3f07ed1bf358", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361485, "uuid": "f12da8b5-5cad-414e-96d7-18855be2ff7d", "value": "393216:edjtBby8b52AALjVabxtndRX7hbggeP7rq7NcpRHbloVMbyktxFFN:exthwAALxa3ndR7hsg8Rd2kt5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361485, "uuid": "9b841459-3d81-4614-9c6d-cd4e2c675fe4", "value": 21429496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361485, "uuid": "c83fec63-e6d7-4ffa-be53-0e179f9a632a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361485, "uuid": "182e5739-9731-49ef-a447-2be2a10f43bc", "value": "SecuriteInfo.com.Program.Unwanted.391.13453.17314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8d6a94-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387860, "uuid": "5fd22b72-67e7-49e1-84cd-d81dd05491a6", "comment": "Malware payload (Mirai)", "value": "9aa40bc92960f7ac9e5c82ea281c8a4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387860, "uuid": "e8defed2-7836-439f-ab32-39e0ddb39c1f", "comment": "Malware payload (Mirai)", "value": "f098d12665d98ff11f90248d91a601163e410a423bb9b2d1c4be297b8b3a00bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387860, "uuid": "06c1a0e2-1f6b-4883-8ab7-70dd3a6d1e9e", "comment": "Malware payload (Mirai)", "value": "b87ccfc87d111a03687c1e3876d675ce80cfa3d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387860, "uuid": "fff27919-3053-4007-85fd-ed7a9438c141", "comment": "Malware payload (Mirai)", "value": "f80fe61ebeba82b4cf49b4fe34a10ae22ba66c80132fad80666a49e31ea1ef648ed755be9c1b135f3e2801c34cfc4d98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387860, "uuid": "eb8f1cfd-2ae8-40fb-9942-406d5b92fb83", "value": "T1CA7329C1FD4780F5D457483040A7F73FAE32E5E64121DA6EEF69AF32EA635029216788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387860, "uuid": "8656d67b-4e8f-4ebf-bc18-015ea78491b7", "value": "1536:v0S+ICtDIgrusMWvyr86M5+nSIPOgCWmKjXwPcjRpSHn8jB6Y1b:v0SlCtMgSWvyrTM5+njPOepjXwPCRzj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387860, "uuid": "004da493-4743-4432-aae4-4972b5f5130f", "value": 75540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387860, "uuid": "1aa8820f-4c51-4f4d-8463-d3c16f435bd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387860, "uuid": "805102cf-2d1b-4dee-8c70-8f50841501a0", "value": "9aa40bc92960f7ac9e5c82ea281c8a4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde8999c-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361631, "uuid": "1b0b41f3-317e-4356-b935-2e9f4120939b", "comment": "Malware payload", "value": "d6a091caa06b3d307a706b4f5562df21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361631, "uuid": "6c9ab847-f5be-4c5d-a3de-6d6d3924bc63", "comment": "Malware payload", "value": "f22def1f82619e281fbd773bba382fd040cd017207ceb59dca7a9cdaa5662890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361631, "uuid": "175fe927-8177-44aa-9c9d-36fac5b2a546", "comment": "Malware payload", "value": "cb98b41334e8ca963b280a70088c8b8dfa8df9ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361631, "uuid": "46da21d5-77f4-4dd8-a69e-0df794e1b752", "comment": "Malware payload", "value": "ae3511ea09c67187a7115f1efa16af7fa5dff5fa57ebb497d5ea4ee08c4b4254911c67b37db5a5680be974a2ba0c4925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361631, "uuid": "75a3216c-a655-49a1-ab7d-ba3e5c679dbe", "value": "T19164F10275C1C172D6B32D364830EB619E3EFC701F64A99B639C2A7B5F345C28635A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361631, "uuid": "077e1814-3278-4202-8c63-8b907cd2bf36", "value": "b09f4628c9b8d8436d8b37442f32d236", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361631, "uuid": "36b63fdd-eb05-4cf4-a703-4716af0c4052", "value": "6144:7kNn/RgaO5B70/QQB+uHg2pEqvl8z7E4xnu1asQbhKQBRp5pafzZvHbBvp3:7kNn/M70YCLgc8sQdhBvQzp5p3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361631, "uuid": "6a63de2b-826b-46d5-ba01-ea6391aa8b8d", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361631, "uuid": "e459bac7-daca-425e-ba38-effaad49f627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361631, "uuid": "9e750917-0c15-4ed3-903d-cfbb92b5bbb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd286ad4-fcca-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713365871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365871, "uuid": "ea226038-c369-420b-9525-52e88d8b1008", "comment": "Malware payload", "value": "23f1d07875a231e3b1ec36e906834b8d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365871, "uuid": "ddf9de72-04eb-4e32-9ce1-ed79fb3da303", "comment": "Malware payload", "value": "f2f9ca9ff0cb7eed58c756649005c78fe847c56c2ba415d15dd8abbd07a3e10f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365871, "uuid": "bd13c0b1-8164-4fa9-835b-e04584174ee5", "comment": "Malware payload", "value": "20cc243bda70d289cb8afd1b92a18886595f0838", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713365871, "uuid": "dafc84a2-c576-4d67-a5a1-0218deb27cc7", "comment": "Malware payload", "value": "d0303807eda71576f2c504a759bf3223b5a1579eda9fc848d2d17defee241d29883d9d008e33f4b511192b3b09a4c627", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365871, "uuid": "aee9a21b-97b4-476e-8672-17013ffa1ae2", "value": "T17171C2CA0D47E46296D61A2A76D861ABDCC460D3DCB51111F7CCFF230BB93A4A762EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365871, "uuid": "e78f7fb2-a0d9-470d-af18-b0da26c7a769", "value": "96:7w2n+EgqEgPZnEMsIRcSEGOYiian3GlkZ:+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713365871, "uuid": "7493e447-2c32-4ebe-a20c-531972d12185", "value": 3497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713365871, "uuid": "ae3052b1-677d-4027-8f94-c2673efa5335", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713365871, "uuid": "d5961e41-bedc-45dc-a76b-82fda81dfc56", "value": "download.