{ "Event": { "published": true, "date": "2023-09-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-14", "timestamp": 1694736181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "08173a83-04a8-44dd-908f-352460c9f000", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6730eb-5320-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694710925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710925, "uuid": "2a122479-5dfc-48b8-b67c-2e1569fffc62", "comment": "Malware payload", "value": "c7d71dcf9ed43b396dee931cdc7745b6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710925, "uuid": "97ec227c-36e8-45ae-a771-80f3697c4915", "comment": "Malware payload", "value": "02cd0843b225fa8bc8135dcf8634b394dfdfe37c69881a63c8321d3b233a652f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710925, "uuid": "dfa6eb41-6b4e-4ab0-85e1-74ca4e68571f", "comment": "Malware payload", "value": "59f25356d05f6b983eeefd610847a3396b382679", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710925, "uuid": "2b173d4a-8cdb-4bd9-9a91-f9c478547509", "comment": "Malware payload", "value": "9a8aacaeda2f4647f40a470195fc7e2aaa6b2b577176e3f8b90bc0b251d5f0b93fd5b71a19e20795d9791d785057c7e4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710925, "uuid": "6e11cf99-f7f8-4c9c-963d-58addfd24c99", "value": "T197942323A8F477590E4B21377B3A15843A44F8ED082DF943919A9742953BDC69F24B3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710925, "uuid": "3331967f-71b6-4587-825b-472a25cf22b1", "value": "12288:ryUCyYciwP/DoZRETEGQH9jLty/hpbGadDqMfHUSXpIjPsvI:+UCy1X/DoRtdjLtyfRlqKR+jkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694710925, "uuid": "a1c44cd8-00fb-4181-8a83-71e68a2654b8", "value": 429865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694710925, "uuid": "93a02e6a-cbd0-4070-a64a-9b00992f21c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710925, "uuid": "24ce29e6-07b5-4989-962b-2732f8a7a8c2", "value": "Invoice_09142023_9528535955.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b938e80e-52c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694672825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694672825, "uuid": "66328a1c-be50-4103-b3b5-36a1e526a07f", "comment": "Malware payload (Mirai)", "value": "b86ca85af4c17e73e69102b2f45fc397", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694672825, "uuid": "c316636e-2b2e-414b-9ea1-6c58a0871a6f", "comment": "Malware payload (Mirai)", "value": "0436ec7c8fde21dd191d3b5cd2731a66d2757327375a647bc1679d813aae445f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694672825, "uuid": "43fc96fc-625c-4430-87fe-b5ab8fec1bb8", "comment": "Malware payload (Mirai)", "value": "d2b119328e1c1f56463713cd6a746c7bf6d04b7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694672825, "uuid": "8cbd5868-b5c5-4217-b3c3-0c336743b395", "comment": "Malware payload (Mirai)", "value": "9b229857554035d3315461ff60994485b8d0de1768dab0479761ea08a34395f194e3bbb114bc27f7b27e243fdcb18bdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694672825, "uuid": "e1c745e8-5ba9-4cc9-8e81-4b43eaaa6ce4", "value": "T188634AC8BA43D9F2DC1602B520B7EF338E76F5B6215AE983D3D49937BC42A11950399C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694672825, "uuid": "7c0abacb-16e1-4239-8c9b-219a0886c0f3", "value": "1536:Dc0fNarwa4HU8Bzi83gZP8SfjLBovCKe9Rbz3JZGH0wk:DOwa4HU8Bu83gV8S7LBo6L73eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694672825, "uuid": "d8b1f9c6-22bf-409b-a1c9-37fb8d3db4a6", "value": 68144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694672825, "uuid": "b07a6165-846c-44a2-a299-da40ba7a249b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694672825, "uuid": "f5e54327-e287-42b2-a1d8-90df2d88c385", "value": "b86ca85af4c17e73e69102b2f45fc397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8abdcb-52e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694683278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683278, "uuid": "e84f7a8e-9464-4c21-ad7a-8ee3a13090db", "comment": "Malware payload (Formbook)", "value": "21133271697040d01dd03a44322e1729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683278, "uuid": "df8bea11-d545-4ddd-a94d-ad11d670a4d7", "comment": "Malware payload (Formbook)", "value": "05360352816fd2dfd09c05a57131f86c59fd38f7153c5261973216cf596ad077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683278, "uuid": "b74e01a5-5f37-4666-b8ff-64b94f2c8a3c", "comment": "Malware payload (Formbook)", "value": "4cd8d5a471c6cf9664f772eda8f509449c95c880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683278, "uuid": "d565e153-5279-467f-88a9-cce5e27c495d", "comment": "Malware payload (Formbook)", "value": "862c3dd4ef0fb06af2333b50ab748888bf88b57bb63c5cc946e79cfebe9d8809b71ae87edd54cca3b4fc82c2e938ea5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683278, "uuid": "7228166b-4182-44b7-86ae-759eddd85a99", "value": "T1E7E4F1C9E71199A0EC6B53B9647DCE32173BAC2E6848D98818C77D773C316523036E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683278, "uuid": "e159dd4a-f860-499d-a03f-4326987e5620", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683278, "uuid": "3ac89c0a-8a86-4469-ba89-ed6f5b481f6e", "value": "12288:4vsOj8FwLm/PrZV2J3IHR3X3PHZ1lI5afz+6canD4m6sv2THVIcFutDtS5L6rco:4UOj8F6cZ0J3IFHPHtfz5cwv2TXFwDtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694683278, "uuid": "6946bc14-4fd4-4f3c-b00d-49f7575a5bc0", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694683278, "uuid": "99b11f39-dfdc-442b-9283-c2d100cc016b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683278, "uuid": "74f13720-fadc-4bf4-a347-7fdac496a65b", "value": "Original Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b1745d-52cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1694674995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674995, "uuid": "c476488d-b487-4aa4-ac12-953555c9bf3e", "comment": "Malware payload (TeamBot)", "value": "49d8743b2ca1a7b66775d58fbf1945da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674995, "uuid": "8a338a09-4acb-447a-b083-28f5b4adb7f1", "comment": "Malware payload (TeamBot)", "value": "05d828574c74668fdd02f3a0e093e947cf7e1ee0970be402c775ebb236b812fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674995, "uuid": "4dc5d8cc-02c2-435b-a1be-b7cb9950f5af", "comment": "Malware payload (TeamBot)", "value": "93291502aca15f8f12db3b4143d37e2824af2cbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674995, "uuid": "28b16fe4-05fa-4fef-8bbf-0d02974cd678", "comment": "Malware payload (TeamBot)", "value": "c192bfb2b746d72f765a3ac776e27081cab5ad270baa02632a99e17509054ebe61acac163fe5db765a524c9f4a1c793b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674995, "uuid": "9acad091-c703-408e-a099-bc4ba28d1602", "value": "T1BB14CF1239A0F172C4A745345434D2F11AFFB8239BA58A9B37683F6F3D323925B66352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674995, "uuid": "d8a8e44f-171d-48ce-bc87-0397c94ee987", "value": "ef163fd1a1dfd01940ab083fe4660afa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674995, "uuid": "bc2a6ccd-3e7b-4945-bda9-91925b435483", "value": "3072:iHhTzLMu8J2m6XSvoX6Ymdr+GZ/agfrZ84C5ER3QRK568bTTTR4P:WTzLM34UgXfWqGZvfrU5ERu2TTV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694674995, "uuid": "f53403bb-6235-44bd-86ca-d78a2c7dd8b6", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694674995, "uuid": "4325c277-3bec-4134-a230-77527988de1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674995, "uuid": "e71be4f3-5135-4d79-9478-731fd976069e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885b3fa0-52cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1694674890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674890, "uuid": "20b2c160-e792-49d6-b57e-78b25c65337f", "comment": "Malware payload (DarkGate)", "value": "d4981a91fa2550df723d823ee0bceab2", "object_relation": "md5", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674890, "uuid": "48550312-a9d9-4d36-a712-2c3e05204c39", "comment": "Malware payload (DarkGate)", "value": "05ee959d42eb453c1c4bbcd742e22670caf4ac2c941b0071ee587a4535f1b3b6", "object_relation": "sha256", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674890, "uuid": "1a3d6ead-c3b7-4c34-8015-32920336b66e", "comment": "Malware payload (DarkGate)", "value": "c8371a0a6f8f6c27f40ed0e33146e30d702f0683", "object_relation": "sha1", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674890, "uuid": "f97f86fa-e6ad-4992-b1c0-022d4f2ac228", "comment": "Malware payload (DarkGate)", "value": "883624fb3eee9a1a4033954c27b0179f218b87259f8c71522b0b98e9811acebfdab9046f8c21fef9a45b6cd909750d95", "object_relation": "sha3-384", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674890, "uuid": "550a1ed5-81f4-4e34-97ef-59c29f2a7050", "value": "T12AB523603795C235D69F0B3291FA8B227636BC242B30D0CF6B9538B95F366D29939317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674890, "uuid": "891d80e9-ad26-4a84-8394-1bbfe9573347", "value": "49152:9pUPh9TtpSD6TB0EMbiEpcLKIkEfsS4uQuKpuw3wU:9pgdtID6+biEpnF4bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694674890, "uuid": "53f0e016-7501-4590-884c-b02986f3e522", "value": 2342912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694674890, "uuid": "8511f8a4-3364-4aae-82b4-9559349fad7c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674890, "uuid": "7bd47bd7-f79d-4f4f-a51e-0f8d911ee025", "value": "open_v_2.2.6_download.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb154f8-52ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694673931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694673931, "uuid": "610ad270-5e84-4693-8725-68da3e4a14c0", "comment": "Malware payload (Formbook)", "value": "9746111e202e6d5dc2f63f0baa352427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694673931, "uuid": "df531b11-c319-4fad-aafa-d496a744d51d", "comment": "Malware payload (Formbook)", "value": "07084edb27452baade13a450954976ddc8e774df3b7d143d3242275d89d1b586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694673931, "uuid": "69f3e695-9bd6-4cbe-8800-b981c2be8497", "comment": "Malware payload (Formbook)", "value": "82b1c0aa6d382b8c80283b5114964f77a3093c1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694673931, "uuid": "906c2fcf-7572-4db2-93d1-dc735f121704", "comment": "Malware payload (Formbook)", "value": "a3e99bfcea05c9cbe7941b87a15a87c36b29fb052e5b93601a915b2fbfd10d3aca5fb35ec44ed1ee8c3e5578504110c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694673931, "uuid": "618b733a-bb3c-4f62-a272-66f96a1003f0", "value": "T18F7423555790D0F3D8A49B317D688B3796EB942514E9320F53EC63AD3632BF18A0E723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694673931, "uuid": "e0d119c3-bf03-4d4d-ac22-f8e0b88a173c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694673931, "uuid": "e3d3e4c9-ad90-479f-b85c-b0ba9feaddfe", "value": "6144:pYa6HXBnF1Kq/tf2m6zV7kI4Nhkh5IBWBYJ5yUJk5ENI9B/bsAvllKiS5c9:pYVHbVf2m81mNurWJ5yUCCO993Ke9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694673931, "uuid": "b0587d7b-17a1-4755-a5b4-56a577e15a4d", "value": 354490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694673931, "uuid": "d807645e-33f5-4c1e-9ee7-3ec1d9a1987b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694673931, "uuid": "9d6fd90c-de00-4d78-9d39-ed735ceee6f5", "value": "Quotation (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c836c472-52f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694692177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692177, "uuid": "45c434ff-b71a-4335-a411-b5d44d7844ca", "comment": "Malware payload (AgentTesla)", "value": "f111e4ac9108f1bdbb1205b23abe1d28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692177, "uuid": "0e73b588-78a2-460a-8032-ac2c34fbd343", "comment": "Malware payload (AgentTesla)", "value": "0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692177, "uuid": "2d7b36b3-e607-4ba4-8361-8b6e2be22298", "comment": "Malware payload (AgentTesla)", "value": "66484a2da4e8a5c63c2f0ff551c281b9b9e031cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692177, "uuid": "6af9531f-8578-41ad-9b14-07b69222808e", "comment": "Malware payload (AgentTesla)", "value": "b3fb8619244f13d129802034774bd363ce9dddf1bbd99a8a3995ac0d12c2c9489a9e12bff9e93ecd1eedb575d0d3a358", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692177, "uuid": "ae83f558-4cd6-4430-872a-ef5ac8c1a300", "value": "T155941231A7D6C527D5F55E300AAA86252EF09D1065A8A30743E47BEA3FB1291CD0FB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692177, "uuid": "5aa49f6b-bc7d-4f2c-b63f-9145e6d9515d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692177, "uuid": "5deaa19d-31aa-47a2-b762-8cb52196e9fd", "value": "12288:GYIro7VTc2oUVyl793J0rUrWbcG9m+gkOYTth:GYKo5Tcu0993Sgi94gOGth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694692177, "uuid": "df741368-87bf-4779-a545-e011134e8edf", "value": 411345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694692177, "uuid": "3b7a991f-4fde-4c29-9033-a84c072f02c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692177, "uuid": "cf3009fe-b47e-4bab-a448-e03bbc25cff2", "value": "SecuriteInfo.com.Win32.TrojanX-gen.32587.28932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08f4d50-52cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694675441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675441, "uuid": "e1bea0e6-f51c-4f1e-a97a-99b210795e7c", "comment": "Malware payload (AgentTesla)", "value": "f9c751e5401e79c31035aca15457de58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675441, "uuid": "375106f5-ec33-4793-87fa-55f5cfdcec8e", "comment": "Malware payload (AgentTesla)", "value": "08ccb639d18f192ab8120a9c5e2b9eb1499ab6e948aa25d8f108ed49228366ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675441, "uuid": "99e8a177-a9e4-4da0-b896-285001462f4e", "comment": "Malware payload (AgentTesla)", "value": "9c63006dad14db3bf5ea40fdccd86ede8f3e526b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675441, "uuid": "ab5bb700-6c40-4c5d-b604-e229c1ca522c", "comment": "Malware payload (AgentTesla)", "value": "25a056190e31cebeb982ff7587fac2ae7af0c798241ddff16ffd94133dc1881a110ac2f2cdb0625ad5998e9c9f0c5bca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675441, "uuid": "cbccbd06-14b7-4ad6-bd63-c9ed82b6e192", "value": "T1BBE423EB4D5097D0E7E6316D8E6514CF2F13EC6079A84088ECDFED986B85BD22B9C409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675441, "uuid": "7398d30c-985a-455b-a6ee-a562df055bb9", "value": "12288:Ac5g+Uw5V/bp8yhEpxO9/FNGZh5l2yW9DPI9M0I6IAkY952eSKPUndIbot1lhwR:Acew5xtRhEe9MsyozI9M0I6IAVr22PUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675441, "uuid": "555c3300-bd1e-4a8f-a1ee-8769347a34ef", "value": 670404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675441, "uuid": "db969d1d-f90b-4794-9e5b-6986f9dea06b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675441, "uuid": "340bf214-1fc9-47bc-b17f-144f613b0ad9", "value": "DHL08949.