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4570b7-fcd7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713371480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371480, "uuid": "5da63e24-924e-421f-9907-474340d46f3e", "comment": "Malware payload", "value": "5294aaf2ff80547172ebb9e0bcb52e0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kapeka", "colour": "#D2EB38", "exportable": true, "hide_tag": false }, { "name": "KnuckleTouch", "colour": "#2565EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371480, "uuid": "d8f877c1-2ec0-4db8-a04d-656b5b5f9d07", "comment": "Malware payload", "value": "f30b9f6e913798ca52154c88725ee262a7bf92fe7caac1ae2e5147e457b9b08a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kapeka", "colour": "#D2EB38", "exportable": true, "hide_tag": false }, { "name": "KnuckleTouch", "colour": "#2565EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371480, "uuid": "96f6207e-5157-49ca-b256-efeb33f010c3", "comment": "Malware payload", "value": "9bbde40cab30916b42e59208fbcc09affef525c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kapeka", "colour": "#D2EB38", "exportable": true, "hide_tag": false }, { "name": "KnuckleTouch", "colour": "#2565EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713371480, "uuid": "e0295a72-45de-40d0-8dca-830305608471", "comment": "Malware payload", "value": "e62d5727bae74ce7eb771f102059eb1959354fafa3a0c4f1ab1c05059055047635652bd9e42104b168ae2a474f1ff94d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kapeka", "colour": "#D2EB38", "exportable": true, "hide_tag": false }, { "name": "KnuckleTouch", "colour": "#2565EC", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371480, "uuid": "17a90a5e-5a8c-46e4-aba0-6dd31f42b3eb", "value": "T187B3290A326442B5D92AC1BCCBC76E0BD7F274955376E3CF12A606CA1F176E19C36362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371480, "uuid": "875f8bba-49a4-4c72-90a6-b5886f166251", "value": "9953472df0cd811a6d9a53885ecaaf21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371480, "uuid": "c9151123-7171-400b-8b06-410028cbd364", "value": "3072:qz5whrkrtKfcuWp05oWunbBm8CRa+pnH:rrkrtRZ3NmTnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713371480, "uuid": "a0fd3bf0-7239-4000-95e8-f8ed4d5f64db", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713371480, "uuid": "b530bbcc-8935-49a3-8c51-baa535971bb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713371480, "uuid": "a8de0cbc-0bdc-4a6d-b954-c8922fb7ae45", "value": "suvyd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33b3f44-fcf0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713382122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713382122, "uuid": "2ce3cce0-974f-4e26-8bdd-1a373f7df97c", "comment": "Malware payload", "value": "77ea89f7aaaae1b806bfdb092493bcf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713382122, "uuid": "b547aa54-8f0e-49cb-ad15-015479fad0fc", "comment": "Malware payload", "value": "f3384a07dc5be32eb52a5af56bea7ed01ee1e8eac92268d95f335329f2082a75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713382122, "uuid": "1ab63c3b-1276-43d4-aa26-af6bb8d44fd1", "comment": "Malware payload", "value": "a6122bfd6ffe9a26210ddc9bcdd27afeef739065", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713382122, "uuid": "344bc50e-e92f-4061-89cc-7f1326be362d", "comment": "Malware payload", "value": "a643271076673defb88da2595a91e32974cb2f884c8c3542890b1466348527bc4aa22b1de144df047a3c302c5cddfa9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713382122, "uuid": "94014586-22c7-4328-a9ef-6bb8f3ae97ef", "value": "T1BB96338DF4941E0FF529D6FA4BB2DD6395A33C98E151573B183C4A6822A2292777F303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713382122, "uuid": "1bf409dd-0369-43e2-a4fa-1e6f8ef5202e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713382122, "uuid": "b8f129fc-6c34-485a-9ce6-320d4d4d78e8", "value": "196608:CgpFoTx04ozF1ADTOsoFovOmpfDRMPiaA4mICq4e8llsqN/dq6dI4:CgpSTGzzMTl7LpJaA4mITenxI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713382122, "uuid": "8313453f-2559-478a-bc92-0b8d6bd7e2bc", "value": 9060352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713382122, "uuid": "8cc056bf-1cea-40e8-affb-b2cbf5cc080e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713382122, "uuid": "afbe936a-2832-416c-babd-bc659c13b182", "value": "77ea89f7aaaae1b806bfdb092493bcf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f47a1d-fccf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713368012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368012, "uuid": "053075ce-2c03-443a-971b-01622b14cf1f", "comment": "Malware payload", "value": "9a6f05ab019e9c9189b5599623ddd33e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368012, "uuid": "4d1c2278-179d-44cf-a9b6-1cfc2b5b6f34", "comment": "Malware payload", "value": "f3ad57044ff8be6139df87cd5454379c63f5bc3a3120c774ae71fb4c6cd58f50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368012, "uuid": "7c4dc286-4e24-495f-9fc5-f205717b72b0", "comment": "Malware payload", "value": "322d1dcb248535bc2a455b7e97a1b3f7373634b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713368012, "uuid": "ddf5a44f-1a97-40a2-a927-209dfe1316a1", "comment": "Malware payload", "value": "4c23fc493df03d7aed06ee2f017e056ae830509b0d573911c5c929c5c595836f66eee4a1b6b9768a04b170592d3e9858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368012, "uuid": "26482738-bce1-4365-bb5d-53d7dc04e9f0", "value": "T17DF4BF10F785E936D4A601792BBADB67443DB9210B214AC7F78C7B4E4930BC1BB36B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368012, "uuid": "a378f0c4-0a58-48e3-833d-2bc58ef4cb34", "value": "3f5b1257870d4f7d46c486840f6d932c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368012, "uuid": "53c6ce58-f955-4d7c-9401-52ab4794ea1e", "value": "12288:iPCOrb2Xcg3VBRvZfA6wE9hNr7fJ8rXiOtcc7qM8:iP5rbkNDZPwE3KrXiOP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713368012, "uuid": "d3953601-d45c-4d73-8e15-094d9a702a57", "value": 722880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713368012, "uuid": "df55b8d6-c94c-436d-bfbc-f9eb3027a742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713368012, "uuid": "d86b1551-4b69-4f46-b2ce-84c4d478dae1", "value": "SecuriteInfo.com.PUA.uTorrent.9217.19611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8606da-fc95-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713343057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343057, "uuid": "6db68c3a-6402-4fb8-aaa0-13ef93fab64f", "comment": "Malware payload (AgentTesla)", "value": "512138564b93795c281d0a49b3b045a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343057, "uuid": "4d8c244c-cf3c-4f8a-8ec2-c315b5b481d7", "comment": "Malware payload (AgentTesla)", "value": "f3d45505e8f17b8a796664f5aecea731a3922c45ab1ffecfc57c40db68646e8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343057, "uuid": "2d99b84f-5c7b-416e-afae-c46c72c0fb90", "comment": "Malware payload (AgentTesla)", "value": "2cfc24ba28c59607b78a147daa7046dd95a7d3dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713343057, "uuid": "9320ad43-3109-4ef6-8047-181d11d0fed2", "comment": "Malware payload (AgentTesla)", "value": "60da80b0ec62a843964abe246981f8b2e716e834cadea37064cdd3bb7c6339f739271feb95aac94be97352f32ae74d24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343057, "uuid": "b4858647-aec5-4d92-a24e-c8e4584e6839", "value": "T15EE433F5E9A20FFE5F8063EE02412BA56147FC51ADEA9D3201CD40997B2C11CE9679E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343057, "uuid": "4cd5b973-31f8-4307-bf38-09d9ff02b882", "value": "12288:sWHvzMYjY/Rzy6+KahJNZWWsumicRbgXak60X33Gzyt2LCx9sDwDtOC:Nv3Cxy6iLN4WvcRBk6pytsCx9sDwcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713343057, "uuid": "1d8d6e06-89d6-4598-9a44-9b091939be4a", "value": 665189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713343057, "uuid": "920ed2d1-c866-4d2c-8dc7-e84767cd0103", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713343057, "uuid": "ba1f796e-cd5f-44b2-a543-3f806e11c9aa", "value": "Payment Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4c204e-fc94-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713342385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342385, "uuid": "978974cb-68a5-45b0-a17f-d873f025d1bb", "comment": "Malware payload (Mirai)", "value": "a1753da6571f90ac3dc3416c06e294f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342385, "uuid": "bff42016-9f2e-4f53-990f-25119c017444", "comment": "Malware payload (Mirai)", "value": "f3e4e7c0bc1fdc5c826050e8dde5f8442ed515a6305e49633aa88b2ade70d034", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342385, "uuid": "8cf7bcca-8bf7-4bd5-b2e7-a75fae9acaf1", "comment": "Malware payload (Mirai)", "value": "011d3dd7aa99e831403a39b901b56e032bc5c6d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713342385, "uuid": "2d8b1da8-49db-456d-9700-128eec80b141", "comment": "Malware payload (Mirai)", "value": "aa138bd44c478288c90d312915bae0a0413e0a64324507e1559c3f7ad595c64666b3009ccd7a4decf50d8ba51e39d7e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342385, "uuid": "c9406fb3-342a-476a-9573-2729f21d7537", "value": "T1EA14B71E6E228F7DF278873547B74A249B6933D623E1D645E2ACD2105F2038E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342385, "uuid": "49a92f05-9e6b-4489-83bf-59f5d77f4c14", "value": "3072:p3eqjLRcfNj+i+/hMbhZGITIV1133e/hS/2kw:p3eyRcFjCgwU4334S/Rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713342385, "uuid": "fbaaa3b5-1435-4c27-a10a-3c18b99ece6e", "value": 204772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713342385, "uuid": "f1686115-d88f-4341-b6e5-65a862b183e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713342385, "uuid": "d34f65e4-f786-467c-8b4b-298341563154", "value": "a1753da6571f90ac3dc3416c06e294f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14efbed-fcc0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713361476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361476, "uuid": "25427dac-2be5-4ddf-855e-0cbb7db46e00", "comment": "Malware payload", "value": "7c7e4c851dadd89c6d43308444dd290b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361476, "uuid": "008446c3-154e-4708-ab77-0a5b828a9ede", "comment": "Malware payload", "value": "f44a0d13e73a70369309d56e88a2d05bca87f9c6c2ea61ad3f47d8bfa0e00b0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361476, "uuid": "abbce34e-ddd0-414b-b06c-07b6e38fbb65", "comment": "Malware payload", "value": "3807fcc05f881adf26002208c4569956126b133c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713361476, "uuid": "2b3e059d-9bc0-40e3-aab0-e2c4103dd68f", "comment": "Malware