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7921cf-5303-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694698362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698362, "uuid": "a5bc64cc-8299-41ca-b060-f2aa22e24433", "comment": "Malware payload (AgentTesla)", "value": "1e6729b59117633d3c8b304267159c0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698362, "uuid": "f74c46ee-8663-4ecf-bec6-ed34143cfef7", "comment": "Malware payload (AgentTesla)", "value": "08ee24a724926d938d89f5c7c7650eaf67512a64386dd3d3aea068ba1157c0bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698362, "uuid": "0cecb869-b469-426e-87c2-934dca5a0f9c", "comment": "Malware payload (AgentTesla)", "value": "ee7d31f6c90aee06650404f5a6cde136bafb5040", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698362, "uuid": "b789921b-9017-4798-97aa-de2315ecf4f1", "comment": "Malware payload (AgentTesla)", "value": "3f69091892e37548282744ebc0c352f75130a96394a76d52f4f56827fd7688551e5850c59b57b1483779c3b0528f9f99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698362, "uuid": "edae7a7b-57d0-476c-881b-2f1308d928b3", "value": "T1A6D42385276DEA30D5D617F1B1F4449813BBCB52E62BD7280F8513781E1BB523BC83AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698362, "uuid": "4f44001f-b38e-4448-8cb3-7c11808e8d03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698362, "uuid": "824b4df1-3a8d-439d-adec-ffb403a64e3e", "value": "12288:/Kj8FwLm/pLYGVocRDKJ1Gi25AGfnPdCqotNTtsVOzPXf:/Kj8F62X7R2nanlNYTaVCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694698362, "uuid": "81dec3e2-eb88-4b22-8057-80e71776b260", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694698362, "uuid": "9b7d3119-2438-467b-82ee-dbdec74d8085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698362, "uuid": "a6e2347c-4e9f-4b8c-815b-d863dd8ee954", "value": "NORIDC APOLLOCTM_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c810388e-530f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694703774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703774, "uuid": "f4c06108-48f2-4a62-b6e4-0a7386ad1377", "comment": "Malware payload (RemcosRAT)", "value": "f5a069fbdd6ef3fc254012eceeab0b4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703774, "uuid": "66b7fa3b-d983-430c-8b84-7d4241fcdc31", "comment": "Malware payload (RemcosRAT)", "value": "0a0cd62f08c090ac9a44f9c0a0a8cabb03869cb6944c39ffd10ff5b9d522bf9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703774, "uuid": "c1b5618b-3dd0-4407-807e-1b51a060002b", "comment": "Malware payload (RemcosRAT)", "value": "9739c4fca01ed08d216dc116d3cb29fd2c0b8115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703774, "uuid": "2ec50900-dedb-476d-9ef3-6229fa106f88", "comment": "Malware payload (RemcosRAT)", "value": "1fe4fcb1c4c5b127bc39c14631d112da1a1e85fbde2e3aff539ac684caad945fad9fe906371b857c79f52f6089c688e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703774, "uuid": "ad6a76bd-434e-49ed-9b9c-f7f90efd5922", "value": "T13C1523117751E2BBCA39253080378FE95E74FD146004CB6A3BB2F95F7A3E7926859382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703774, "uuid": "dc94df6d-fddb-43b5-b6fb-d6a47c4adea2", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703774, "uuid": "a55be229-a7ef-4568-bf7d-7dda53544528", "value": "24576:4B559KG1SktV5PU+UoHBbfIju8OkUGhb36:SL311L5PnfIzHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703774, "uuid": "0c3250ec-ec3a-42ed-a38d-965bf33e92d4", "value": 889920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703774, "uuid": "3d0736f9-390b-4e4d-aec5-65f79e204a52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703774, "uuid": "eab381eb-3a27-4109-98bf-afc0b28bc4a3", "value": "REQUEST FOR QUOTATION - yk group.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896ccadf-5307-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694700233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694700233, "uuid": "ae27c719-12d1-4e80-a47c-0badc090d794", "comment": "Malware payload (GuLoader)", "value": "6f863fb01f4555afccd439cfaa05486c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694700233, "uuid": "c0ac32e4-d20a-48ac-a70f-37a4e8456da1", "comment": "Malware payload (GuLoader)", "value": "0aeee2c51683d63a82d22bedad91e3355aad5b09e165fca684582c607b81aa22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694700233, "uuid": "546c10fc-ac77-41bf-b867-cc8df5b9ba0e", "comment": "Malware payload (GuLoader)", "value": "d149fa1daa26917562572efe703afd7193d5ce7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694700233, "uuid": "29b3718c-2c35-4bcc-9481-371cbc45f194", "comment": "Malware payload (GuLoader)", "value": "f99379ed6988bbf8d68f1ac069daddd5165f3ea497463ef60ed472ac1547bf25be6128c0509ba9bfb4db241a3d910566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694700233, "uuid": "7beeb529-4987-406f-aff0-f155556e63bd", "value": "T115B4E02E644CC8CDDDC72A7AC860718CF2B35A56CF4300BD13546E865FA9E39D694BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694700233, "uuid": "89eab30c-d4e4-44dd-8b45-4c1c577adf2b", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694700233, "uuid": "763a1b78-148c-4987-8cfa-f73f982ccae7", "value": "12288:UhtN9eKJeoCcmHOu+g57o8XYiXu/TCA9cP8ugXl:UpehjuuT57TXVereP8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694700233, "uuid": "4e4ca5c1-a99b-4fe5-bc41-95ee4a65b008", "value": 514368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694700233, "uuid": "c670865c-ee20-4049-9014-fcaac78dc97a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694700233, "uuid": "20abeea8-f7a4-4015-bf19-892d0f3b2743", "value": "Pedido.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e0043d-52cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1694675014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675014, "uuid": "9bc49f04-0686-4b72-b66b-05581667cdd8", "comment": "Malware payload (DarkGate)", "value": "4159d454a06b07465a42fdc2ed3d1575", "object_relation": "md5", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675014, "uuid": "f38b4bb5-b91e-4ae7-908a-a94f5fa0144c", "comment": "Malware payload (DarkGate)", "value": "0c43398c9b643823f879aaaa2e3cc9f4511cb1e45687bf673812ac55f527ff12", "object_relation": "sha256", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675014, "uuid": "1720e3df-647b-477f-98e4-f957632d58e1", "comment": "Malware payload (DarkGate)", "value": "c90d572f7f160dd8a3ae6e825eeb2a9d6628cef5", "object_relation": "sha1", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675014, "uuid": "44b26cf5-5b2b-4666-ad9e-3cd879194d81", "comment": "Malware payload (DarkGate)", "value": "f4ba9a7098109984a01da6c6df9ec0ca1162675663762103a86f227a9429ccf2c4e7f9a9fbbe85227f4cf5d59bdb0c48", "object_relation": "sha3-384", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675014, "uuid": "7704074e-9820-486d-bd8c-1ba37af9ba3b", "value": "T1B5B5235136C9C137E69F1736457AC7A6126ABC205B30C0CFABA13D5D5B32BD2AE39312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675014, "uuid": "23d5292c-3506-46cd-9f11-a19cdcba72c1", "value": "49152:kpUPh1lqpM8LVFlZRUGJGV0Ar3mhAijKtORfjBHbioVvboWQRJna:kpg1pejUoGa1HWuvmJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675014, "uuid": "65ff4393-a0e9-4d1a-b57a-3358fce4df4e", "value": 2347008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675014, "uuid": "71b7d69c-81d0-49a9-9ca3-967f02f71ef0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675014, "uuid": "9fd0eae8-3e7b-4ef0-94c8-7e91e0f19ee5", "value": "S_install_x86.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef977e8-5310-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694703919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703919, "uuid": "e474ad32-69fa-43d0-8a78-b9bf31621664", "comment": "Malware payload (Mirai)", "value": "9528a2d9c5dd2ce581809e1cd9e9187b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703919, "uuid": "c27de6d5-eebc-4976-9d09-33c2605c749c", "comment": "Malware payload (Mirai)", "value": "0ceb43aefdc01bedf27d70dc390d9b2b6d34ea13b221e720d05050843d29f30f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703919, "uuid": "c889d91f-108f-40bb-8904-42f2c5f1b2b8", "comment": "Malware payload (Mirai)", "value": "c161297f131c4d5b49c3294598625f1226d22755", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703919, "uuid": "218c4575-4383-49c2-9a77-9d9066141a40", "comment": "Malware payload (Mirai)", "value": "fcae0d9b4af302fdab9ee82317307c722adeba1b15db9735b344ec743b56e09c950ec5b0f13abf62ad161bcbf8989572", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703919, "uuid": "5ebc9879-64ba-4dd1-b7c9-c5bd14dc711d", "value": "T194336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703919, "uuid": "bee4ddaf-caf0-4d89-9a78-489981e45427", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703919, "uuid": "d657744a-fa98-46f6-ba12-b9d3cf6e4afb", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703919, "uuid": "7b00a527-1e65-4e33-a5d7-8c9acf14f6ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703919, "uuid": "3d881d4b-9882-4460-af7a-7a34e4376227", "value": "9528a2d9c5dd2ce581809e1cd9e9187b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb953341-530f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694703780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703780, "uuid": "a0d33fad-a526-4b2b-bc71-9644350c3afb", "comment": "Malware