payload", "value": "510716e7fe6dc0fb9f042c8254474f46023e33ec8b3142bd5cd81de4604466bc614bc3482e9fed75e82c747560adc3ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361476, "uuid": "cfe99d0c-9884-4e6c-9bc0-3e3fbafd380b", "value": "T1E9560912BF58ED2FD25421308BB7C23433D53D1482E16533AA56F71E2EBA2B5991BDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361476, "uuid": "8714d325-26f6-44ce-a670-3f892b655941", "value": "49152:XralYsYZ/MjJ7fhP2pCQLg1xbnZdY3MniUj0E/GiV:Xr9lMjJ7fcjWjV/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713361476, "uuid": "8aefb478-0ae9-4b57-952b-92d90df783ff", "value": 5963776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713361476, "uuid": "a1f4c98c-588c-4092-addc-bac631193fd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713361476, "uuid": "80550904-2218-4b1f-ab81-d9835eaa7e14", "value": "SecuriteInfo.com.Heur.11614.15288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbb32d0-fcae-11ee-a120-42010a9c002e", "comment": "Malware payload (RustyStealer)", "timestamp": 1713353711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353711, "uuid": "55c5e3bf-9136-486f-80fa-2080f5e2c097", "comment": "Malware payload (RustyStealer)", "value": "7d5dfe91cfb6107463625c6c9506bb5e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353711, "uuid": "c8b832d6-02fc-4d98-8b55-a75324594561", "comment": "Malware payload (RustyStealer)", "value": "f48f98dd52f2c7fb93e6f41403c767371ebf16290c25dfc3a0990b4c83870a59", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353711, "uuid": "cbe126b5-4ede-46e6-9e65-eb642d3950d5", "comment": "Malware payload (RustyStealer)", "value": "9d45224537c8cae5f90b0230215a0163ccff7d4f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713353711, "uuid": "bedb36ff-adeb-45ff-9399-a7ca35b5a152", "comment": "Malware payload (RustyStealer)", "value": "6a40620bbf94eb56406012ab4317a7a57ca88e4c29ecba5fd1c76c616cd29494324e8a190123420752abc0212b601288", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353711, "uuid": "7e03fb79-d159-4d1d-8182-fc8300a3105a", "value": "T1A0D518117B4A99ADC05AC4B082478B626A717CCA0B35BAFF4584B5343F7AAF51F3C358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353711, "uuid": "c1219d7e-84fb-49cc-9eff-11ac0afe58d7", "value": "1d589303777bbaa8685babdc003b2dad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353711, "uuid": "2f9bcb37-797f-4e10-be21-c580a1634b1d", "value": "49152:Uaj1gng7AABTrOzW1GCP7dpLcRgad2cOrzO:1jP2qzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713353711, "uuid": "639ef5d7-3e49-4c7e-92b2-603e29807791", "value": 2910208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713353711, "uuid": "7cf72c8a-65bc-4c92-855a-0a9c3c812aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713353711, "uuid": "f919742d-a4db-49e5-856f-7806a3a85e49", "value": "7d5dfe91cfb6107463625c6c9506bb5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2f881a-fc84-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713335453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335453, "uuid": "96fb1794-1801-4368-9d08-116d69470f6e", "comment": "Malware payload (GuLoader)", "value": "14a5cda1fba8ac001d1d6cf35b6117ee", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335453, "uuid": "ccfa72c5-f7a1-4f7b-99ee-20b9198a6465", "comment": "Malware payload (GuLoader)", "value": "f761f760379d4fd439b7fd86724f6e571bb6b8e36d685b6496e3d89e21c95450", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335453, "uuid": "d6f72458-153f-49f7-8099-5a768ddff765", "comment": "Malware payload (GuLoader)", "value": "b05a8ff3ab460bb650b2ff351aae5f3aa3241f4d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335453, "uuid": "55f99029-5081-4341-af5b-29b1acf9cb16", "comment": "Malware payload (GuLoader)", "value": "e9ab47c8fd329c35ba65f16d935d7fea6dfe25cf1d561bf8a4f8a15335eeed05c0217441c1b0542ba58529a0e3955e2f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335453, "uuid": "d0e40567-c72e-440d-92f9-3fca7493e307", "value": "T1D92419F0CF0B36199F4B3EDAAC6445928AF44195051638B5AAD817EDB283D2CE3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335453, "uuid": "b78d0d0f-8e59-4a36-aec4-1721fac126cd", "value": "6144:jYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJf08q1:g2dOUXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713335453, "uuid": "3ee46048-1f1b-4e5d-b10b-0d3e574ae224", "value": 216062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713335453, "uuid": "186a0c43-75ce-4afd-8d15-09dfad3734c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335453, "uuid": "d84d056c-6563-40aa-8720-148fdcbeef1f", "value": "Credit_Details21367163050417024.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d557507-fc77-11ee-a120-42010a9c002e", "comment": "Malware payload (Adwind)", "timestamp": 1713330009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330009, "uuid": "93f79570-7d6a-4bf2-959f-095d40cb674b", "comment": "Malware payload (Adwind)", "value": "bc34f4e23dca52ed6425b46a3dcf5e95", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330009, "uuid": "01ded379-b679-473c-8552-ff430b5000cf", "comment": "Malware payload (Adwind)", "value": "f77617921c5fb6f8114eca9fe330b8d2bfc3a99c4f581f3f9a8282a31d528aeb", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330009, "uuid": "ce47a655-0f14-4a1b-a3c9-d5e129634990", "comment": "Malware payload (Adwind)", "value": "e82affa4fea489146e3deb803efdb561a394073f", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713330009, "uuid": "b9b11633-bcc6-46d9-8a41-5d30a626f33d", "comment": "Malware payload (Adwind)", "value": "d8ba5b0d9089cee83c894b347e4b426aa6de931f34d8aa8344014eb327063acc1e99c77fb2b7672202f0a4d59d76ee22", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330009, "uuid": "3a8d58e0-4231-4953-a9bc-7d4c0dcd9dce", "value": "T1D7D423CED8E9EA91B6935C600D34B73AB7D6768D03AB0D70A77C9B1CDEB231500E5582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330009, "uuid": "2da9b7fe-69aa-42cf-867f-1728236b732b", "value": "12288:Cz396wbsskjH0PljDlBPfPSlU5XhBFDYU1SkzuiSn/BIu9:s39bssOUP1l9fPScXhfg3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713330009, "uuid": "24122d56-31b5-401d-af1b-ce92373b7cc8", "value": 643693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713330009, "uuid": "8c041c40-d530-4271-a146-52d79eaed565", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713330009, "uuid": "f85fbc06-e624-4ab9-8f08-e06e781ea5c9", "value": "NewOrder - P2D041197.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5797edf7-fc9d-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713346320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346320, "uuid": "913bdedb-41a3-46fa-8c62-5c69afc0fe48", "comment": "Malware payload (AgentTesla)", "value": "03e2a0c33e613d9aabf9167bd28cf3c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346320, "uuid": "e60639c3-f882-4fcc-a7c6-d8cc8dd5ae34", "comment": "Malware payload (AgentTesla)", "value": "f77b953a53a607e534572eda08dfaa91ad61f52491e9982a0790869c80a714c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346320, "uuid": "c6ab93fd-1572-42ed-846c-c8798851a6b9", "comment": "Malware payload (AgentTesla)", "value": "e7bfde31a95148dc223347df2ed2ea436d4be041", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713346320, "uuid": "844cbfb5-eabd-46dd-a447-ecbf793c3409", "comment": "Malware payload (AgentTesla)", "value": "741ae09dbe41081125bb4a93ecb5f22f217e0526094d9dcd57667e597253016569e37136442ebac8fe984c3cdf8107e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346320, "uuid": "869788c4-f13e-4cdb-8750-3773a7868744", "value": "T1F0544BA0CFCA26394F4B2FDABD60459289FC8159021224BDE6D907AD7243D6CD3FED58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346320, "uuid": "1daa7f7f-c9be-4d70-a802-e9a7a17f5903", "value": "6144:LTdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOiw80ewc4FW:HnS2Im1OwE5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713346320, "uuid": "ae119b06-4717-4e82-84dc-142571daed42", "value": 285658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713346320, "uuid": "2b3acf96-5431-4cc2-b4ac-c16ebc89f449", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713346320, "uuid": "5af5a7c5-6da4-4869-a06e-2d1e15845974", "value": "APR 20204 RFQ .xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaaeb154-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713388228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388228, "uuid": "90e77e07-bb11-49a4-8b85-a3fc8918f4cd", "comment": "Malware payload (Mirai)", "value": "6c3a700a58d2e98fc03e53ce0eef9e38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388228, "uuid": "a70cd3fe-94a7-45e7-b756-fffcab963948", "comment": "Malware payload (Mirai)", "value": "f79aeac6047bf28872231a7c92c0e6bdb5648fca032a4485d6370625e021a646", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388228, "uuid": "c976be07-14c7-48eb-ba2c-813d05546e69", "comment": "Malware payload (Mirai)", "value": "48bd6184c08d72c98d89fd5f077194e6c25bb7da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713388228, "uuid": "3a5d7adf-d20a-4b19-914c-ab0daf43a445", "comment": "Malware payload (Mirai)", "value": "b370edca761f8eb8e16d708838333104c691bcac041072322d7ace55492c107198d35e69a9a7e2cd4266a3505a27f874", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388228, "uuid": "b6275a3b-bc33-4e5e-a070-5804c0dd4d0a", "value": "T15C934DC7F400DD7DF80EEA7A04634D0AB531B3E116831B767797B963AD322952922EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388228, "uuid": "0beaae35-fb41-417a-9dd2-107dd1d5445c", "value": "1536:LdWTHUOl+6GpBrLti0w8MyoQkIGmCSdc14T7/KNe8bUzhksCOnl2SV:LdWTN7GvrLti0KyoQkFSe1G6bUzCsCOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713388228, "uuid": "e3deace1-6d83-49e4-8db1-7f348a248636", "value": 93144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713388228, "uuid": "325c2404-a604-4f72-9d52-6d567158958c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713388228, "uuid": "6758b457-4ba1-417e-9617-2ae64340a1c9", "value": "6c3a700a58d2e98fc03e53ce0eef9e38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a722ad-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387896, "uuid": "6bfdaea2-c5d8-4989-9bc3-e2bb8434ea33", "comment": "Malware payload (Mirai)", "value": "413fedc45da2ad408f91fe2d6ecc830a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387896, "uuid": "f1317a21-1941-4ede-8eea-dffb38b6327a", "comment": "Malware payload (Mirai)", "value": "f80cd3259f269a6a1b266178c8d3cb9b4d5774427a67371d382adcffa53f98af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387896, "uuid": "e1125661-4720-4d9a-9648-519444f21778", "comment": "Malware payload (Mirai)", "value": "4d78c79c811b3fd8b9f1ee2c6c57e8e2d5508dfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387896, "uuid": "b110d2ad-8fa1-40af-b27b-07f779b35ed9", "comment": "Malware payload (Mirai)", "value": "96336c62ae4c6ab2b2a403f05ab57e26d437d0f664b143dbe7056a3c08c883c11aad3b04cdb097387d976a0fb857b262", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387896, "uuid": "69114237-6732-47d7-9b53-7c9f45dbf111", "value": "T16873E806BB510FFBDCDBCD3705A81B0528DC699F22E56B363234C968B44B64B56E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387896, "uuid": "f6ca37d0-bf5f-4691-9186-80d902b87936", "value": "1536:ldZeohW9uklAIYyBBAn/+aUZ0Z8FABk9i8k4:lDeohW9ukfO+aUZ0A7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387896, "uuid": "87d84049-ba69-4c4a-9ed0-1c0cf12a314a", "value": 