payload (RemcosRAT)", "value": "d327d1f2e4c2192cb0d8c91045a4fb78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703780, "uuid": "de65665a-9fba-4a0f-913e-0d23684a08ba", "comment": "Malware payload (RemcosRAT)", "value": "0cfe83d4758e9c2cb881258191b2628be42b563fdb4ce22e8d94f0a3f7ef7726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703780, "uuid": "4f90096e-168f-46bc-aefc-49c530d20cd7", "comment": "Malware payload (RemcosRAT)", "value": "2a70a23b9657e57aab2e1f364450d61d609d82eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703780, "uuid": "078f4f26-bf78-492f-9326-089f5026f743", "comment": "Malware payload (RemcosRAT)", "value": "da2e09b4694d011774339ff64bf5cacafeea23dfc56bf7794b289fd22c86f9c37ca0fee7982bbd634cd5412c6a23ed7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703780, "uuid": "b2b220e7-b6a0-4ac2-b998-2e948252edca", "value": "T1FD1523596A90C0E7D8249B7180678FBA1FB2DF506802574A37F1FBDFAE707C196A1780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703780, "uuid": "ac973149-2787-4497-b322-ab35d69accd0", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703780, "uuid": "92715930-c355-4795-8c1f-6c1b247fb040", "value": "24576:ZqKoweKqdPc8GCxuB8UiT+QVhRL6QRkUGhb36s:E/weKqdP2B8UiT+amHtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703780, "uuid": "24eb251f-2548-47a0-b5a4-40929757f1c9", "value": 898744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703780, "uuid": "0dc19613-e19c-41c9-92fb-b4f36ff4aa55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703780, "uuid": "f1a4045c-140e-4b21-8887-23f3e615fa87", "value": "Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93ad997-52cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694675429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675429, "uuid": "4e1d1552-a0f1-4d00-b1c4-d929f7437bd5", "comment": "Malware payload (AgentTesla)", "value": "ea035f263ee580715c0f7b7428a4d7b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675429, "uuid": "9fd8c19a-9da7-420c-9e68-752da800333d", "comment": "Malware payload (AgentTesla)", "value": "0daf18513d6b35493737ec289f4dcbf015668ef59d7995c0f42dac26d72cfd5a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675429, "uuid": "d197151a-ac5c-4536-99f7-84a203506354", "comment": "Malware payload (AgentTesla)", "value": "53c470a8a33b69dd1d46575fd989d5f6906f8030", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675429, "uuid": "a525ec8d-9ca0-47ca-b8bf-9bb3e64d5b2a", "comment": "Malware payload (AgentTesla)", "value": "3b79fe9b5ed281c0f6a0ac4b63708d25c21ae2018bf93fa0f73746026f4f475d6353be9d43bce0c3b8ac4ccfbba8314e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675429, "uuid": "e4971abd-de5c-4713-8fd6-91b8233c64b8", "value": "T1B8E4231440D51AA3DA0B333DF81A3547BB42394B4D797C6BBA32BB76083CA5E2D31A5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675429, "uuid": "36405870-778d-474a-b776-14a048f46a3c", "value": "12288:AE4nWw4eM/abKS1sMuKHjG2bgoRgkDC6lDiyQD89JVlFOiW9xCYlwao8Zh7dqnUT:QwV/C16gjrbgoRvQ27OihYlwhG7snDIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675429, "uuid": "47e98bd7-4dd4-44ae-900d-28611e289d70", "value": 670980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675429, "uuid": "3e9aead7-b315-4021-9b3a-2693e765c265", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675429, "uuid": "d256aadf-2918-4373-9293-2bde44788b1b", "value": "PO140923.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac12a45b-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694703297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703297, "uuid": "92ef5eca-13a8-4f21-9cb3-5a8206100516", "comment": "Malware payload (AgentTesla)", "value": "3cb62aef84617b2c715da3b5c0ef9bd1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703297, "uuid": "e5c67dac-104a-4504-8b2e-581ec51fd7fd", "comment": "Malware payload (AgentTesla)", "value": "0f69d4d4547115ff76ee03ce25d3d18db598ac2b1ff3806c7bc77e75102573cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703297, "uuid": "8e47c76f-9cd3-4e4d-ba90-b633873183f5", "comment": "Malware payload (AgentTesla)", "value": "96cd14b1a085300294cfc7d1fa4c2ea526ef02e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703297, "uuid": "38d480d8-7981-443e-b6be-7b562b611d62", "comment": "Malware payload (AgentTesla)", "value": "8654363bf8cec9f914d3542bcd7f0609487b40c93060404c4bb2f28531e2db1cea81462839768cc8d3ecd9ab6ce1aea0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703297, "uuid": "7bd1c646-c1b0-42d1-93e8-ca2a5fdbe728", "value": "T163E47D83F64548E3FD551732C4FB582013A2EE86B767D60D358A33A21A733E398669C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703297, "uuid": "ab084488-3642-4eb3-9b38-ad45985fb5f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703297, "uuid": "a7880e7a-a409-4bd8-8cd8-a9d1eda02c44", "value": "12288:/tMt0k+/waxh2poc21aB1R1Cy4RuVQdlBGX7PGKFqSRrPR:/hkkwa/2ponSj1URuVQlGzGKFq8PR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703297, "uuid": "e5107cb7-449d-42ca-9bbf-9474994ea976", "value": 714744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703297, "uuid": "d64c1fbe-de7b-4284-9547-482e6e4b6acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703297, "uuid": "6013e475-cf6a-4d2a-b789-ff3b7713dcd4", "value": "Request-020601pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a26fb7-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694675924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675924, "uuid": "835e6068-6435-4528-b017-1bd51484d446", "comment": "Malware payload (Mirai)", "value": "87a0504bb617f86698a7e69d0f8086bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675924, "uuid": "993d8719-a7d4-4ba6-bac7-d9d25bd2674a", "comment": "Malware payload (Mirai)", "value": "10795c309dd83611da5bd5a5e49ad5a2eedbe9fa98a969bde0425d1650c75a69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675924, "uuid": "eefd6773-d484-44fd-bf11-63edb608dc70", "comment": "Malware payload (Mirai)", "value": "2075d270cab48e63983eb60946925252e3f6246c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675924, "uuid": "583777b4-35cc-4800-b818-f4dfe1fba80d", "comment": "Malware payload (Mirai)", "value": "3647b8f9edb9c2e5889b4a428b12128a3a153971f199d698d69d20fb60764f16691ae13c7ed4921e3deb70143118a1e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675924, "uuid": "6c84c1e1-7075-4ac3-b298-c629976244a3", "value": "T1B7830A95BC818A11C5D813BAF92E018E332267E8E3DF72169D205F2477CA92F0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675924, "uuid": "85cab9f3-99a8-43a3-afbb-19f2a0983424", "value": "1536:aUnnPM9miB3/SfboltisGSEILicNG6G1X0Rw6y5zpZ51Lhuc6BIbiQaUDGWbEf4:O9NjtfzEILiMFGVlbZbaUDGWbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675924, "uuid": "63a19227-976f-44a6-956c-87456d88ba81", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675924, "uuid": "a548f893-49a5-4a29-bc61-1ce59b4bfb60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675924, "uuid": "9c5dca96-e492-4323-a669-5154d033bf2a", "value": "87a0504bb617f86698a7e69d0f8086bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1be8bc-5316-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694706760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694706760, "uuid": "d755a0e4-5c8f-459a-a30c-6c459557fd27", "comment": "Malware payload (Smoke Loader)", "value": "d246b71e5df1eb4c2a7e617404aee3d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694706760, "uuid": "f3a1193f-5943-4aa5-8b4d-887c0127f7ec", "comment": "Malware payload (Smoke Loader)", "value": "110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694706760, "uuid": "bb250ee0-1222-42b0-9e6b-69773ab1bd63", "comment": "Malware payload (Smoke