79448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387896, "uuid": "d12e770f-47d0-46ce-8881-b0e1564f8115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387896, "uuid": "96808af5-0909-4307-a125-616378b9531c", "value": "413fedc45da2ad408f91fe2d6ecc830a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f917f7f4-fc8c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713339289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713339289, "uuid": "abfb5bb3-e141-4183-9d63-e11214f88f93", "comment": "Malware payload", "value": "c2ec94ee2cf410d8732bcc14d40d9b84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713339289, "uuid": "5488f8b4-2ade-4870-aab6-2e323106d3e5", "comment": "Malware payload", "value": "f90baabc766cfad286ce325c235f28b0391171e857552f6319c306335be92d1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713339289, "uuid": "9ed57b3b-9052-4291-b3cd-f2fad9daf438", "comment": "Malware payload", "value": "995469783baf3c0b1a98e951ae32f44a1f349d87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713339289, "uuid": "6453f3c4-4fad-4197-9657-032f88b85e87", "comment": "Malware payload", "value": "0447c047830c1764e901b5625ec7d8b8e97256ddf0d5966bf6b94577c9fce28c767bce4c75d21c34a06056ca918e6eec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713339289, "uuid": "264e97e4-fbb9-4fde-aa9e-30b091727239", "value": "T1C5159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713339289, "uuid": "56162f7e-08d5-4c68-af1e-b2a8abd0010a", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713339289, "uuid": "b77dadc5-f821-4de2-9f29-babaed39df38", "value": "12288:YqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaXTo:YqDEvCTbMWu7rQYlBQcBiT6rprG8aDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713339289, "uuid": "37d8969a-59eb-4df7-a4a1-82b58dd83a8d", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713339289, "uuid": "f7489f74-df51-43b5-8a39-094e68dbc440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713339289, "uuid": "78a99c6b-193d-4dba-8616-75cd20cbfb02", "value": "c2ec94ee2cf410d8732bcc14d40d9b84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a97799f-fcbc-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713359639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359639, "uuid": "a24b7107-5109-4e67-965b-a96a3b9766f7", "comment": "Malware payload (GuLoader)", "value": "947d8500e25de01d02c5dc254d67c248", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359639, "uuid": "ef011a28-e962-4b90-9885-669e36f3e500", "comment": "Malware payload (GuLoader)", "value": "fbd7521613eeda606382f56a500c5015af001af819556b056bd1ef076820e297", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359639, "uuid": "4ffa9a66-6da4-47f5-9086-e9fb5415fd38", "comment": "Malware payload (GuLoader)", "value": "c073a8f64f2cbb46a1ea768b8c701d17a413b984", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359639, "uuid": "381d8c30-6e8d-4187-9b53-6ee6ae635d15", "comment": "Malware payload (GuLoader)", "value": "dc5463de155734689dab7c7a30d50d6ac0e09c99cfd6a8fec198f1ed6b222c3402ccb1d608831a8307e4b81e1195c175", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359639, "uuid": "6b8fee0b-401b-4e78-89fa-af37373cff98", "value": "T151145BA0CEC9223C4F071BDAFC650561C9FC816A462650BDFACD275D6143A6CE3FEA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359639, "uuid": "f7a719a2-bafb-4674-95d3-ddd8b6707066", "value": "3072:2+w8jqrKK8ccABOwbDS2y2zJETxUuoHh36wH/OLxCxTwvNPapsCRXBDo5mFSartr:GrR8ccABOwbDA2zJETxVu1vH/rsqfXB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359639, "uuid": "a27686ab-960f-412b-8dcd-6c7254669322", "value": 192228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359639, "uuid": "c79364ae-36ff-43df-98e3-0a6c41c6d419", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359639, "uuid": "5eac2738-ee33-4e82-994f-ae21be22579a", "value": "Carlispa_Ordine_00401702400417.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc79242d-fc9b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713345630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345630, "uuid": "d8fbdb45-fbb4-499f-91a9-ec8fd63f6aba", "comment": "Malware payload (AgentTesla)", "value": "1b16232e4a8561dfc2f8923464c95fb9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345630, "uuid": "543d46a8-aea8-4290-acd7-66c0300369a1", "comment": "Malware payload (AgentTesla)", "value": "fcac020d3bd56962a5a216f3b0c74e9033edf48bd438df38a9015c3b76bad7e2", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345630, "uuid": "c101e86e-4aa7-49d6-b0f0-ef646ae1ed37", "comment": "Malware payload (AgentTesla)", "value": "bea7650821b1d6c2939494ac47679fc5a50a4090", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713345630, "uuid": "f0ab2723-8876-490c-9a9b-5c24cafbab7e", "comment": "Malware payload (AgentTesla)", "value": "eaf74f74e2ace6cb21f1dc6f013bf27bad201d18748457af6552e36a850512f2ebf0df2756678bd26a2318b7ad5e43df", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345630, "uuid": "cf20b4d9-6989-4365-ab90-3bca3da18d43", "value": "T185B53312A690F8DE9096F4F14CA112DB83469B884E17B278C7F7749F72627211D6BEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345630, "uuid": "e30a628f-c82f-40a8-9796-ddfe59d63565", "value": "49152:/sUMoptpfi6d3mWOqzLuSmm+0tcz0tytdTCniP3nTiESaMLKOeroiV:/0oLpfVJmx0Lueo0wtP3IKOekK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713345630, "uuid": "cdd4fcda-5f38-42f8-a5c1-c9fab7f3052c", "value": 2355208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713345630, "uuid": "5a078292-03ac-40bf-81c6-7c989d71369f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713345630, "uuid": "ba1af7ae-f1fa-437a-8ea9-f9a56b45febb", "value": "copy#20005716.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093bf45d-fcfe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713387850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387850, "uuid": "15856aa9-1a44-4031-a57f-18513f76e584", "comment": "Malware payload (Mirai)", "value": "eaded9c6f8829931245777a1516fe45c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387850, "uuid": "c2bdc72d-9b69-4378-9f76-956b50bd0029", "comment": "Malware payload (Mirai)", "value": "fe5eb2aae1b73c77d86f7a157c6fd506d24dd6411b404354aea3a6b9ce8ee67f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387850, "uuid": "6654cc63-bc67-4f5e-b2b2-470e11641f2d", "comment": "Malware payload (Mirai)", "value": "ffe92008cad6356b63fc6f5242dc232450ef994c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713387850, "uuid": "6d2da02a-ac6c-463c-b62d-d85a680b44d9", "comment": "Malware payload (Mirai)", "value": "4a4dcf4373820ddb42c8631dd585a5e316c6a3611889a0dc454266a9605fe5759bb6f47364b16f631a87cf37f3718a7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387850, "uuid": "ac0b6673-73f2-42a5-a8a2-cc29d156b494", "value": "T1ECB3FA1E6E518FBDF769833107B78E21A79D33C62BE1D546E16CD6002E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387850, "uuid": "525c63e5-103a-40c6-9c73-07807de23941", "value": "1536:d3kl7hcFsVD0x+g1PvDAo/ZaKLWujMTDWe3cMSZaYxSieNn1:Ol7hus6ZaKLWGMTD/gaYWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713387850, "uuid": "7b49c504-19df-445b-b54b-ecab09d9e90b", "value": 108248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713387850, "uuid": "4e2ba444-55cb-46f3-8114-10483ea69dee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713387850, "uuid": "c5ad450d-4145-423a-95cb-43aa65f229b3", "value": "eaded9c6f8829931245777a1516fe45c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e60bc62-fcd2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713369175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369175, "uuid": "4b5ca88d-6057-4cc2-9dcf-6af048e56315", "comment": "Malware payload (AgentTesla)", "value": "818cfb9204560273c40f61b8ff020e6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369175, "uuid": "45e77d85-effa-4503-acdf-ce349b3fca4d", "comment": "Malware payload (AgentTesla)", "value": "ff3f8efff10733e8f1aedeb70e947ff881e22201c3fd8bf1b13d78df504370cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369175, "uuid": "87d8c65c-0f96-4751-9d5f-370301b80998", "comment": "Malware payload (AgentTesla)", "value": "7e6424af80b93508341ae804960fab64289daf13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713369175, "uuid": "ab75bac5-8dff-487c-b21e-eca153891f2d", "comment": "Malware payload (AgentTesla)", "value": "22c6babdbf389d80af792e917e976877cb0043c2b45bbf329f7c69a840277d547a5e369c928e5030ee468fa5e4677275", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369175, "uuid": "a40f088e-dea5-4325-a259-1cf71e92be17", "value": "T12535AD0273D1C036FFABA2739B6AF60156BD79254123852F13981DB9BD701B2263E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369175, "uuid": "db0e2e9f-470e-4b08-ada1-5075fc69a6d7", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369175, "uuid": "e56e25a4-4239-4f51-815e-5c6c836c727d", "value": "24576:8AHnh+eWsN3skA4RV1Hom2KXMmHa/Qu71sOxsPsC5:bh+ZkldoPK8Ya/Qu71PuPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713369175, "uuid": "b7aa90aa-c468-4c8c-a9b8-f866ac04cd7d", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713369175, "uuid": "f2517814-fc8a-4fe3-bca8-85f8ac077569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713369175, "uuid": "04daa9ea-b2a6-4bb6-b597-464da06f17ad", "value": "comprobante.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca91b21-fcbc-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713359670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359670, "uuid": "6d3e64f4-216d-4c90-a59a-d98ad2f1c2f1", "comment": "Malware payload (Formbook)", "value": "20fbdbe87c8a088b4c5ac0bbf3b83150", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359670, "uuid": "e907f925-5d58-47b1-b263-854dd6f45927", "comment": "Malware payload (Formbook)", "value": "ff4906bb8fdde2a16fd8d3703fa702fb5e0622522c347dacc5e43ccab948a09c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359670, "uuid": "bfc51c3b-d9b9-442a-a7d7-e0a09be0348c", "comment": "Malware payload (Formbook)", "value": "8c4e82b0914c8939f4390b02d0c0b6f508758236", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713359670, "uuid": "0c783d05-d75c-4484-9926-cfb7ca35f643", "comment": "Malware payload (Formbook)", "value": "786322715904c10b48c461a85787ee24a31432daabded8162eaf618a0c768957868839f90bbd6b22a30e01d316f1fa3b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359670, "uuid": "a982a377-71bb-4763-98eb-136c569ae045", "value": "T1B5C16C2C875F48940C60633A4DDAAF503968CF6C7A71643DA2787886F846E606377F4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359670, "uuid": "96fa74d2-4f65-4099-b085-2c59199ca968", "value": "96:7BiCmAeB2nNFOMqEck5nkkLJpSNkYKOHs9/uFMjZXjXj25JTN29/VGaT:FiCmiNyk5nlJpIkqI2FMNzCTTwRNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713359670, "uuid": "0f61e569-020a-445e-9ed0-55917493de23", "value": 6063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713359670, "uuid": "4d176470-cc4e-468e-bf9a-c02d303c222d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713359670, "uuid": "595ca969-c743-4040-9675-15b03e8a6c88", "value": "PURCHASE ORDER LISTS GREEN VALLY CORP.