Loader)", "value": "57ae3ea47c9b3ac954a69ea0272d0b311e97c129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694706760, "uuid": "0e3537a2-98f1-4a8c-9465-ecbdf28a8e11", "comment": "Malware payload (Smoke Loader)", "value": "5cfb1d1825b07b5df17ad245fd784415c40197a6b3e9ebe48b8d98b4136a7e04ecede43f4588be0f1fe103d19392f963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694706760, "uuid": "19b2f6b5-37e5-4fbd-b1cc-6ac6de64451a", "value": "T19814D01236E0D071F4A741348474D6E16A7FBCB39AA6854B33583F6F7E312A267A6343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694706760, "uuid": "a663b5a8-980e-4511-aa82-6782e407c053", "value": "b240da42760a8c87cea3a4ff648819c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694706760, "uuid": "b0bf85bb-10dc-4562-a0ca-1b0621aa32c2", "value": "3072:TOhzzLL/JYhibm2wUgur/U5f0vgbqu8FlpO56VpPT3R49:GzzLzOh6VwxuzU5fbbp8fbvPTh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694706760, "uuid": "f843d765-d310-44aa-9dcb-1739d7ba0f9f", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694706760, "uuid": "18a4beb2-eb92-4522-b37b-0b8a7a4cac65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694706760, "uuid": "8eaaf241-3a72-49f8-8eec-a4acac9891ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fd0706-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1694703305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703305, "uuid": "5500e397-e59a-4320-a123-bf6890ea2096", "comment": "Malware payload (XWorm)", "value": "cd97ae4a036b63d4144365153a9e2510", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703305, "uuid": "08d895da-59ab-47d2-9a74-fcf419416165", "comment": "Malware payload (XWorm)", "value": "118c2b5a086c49e63b9113e0bca7aa2dbe7f5c9a4214d60c85cafa1adaf22730", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703305, "uuid": "3a5866c2-df15-4cf5-8441-868fe46d5599", "comment": "Malware payload (XWorm)", "value": "f607fe3750a01bf778c72f67feedeabac50e39e1", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703305, "uuid": "ddd30300-e795-4f03-b93d-092c312ccbe7", "comment": "Malware payload (XWorm)", "value": "e39ff874a2082d89d313a3cf8eb9929edda89a73393dffc421f0b28c06f3f009ceb8f5fad470c58452952a1df0b21c3e", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703305, "uuid": "6b602bb8-7dae-4982-8fec-524a980a49f0", "value": "T1F48423E93111DF47E2F52DF3E4443BBC2AFAE82899329E4EBD196E61584CC990F24543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703305, "uuid": "3656099a-b9c2-4b51-9e44-f0331596836f", "value": "12288:WpZv0SCbdTWdgZfskJw1CtS12jY+cPlGRp:WpZMrbRPfsJCccjYFPQRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703305, "uuid": "732df902-80c7-43d4-b053-afa64fca19d4", "value": 400738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703305, "uuid": "ea521376-15ef-4665-9aa0-18c2ce8434d8", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703305, "uuid": "6e5bb1cc-e587-442f-aa98-da94e41b1e69", "value": "XPO Invoice PDF_1.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c759a119-52f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694692176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692176, "uuid": "28cdac99-d32a-464e-b400-32ce4d27bc11", "comment": "Malware payload (BumbleBee)", "value": "3a96a42f6d6334a36d2ea26abb0a2c95", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692176, "uuid": "fbe03606-d43e-405b-8af1-547891721a00", "comment": "Malware payload (BumbleBee)", "value": "131cee43a6f14bd9133246e87828275c30b2ad9d3036b4fcd4a08001903fa7e7", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692176, "uuid": "3ce8d954-5a23-4881-a447-4a3bbd8a16db", "comment": "Malware payload (BumbleBee)", "value": "d88496edc6ed76072d656f68c3bd845bc823e442", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692176, "uuid": "c5625b88-83f3-49aa-a906-4c9862c0a89d", "comment": "Malware payload (BumbleBee)", "value": "2e56c3330463484cd6407c1732bf02f06e421ba2b527991372252a9fa622b2591255133464537847c97918ef3ba25088", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692176, "uuid": "e810f37c-4f6e-4ff4-90db-f504c0fbbe23", "value": "T17135AE61A27AB733F737B53B08BEF939560135A66673BB5B101936431032683EEC750A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692176, "uuid": "33958418-21ed-411e-b9e5-12acfb3309e2", "value": "660e4ba65070c42e55f04efddf5f7d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692176, "uuid": "e6a46ae1-c87e-4e77-8d50-f3b335ffaf52", "value": "12288:VOQRLO3Bp/U4uxkfRZ2qKoWep2F0D02lHoSrcrb+OArPFJz9N4xvYb8:VOQR63XMxkpkqKZ+e0Z8uprPrf4xQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694692176, "uuid": "86563253-d084-4abc-8d74-574d41a24229", "value": 1119232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694692176, "uuid": "85ca89cd-dd53-4a23-b8d5-1e0f2959f2ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692176, "uuid": "49d13525-84f0-4960-9593-ec33ebd62129", "value": "SecuriteInfo.com.Win64.InjectorX-gen.3183.32393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de130336-52fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694695650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695650, "uuid": "af96b1ef-7afe-443b-88c0-18315146c049", "comment": "Malware payload (AgentTesla)", "value": "b3f6079092d3bb409976a3b2a638e379", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695650, "uuid": "147ab6c0-362f-4441-baef-2ea1cb7fdac6", "comment": "Malware payload (AgentTesla)", "value": "142b5c747f40768652455670aa1050e6b2cbd7cb1517c3ab0b958007ddc9e692", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695650, "uuid": "57efc206-da29-4800-ad37-017b63186596", "comment": "Malware payload (AgentTesla)", "value": "e05ec2550a0fb094798cc92ca28270e7be9dc8c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695650, "uuid": "255cc2cd-aa70-4c1c-b26c-ad3205347a31", "comment": "Malware payload (AgentTesla)", "value": "1cc8e2714df63f02d33c51d5398b48f1b650a481de4857829ad057db9f0210fcdc2ba8927e6a6162ffd93c4a1f308af0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695650, "uuid": "392ea74d-6261-4490-8169-130b18f75a9b", "value": "T111E412E2B616EE89E8AA0BF14472530003B56E6D95ACE50D2ACE3D9F73337431594F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695650, "uuid": "badc15e1-0e4a-4377-852e-5638c599d82f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695650, "uuid": "c5cd423a-749c-4343-9a4b-24f00dc258c3", "value": "12288:Xv5j8FwLm/BFLmM2+3XJ1gyIbIzSNAOk6YxFjul9NOMsrX3WtmMzXLWFEAmD:XRj8F6ONmM2+3XTgyIUmNAPZUOf3qzXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694695650, "uuid": "1584f9c9-523b-4df2-93d8-b2c7e96b6250", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694695650, "uuid": "acaaa634-b671-46c2-bb96-50683b95dde8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695650, "uuid": "52115e2b-4309-4ed2-804b-f68700392993", "value": "SCAN_AWB_SHIPPING_Bill of Lading_DOCS_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57399784-532b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694715610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694715610, "uuid": "57adfad9-1360-41ba-9467-85a33839e677", "comment": "Malware payload", "value": "0eea2c9ded8d309820234b17b4e8343f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694715610, "uuid": "f2f48b43-9dab-4aea-898e-4de42e8fa046", "comment": "Malware payload", "value": "14a345284451e91e690daeeecdb8408c33ad9bcd725fbc2090780bc128e4d0bc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694715610, "uuid": "beb93643-a0cd-409f-a1d0-6e659d8cfc85", "comment": "Malware payload", "value": "88ec76de11c3972f1805a9c1ab0fb2c81197839d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694715610, "uuid": "1d3b72de-a36c-4d4c-8750-0556a5540035", "comment": "Malware payload", "value": "de9e4f465def534aad497ef57d119c800b91bdc59730610559b37f6a52d3e649e0bbdf47179b0056a4f681076403a4b6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694715610, "uuid": "b283f6a6-15f3-44df-811f-b5804d60decb", "value": "T190D312B9BAEDB931DC3BE275BAD320D2B1090A43581AE7612707E31C6769FC79353850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694715610, "uuid": "c1ded7e8-0eec-46b4-9c32-fe9403ceab2b", "value": "3072:QOw88yvt7SMkEhz+PL5BzrLwpJ6yK8/h7b7/ZDO+Ukd/:QOw88YJkEIJLwpgjGhb7hDO+UkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694715610, "uuid": "a87617e8-a2ab-4f10-bef6-eb5d6ba49d0f", "value": 140402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694715610, "uuid": "2726f086-4c24-4ca6-83ea-966c307af20a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694715610, "uuid": "cc78cb54-07f2-4ae9-9b81-f8334ed6c566", "value": "Anji Reddy -Certified SalesForce Developer.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbdd260-52e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694687353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687353, "uuid": "3cf44aaa-7efc-4e0c-94a9-056df30ec418", "comment": "Malware payload", "value": "f0ba4e02dfc241dfbc0af650896189ac", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687353, "uuid": "786bb975-e07d-42ae-94a7-20f1c6f8e0b7", "comment": "Malware payload", "value": "160b32b78681994ebfb47a8fb97b56d951707f876a42b6d968908b9b48a147a6", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687353, "uuid": "28cfbd81-cdb9-42f4-89e0-013a5db59f6a", "comment": "Malware payload", "value": "5fcbfd1ddc62496685a52a1594edb23e4fc5ccc0", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687353, "uuid": "67d69a4b-14e6-49b5-b040-9840be825ad3", "comment": "Malware payload", "value": "5879a9520315c9c8bfdee02f3188add0e0f1db49a234f6f6fc8adf632993be0a9531f99ea354ad34d21bbeefa19524de", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687353, "uuid": "676e335e-d5f2-4e34-8196-a15353742ec9", "value": "T19F426C2EF9277C2ED67182B8043887E4651F2943D342A56F2BC875985B43A77078F1DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687353, "uuid": "b239f8be-510a-4d52-9e5c-4a19cf9982be", "value": "192:U6FeLEn6Jb3UCG3BFQQav/dMT+y8b5HdyOiSkhc1Rbxcu:UOeonm3rMBFQQu/vy89kOiSk2bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694687353, "uuid": "47fd45a9-ac52-40f1-be90-5b78061d01aa", "value": 12685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694687353, "uuid": "e637bbb4-0dcb-4ef5-983f-12bed0abe272", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687353, "uuid": "2c525aa0-249c-47f4-92e4-ca351e49515f", "value": "f0ba4e02dfc241dfbc0af650896189ac.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281f35a8-532e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1694716820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694716820, "uuid": "3c3e253a-9be9-4826-b003-ba70db4e4cc6", "comment": "Malware payload (AZORult)", "value": "a287b7c12fb69b25c4c43c84a0639916", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694716820, "uuid": "f7957e30-60fa-486e-8e49-51297ff32d2a", "comment": "Malware payload (AZORult)", "value": "16495e3c7dc157fb17b808e31db3f6c6339a398c80bf6c2229cc7e0c22fed3fe", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694716820, "uuid": "30fe7b50-c310-407a-874c-2be652122ff4", "comment": "Malware payload (AZORult)", "value": "bc57ea1e21d27f37cdd714fa509840bdbafb235c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694716820, "uuid": "9fe084c1-8eec-41e6-9798-fe74b79c43f5", "comment": "Malware payload (AZORult)", "value": "bbf888dd229bbbbd85440e6e94d5b9870a1b6951daabb11d8f85a2dc3b2fdfb9f246b7da4eaa13af423f79c2d5e11dee", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694716820, "uuid": "75679ecf-d969-4f50-a1ac-41979a3bde5c", "value": "T198C4E08073A86F1BD0BE83F8457165140BFBA4197026E7488ED634EF2AB0F948B55F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694716820, "uuid": "69b66d97-8b9e-40fb-8fb2-be31907fe85e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694716820, "uuid": "6d63c135-474d-409a-8cf7-01c249031645", "value": "12288:zozCw87wtvbwxdmKJT1u9/zjkCYfRF8zaNXzA22tCKqm7j8FwLm/:zoCwmwtMxdJJT1uZjkCUFGoXz0qgj8F6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694716820, "uuid": "b52ad26d-b573-46db-9bbe-e3bc95b63025", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694716820, "uuid": "958a170d-589d-4f61-a938-2721440c4eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694716820, "uuid": "70ec7804-be7c-4ceb-9afa-dc00fa4e5ac4", "value": "RFQ No. Q-REN-P-2023-00090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635e4f83-52e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694683418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683418, "uuid": "d3f87703-e1a7-48c1-90b9-9912f89089f2", "comment": "Malware payload (GuLoader)", "value": "fd071a543e822451d1c638e529b3ebf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683418, "uuid": "93727cc5-e135-42ad-82ea-38260003fdc3", "comment": "Malware payload (GuLoader)", "value": "16a80cfdecf7936888b155b6c3f39b7d7f76015471f4b856ffdd318b716dee18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683418, "uuid": "88a15a34-6bd7-4c7e-b7c1-fe1537b0b0e4", "comment": "Malware payload (GuLoader)", "value": "60717e676902355877eb4ca464a01cb1f383fba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683418, "uuid": "ed8c7ca6-c5cc-460c-bd3a-3c8c5839bcfa", "comment": "Malware payload (GuLoader)", "value": "8804b8694ddb138d6e27b7d81a316d3fe11839eaf5cffb1e2b1771af2b0e0f0a1714d4451beadca1e40c86758cfb7d15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683418, "uuid": "df948aa6-ed92-47c4-9630-fb993a9947c3", "value": "T1A2C4F0127546E483CEE51DB15F3BA8462EECAC1548A0106F36C6BB1E503767246FFD8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683418, "uuid": "5e88bb23-0fba-4582-9db8-19b9b1487f4e", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683418, "uuid": "e22cf18e-c0d4-4ff4-975e-e95a38dd74ee", "value": "12288:JKDae4RVdQVCCkyd/lL4CpzPV2S9P9C0ShnPR:JKaeAVdQgXydiizgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694683418, "uuid": "3d9d378c-60f7-4724-a17a-9cbdd1742ad0", "value": 559680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694683418, "uuid": "0b61a6da-30ec-4b68-927d-aeab58fef5ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683418, "uuid": "2927b55b-aac9-44b8-a968-a7171b021822", "value": "PO-3078.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea64a1a-5353-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694732722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694732722, "uuid": "4ed9be76-7717-4f6c-b20a-ced89e8284ce", "comment": "Malware payload (AgentTesla)", "value": "de10eff61fa8ac7c0d98c6a0aaf5231e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694732722, "uuid": "18e0a1fd-5708-42c8-809b-1c6d94244f0e", "comment": "Malware payload (AgentTesla)", "value": "171c707afb64b5ad621864968ce888af80401c2247b5b21a05f45985063d5b88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694732722, "uuid": "5d6e8b25-8f2e-4f97-b07b-e7e8357d1451", "comment": "Malware payload (AgentTesla)", "value": "a3e093bdc426e5252360183ba677c8f968a4ba5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694732722, "uuid": "82056027-d978-4f53-abfc-58831d420b26", "comment": "Malware payload (AgentTesla)", "value": "883913832fc857fcc643291c73434268cdb3ad80e9ae2850921fc4bae45101803a8cbbeb03b7d2b06409298d0b7d4fd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694732722, "uuid": "edb527cf-342b-4158-a48b-0c6f6fb88662", "value": "T1C774021DABC98B54F0EF867294B7524283F5E106BA39D3880EE771D70E2BB560016F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694732722, "uuid": "ef5fd537-c08f-44df-9fd4-3502b8139568", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694732722, "uuid": "a670fd34-65c2-4018-831f-f6eb8971747a", "value": "6144:Pr3LLPrx/Q2+mLLygc5aiEtk3ciynTjcY3ixH+YgsxqaoXmMH59:Pr3LLqG/dlk3XyvcPHYsxi2MZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694732722, "uuid": "6bf4ba79-1f1a-4f87-aaba-f2a0e642fad2", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694732722, "uuid": "101a5090-ab15-4358-98bf-380e56300591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694732722, "uuid": "17c4619e-7122-44c3-9c81-ae052b2ea9f6", "value": "PO-987098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c34f594-5311-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BitRAT)", "timestamp": 1694704425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704425, "uuid": "cd6e3a04-2a43-44a5-8257-99603c38797a", "comment": "Malware payload (BitRAT)", "value": "68297123bc1ddbbd9336aa121a9dd534", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704425, "uuid": "495b70c0-8ec4-48eb-a20c-bea678c541f2", "comment": "Malware payload (BitRAT)", "value": "17cfb90deb531e2068d99e671423d8d1bcf8f06a0e2666f0108ca8e8b706dd1b", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704425, "uuid": "8ba8670b-9ae9-4960-afd0-02b0f16a8d45", "comment": "Malware payload (BitRAT)", "value": "2d8016319edb893e0ae600ba8c89f00a30466967", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704425, "uuid": "3222bf6d-1671-4c03-bb85-d6df68cb5d6f", "comment": "Malware payload (BitRAT)", "value": "6d7185046fe8045f9b5b778dd23fdbf7564f8a25d9af42b15b06a1367e25eb03f217ec3297dbcddc609afbb5b24cd784", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704425, "uuid": "ec2f153a-894a-4fcf-814e-5f94d509dcb9", "value": "T128140227B3A4D911F44183B4A8CBC5557B32FC64AE01AA8B77467F8FED752709D0270A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704425, "uuid": "1e743827-9844-4545-88dc-207739bafb51", "value": "3072:SbiyWTxSoVHpNY6nemhInf/va46YP6z+dzL:miyWTwoVHp6m0/yl6H9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704425, "uuid": "ff524f83-7b36-45bd-bac4-e82bf816fefd", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704425, "uuid": "c224a925-3add-4433-8dc8-27a2a32bb65a", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704425, "uuid": "ba755d48-e74e-4dd5-90d7-577a54e3135d", "value": "Documento_Orslgroup_S.R.L_09_2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0d1761-5320-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694710921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710921, "uuid": "3eadd482-3f5e-4e6a-b25d-19ab71e42ed7", "comment": "Malware payload (Formbook)", "value": "86f23924ae2df7830940e8f8b51e602d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710921, "uuid": "a779ad64-66de-4b67-bb58-2905bda68781", "comment": "Malware payload (Formbook)", "value": "1837977343db27c358f1e1591e4aac16bb0cbd920ccb5663c2d4c7cf1baa1067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710921, "uuid": "29af1f15-538d-4bb0-b78f-61c6f58d761b", "comment": "Malware payload (Formbook)", "value": "049548115dce7b49b97865f550b559041b03a76f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710921, "uuid": "d933b568-c181-46c0-b5b3-86720fdace87", "comment": "Malware payload (Formbook)", "value": "cbd5e7fc790dd9960244418e3c58f6b603213f3903729bf2c3ba6d56f75fe73868aa7409426b6972541afbc7ba535e64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710921, "uuid": "c372f4c0-2a43-4d95-8204-7b57a7b2d5cf", "value": "T1ADC412A722A45B07D4FF83F69576260953F1D8799828F20C4FCAA4FE2B36F401548B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710921, "uuid": "97ccf4d3-295b-47d4-bcde-21cb54c4fe18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710921, "uuid": "ae0e8727-7616-4a16-b57b-af67aa29c21f", "value": "12288:Tv2Aj8FwLm/VMmXmiyb8kIVz6pHj/1tasyvucZptQ5Ic:TuAj8F6QjmisIVepZERvuSptQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694710921, "uuid": "dfdae5f4-4552-45ad-9f78-245774b4a938", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694710921, "uuid": "b0769054-8b76-490c-8be7-268c91bbd28d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710921, "uuid": "1108eb2f-9e7a-41e6-a599-82fb97fe173e", "value": "hkcmd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ff155a-5353-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694732733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694732733, "uuid": "ec0b2722-c805-4dc4-ae6c-f335bc2bbe82", "comment": "Malware payload", "value": "c5521f937b54a93aaafd7ee393c8c598", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694732733, "uuid": "1bc8ddc4-b0c6-40c5-af94-573cc5147551", "comment": "Malware payload", "value": "18b60825348e063c719f443680ba8425dc968ad9cfb4f07f91fea89e2b2d1f0a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694732733, "uuid": "aa647fe9-703d-4034-856a-00b43b5aa3fa", "comment": "Malware payload", "value": "b5619bda677a9bddc555027e7790cea35a925f62", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694732733, "uuid": "a0d41964-b72b-44df-a760-01083f9ff726", "comment": "Malware payload", "value": "033a53aff2fb14b881a2eda91d2c1bd13b0a46d6154ca6c7c58239c21d8beacb9e78a16983b0d2fab7c836fc18d46219", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694732733, "uuid": "d64e946f-bedc-444b-81cf-edae21644192", "value": "T153A51253F665A86BCDF6D3732175523651370D28CB43BB8A2D4877BE28BB9E84B421C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694732733, "uuid": "04acd3cc-54c3-4c16-a190-4eab3ffb740d", "value": "49152:O/QgYA4FT0XSoSu0cEhnQoJHHkMCfUH1Gmgq21a5TMqhlfT8S4cTVuxHREYCM:kaYS13caEMwUHD20fhJz5uZREYCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694732733, "uuid": "a2070de9-a691-4055-96f9-a4f8a049d6a0", "value": 2188019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694732733, "uuid": "c9d1a37d-1dbb-442a-84dc-c26c7dfcb325", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694732733, "uuid": "799b982e-6b95-4e6d-8986-bde258b96915", "value": "Sexy.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d116b9c-5315-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694706117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694706117, "uuid": "929969db-07d8-4274-a66f-5b1ec76e6aed", "comment": "Malware payload (RedLineStealer)", "value": "070f4d81585a8247164b20f5ca6b1503", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694706117, "uuid": "2a799859-f20f-4758-913b-13fb87247820", "comment": "Malware payload (RedLineStealer)", "value": "1964e458a31a00bf2dc445d1ce3528cf304ce68dce5bf1fe2a9e3975cb018d33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694706117, "uuid": "70e33565-90b0-411d-ae1e-4ae02c9b20cb", "comment": "Malware payload (RedLineStealer)", "value": "497f3b7376925bffdb06634906ebe4104bc4221d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694706117, "uuid": "ac837f5a-9652-485f-83ba-4416f8db3e4a", "comment": "Malware payload (RedLineStealer)", "value": "df630b8c02b02cefb0105a833e894c757c95147b436f8aa385941920f2604174e949ae957b0d7c148ea4d8b35b9a7d9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694706117, "uuid": "300be897-cdd7-4cb8-b149-0b03c9a35cef", "value": "T13A74F1223990D431C2E75138D534C6F1AD2FBC2BA7A8969B37542F6F3D362926766303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694706117, "uuid": "f77b4f2b-e49d-4ce3-a16b-6dab501c54ab", "value": "b240da42760a8c87cea3a4ff648819c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694706117, "uuid": "69fc4fcf-db2e-4d7c-b853-2ac114628263", "value": "6144:nKxLFfxiiTgnHsj2sUvVE5U1/LpseizXgGEoDCDNtouiLqLTh4:KxxpiikHsjJ2VsiyNtEoDcNKuhfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694706117, "uuid": "7465efed-621d-49c2-b98c-a1a9be521438", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694706117, "uuid": "c4ef5281-a5f8-4dfb-8936-230df32aca5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694706117, "uuid": "7ff9207c-6e09-4d2a-856e-df36815b25cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c4439a-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694703283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703283, "uuid": "5ae25ce4-59ee-44cb-86e2-a93b2e3ac0cf", "comment": "Malware payload (AgentTesla)", "value": "6759786b3261da3fba42cfd1df7d8445", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703283, "uuid": "68d39c7f-95d6-4c78-978b-94365cc15d83", "comment": "Malware payload (AgentTesla)", "value": "19c0e86a132c015604d28a1871a3dacd60f7791896da6225bcb783a4543d7f2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703283, "uuid": "6d6f9135-9a34-4ce0-b6de-82ff36f6684c", "comment": "Malware payload (AgentTesla)", "value": "849e1c478a8e349817963b2529a86ed29b5e1548", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703283, "uuid": "df122e04-2e95-49e5-906d-4b421cba77b1", "comment": "Malware payload (AgentTesla)", "value": "e938d10fbf5a516f0e1ca5bbcb863b9f0f187152b5b75164cd7a0512701972456aa3e68702c283940e6b609c7b199111", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703283, "uuid": "54c8480a-48fa-4ab7-bbc4-0d09b386a1ef", "value": "T1BFD42369DE0E36683B1CABAD87415B17FB5093BE99089708C0337BD487E488D770EE48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703283, "uuid": "8dd223f0-feb9-4267-92a2-4d8695d2f103", "value": "12288:DiqGl0S+KspSxsNVL6SAuskDkP9NuLp8/CCtxtg8e6hjQQ/pAexI/FDUo/pgAPxU:00S+KPsNTnshP95tNjh/pA7DrpL90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703283, "uuid": "82abeb6b-389a-4afb-9472-95f62bc62756", "value": 645588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703283, "uuid": "033dcf0d-0c4a-49b5-83ed-c191028829f7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703283, "uuid": "820821a8-eeec-49cc-82e1-5fe128d9c9ec", "value": "G\u00f6nderilen \u00f6demeyi onaylay\u0131n_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24c5dbc-52ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694660841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694660841, "uuid": "9dea4493-9dc5-47f4-9b1e-96bb804fb4dc", "comment": "Malware payload (njrat)", "value": "52884c1cab64fce4ebf6bac9dd66b0d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694660841, "uuid": "460864fa-dfda-4cf6-a2f4-4d5dcafabcc5", "comment": "Malware payload (njrat)", "value": "1a2c4455849c0b9c3b3b9a3babe3774b2cf2628ebaf8b10ea555d487b0f7ac93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694660841, "uuid": "504ca035-d38f-4bfa-abeb-462c400c9f24", "comment": "Malware payload (njrat)", "value": "6c764b9f987718bfbdc1be40593aaa7b93dedcf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694660841, "uuid": "03184392-7c42-4d57-b99b-08a4f4bc3d1c", "comment": "Malware payload (njrat)", "value": "a98850eaad89bc0630d72c798bd0be34f8f5186b9a80a858e2567b7a0bff5580ee27adde50ebddd4f51c281a560891ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694660841, "uuid": "148513ca-e11f-4fb4-af93-10533ea69e3c", "value": "T1D6E2F7467BE98215D6BC5AF88CB313214772E3838532EB6F5CDC88CA4B676D00645EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694660841, "uuid": "8078ab86-d084-4496-8a64-c88f3a18397f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694660841, "uuid": "21ec5c4e-644c-43eb-8e65-2edf77974b43", "value": "384:x0bUe5XB4e0XiODzw0Q0mS03AWTxtTUFQqzF+ObbV:qT9BuBY55dYbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694660841, "uuid": "2e41d511-ac7b-4665-9362-2ced4b186594", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694660841, "uuid": "9477d461-4bf1-445a-87a5-9e7e4aa2d7c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694660841, "uuid": "582a2a5a-41a5-4c76-a955-3b71e2042ca1", "value": "bPHF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063e1766-5300-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694697006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697006, "uuid": "b3f47e3f-43e1-406e-b63e-3cec1318e979", "comment": "Malware payload", "value": "46253bb4efb2556b8a79354480163022", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697006, "uuid": "6526f3d2-5549-4bc2-a77e-695707d090f4", "comment": "Malware payload", "value": "1cbe24254f9476540903147f75a7b66280d7a93453e7b014aa4d3dbeb8d1440c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697006, "uuid": "81f9a9f2-3e56-410b-a4ac-75f961e9aa78", "comment": "Malware payload", "value": "f7bf5abe91e9e6a1a5e2fefd576bccdd34c1c372", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697006, "uuid": "7377b84a-95b5-487e-b1e2-163c79aa4b5b", "comment": "Malware payload", "value": "9bcfb27aec2e5281994d44fa0636ed595a36ee4f373fc4feb02fe0a9187589e11fa33228f36761c066649451b361570f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697006, "uuid": "7e72eaf9-0033-45ac-bbca-f6d6b8e7066b", "value": "T1B3856D22AA40A63AC19F0D3D89355E155D3EBBD366139C4A77F48C5C8F251832EBF24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697006, "uuid": "21be5864-e2f5-4feb-ad41-56a154e36c72", "value": "fd371c5ba0e9f0dbe6188d630437d228", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697006, "uuid": "7336eb78-652c-4bbb-8e34-3fd6428b0c81", "value": "24576:2GrkG1xlqft87sRFivLhRJj6kbD++87/pYH/K8ORlaNYu5T9PbXNTV:2GNlIm7s8j3DATflWT9PbXxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694697006, "uuid": "6431854a-74d3-47eb-8894-5aed34817e2f", "value": 1781760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694697006, "uuid": "e3bcac09-eaf5-437e-97ab-1dad9a70b638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697006, "uuid": "a0a115c9-ec62-4d03-a61f-92130f96a497", "value": "1cbe24254f9476540903147f75a7b66280d7a93453e7b014aa4d3dbeb8d1440c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91ff54c-52f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694692179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692179, "uuid": "955b6a95-8260-4f5d-854f-ee148e257436", "comment": "Malware payload (RedLineStealer)", "value": "f271cdc7b55710c256bb9e8b37041a2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692179, "uuid": "a3bfadd1-49ba-4e75-895c-dadad6f0d6a2", "comment": "Malware payload (RedLineStealer)", "value": "20b9457fbd3b81996eb9283d1eea3b6da2cf2045a2b7c872540edece5bb3b0e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692179, "uuid": "36cae5f3-5763-4480-8a7b-be4a1d1cd870", "comment": "Malware payload (RedLineStealer)", "value": "de1d80404a7fed0d6b7145493d87df5167d41807", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692179, "uuid": "8d70028a-0742-40e6-be8b-3f5887539041", "comment": "Malware payload (RedLineStealer)", "value": "3f78d633a17b61d785783576475cff4df6d2b15584411954ab0e1feef5f46e72879986c6200d17dd6b58befa98dea6c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692179, "uuid": "b1f7dbee-5a39-4f07-87a8-07e6c5ef3588", "value": "T1A836232B27710109E1D5DC3E8E33FEB533FE47273B52B87DA5886AC126164E46603A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692179, "uuid": "be3dfa44-487b-446f-9364-e17d1f291c05", "value": "de8af78b3569eb79f0a43010a95e85a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692179, "uuid": "8ef461ed-9c6e-41b6-aee8-24f92e7a69c6", "value": "98304:Yeg9zmoP79ho/4m6X+PFmKlCbfNhOpy6iAix7Y1gimPc:YDzmoD9ho/HPwuCbfrOpy6iFuPmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694692179, "uuid": "a01a4200-4c2d-471a-b4b5-931755474ba2", "value": 5049496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694692179, "uuid": "34546270-c932-4802-9318-8edf7e3b76c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692179, "uuid": "68cf26f6-4f56-41f8-be67-4013febcd3ba", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1304159.28480.19940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79e6791-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1694703290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703290, "uuid": "5e314fb2-6feb-427d-8dde-78d617d2a356", "comment": "Malware payload (XWorm)", "value": "0e1fbdce807fa4142c845a0a9f16ce9d", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703290, "uuid": "cfbb0cce-fc06-40a8-ad6d-3d58d275a368", "comment": "Malware payload (XWorm)", "value": "21432bcec2d1df855e85a64b3bfbcae8f5031ce449f2c4652076db7bdea375a2", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703290, "uuid": "1922d51a-f256-40ae-a493-778d1702e2d6", "comment": "Malware payload (XWorm)", "value": "8a5ec3a2e03553d23a3327a1667908737851f114", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703290, "uuid": "9dc25b0e-8dcf-4e9a-b1dd-f28f0e324743", "comment": "Malware payload (XWorm)", "value": "54f2340997ef35307016cadc6bbf913a6bcae90b2b631b7efa89dbca7757788e810d5f1334aa12b6a37496ed173774d4", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703290, "uuid": "0317f22c-d133-4225-8eb2-29b41ec80693", "value": "T12DB42337EDC