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163f1e4a-fce4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713376705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376705, "uuid": "a997036e-05ff-4bf9-960a-708657f7e959", "comment": "Malware payload (Mirai)", "value": "5c3f05657dc807c9c8220ec2031d5c67", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376705, "uuid": "84d2ab4a-bd1a-42b1-b865-12ec9d40d360", "comment": "Malware payload (Mirai)", "value": "ff52b6caac9aa7a12a9dbc65bb5ff9e9b2d6d9233fab9fc416d5b15b9e93ea85", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376705, "uuid": "346baeb7-26c8-4cdb-98b3-2df7c211a0b6", "comment": "Malware payload (Mirai)", "value": "95aac16076fce1ad435befed98cf2ca0d9536080", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713376705, "uuid": "e66540d5-707f-4dce-9480-d00db2152dd7", "comment": "Malware payload (Mirai)", "value": "9325a1655149312069fefc3228d205b4c0b4a0a508b33a69a3deee5a20f70f92a8e856d160988d31899592c44080647c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376705, "uuid": "2fa3b450-09e1-4f0a-bec7-bd2e58dcc83a", "value": "T178144B0775C090FDC4DAC1744B9EF53BA977B0AD1239B12B2BD4AB221E5AE314E2DE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376705, "uuid": "ae894897-603b-4a07-aeba-c3be64fe1f6f", "value": "3072:45TktNb2VUf4dY+Axjbl/qoem+2JE7ZAdPMvhfRHSK8wz:45T+b2Vk4dY+AxNaAFopSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713376705, "uuid": "cf2c6260-267a-4e77-b9a9-4933b9d96d8c", "value": 195160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713376705, "uuid": "d417d337-22cc-4672-a49e-1751fc10322a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713376705, "uuid": "cfd90e0a-79e9-4724-ba78-fd4093f0c6fb", "value": "5c3f05657dc807c9c8220ec2031d5c67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf2763d-fc84-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713335699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335699, "uuid": "7fff8af9-d590-410f-b0b2-c8c1578cfdc1", "comment": "Malware payload (AgentTesla)", "value": "0df9817e2867f94e6bf0c066f9d88013", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335699, "uuid": "ac3779f7-3fbd-4db2-bac6-96d50ab3e7f7", "comment": "Malware payload (AgentTesla)", "value": "ff70339ef950407a12f181c63d5b3d59fe40198237d97ce3c6537403c7863624", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335699, "uuid": "e6e53edd-edd0-46c4-a787-75e5a745ff4c", "comment": "Malware payload (AgentTesla)", "value": "9b45f5c8cf5402b8cd56b58df316ca84b633f5c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713335699, "uuid": "44976eac-a062-4f1c-a928-e14c4214e3d0", "comment": "Malware payload (AgentTesla)", "value": "ce9df5bd587d3f73225b15c96dc6e84b28d04d2b9eb87f73113ca5fe6e7e2f7e3b56da6be6e9c9c82e31a08e6c72c41a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335699, "uuid": "1e9041e1-ca14-4141-8d1d-c0987e296835", "value": "T103F42340316A9F33CA7F07F9683C25F00B766569F671EB8D5CC950EA15A8F810762E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335699, "uuid": "25a68642-e93c-4206-b505-e21bd57ef81f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335699, "uuid": "e6499d45-0e31-4829-9c05-aef6dfa486ef", "value": "12288:qJiNBSErx60+7FKlMglO7kMSd1CjKaXJt9Fh5bvo8nkLtU45M1z:+iNwErJuoMSOGk750FtHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713335699, "uuid": "bcc183bf-f339-4f8e-bf66-a1d05861c6d9", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713335699, "uuid": "e96c06bf-ce87-48e0-a27d-d592837e00b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713335699, "uuid": "2aacc4d7-287d-4daa-b342-de6f7c2ddf3e", "value": "Cleared Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459c0f26-fc63-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713321379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713321379, "uuid": "991bd81a-1364-464f-8097-396aebae74fe", "comment": "Malware payload (AgentTesla)", "value": "1f166bede91bdf96650ec5ceb2e6787b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713321379, "uuid": "d5b70010-6b7f-4efe-b9f4-590dc2d6e906", "comment": "Malware payload (AgentTesla)", "value": "ff939a5a3ccca65092f55808e05edec69e6db26df74db1b743cdc96f4c872279", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713321379, "uuid": "4ec3f86c-d110-4aaf-821d-973924f652a2", "comment": "Malware payload (AgentTesla)", "value": "13fcfdd4e9e20768fe2b405fb7e198ce967e94cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713321379, "uuid": "184e438d-79ab-4640-8d31-fa08acdda279", "comment": "Malware payload (AgentTesla)", "value": "bc982d43de8cdb1d451025b8c095ccb48126211bc0b94d13895e5479cfb5bde8b8dbfea15dd86dcfa8fedddeccd098f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713321379, "uuid": "29f47b36-a938-4e22-872b-4c2441601ae5", "value": "T15FE4120D96F82E24C4FC033EE4A255581334EA92E407FB4F9DE954F65F823CAC586B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713321379, "uuid": "75b47727-af66-441f-a3dd-fa2b3559710b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713321379, "uuid": "fa908ac0-8794-4470-b721-537a635e6825", "value": "12288:RG59AO82u/ZSi1RMcquqCg4G0DLtGAUuxtiraSvzK26AgzutR:RWd82crqCg/0DdUuXirFzf6vzutR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713321379, "uuid": "562bbd3d-72aa-4688-8475-ce9e89a3db23", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713321379, "uuid": "f7f6a726-629e-4e2d-a740-0031d26928e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713321379, "uuid": "05030cdc-ef36-430c-af20-16489ca8cb23", "value": "SecuriteInfo.com.Win32.PWSX-gen.24048.16406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }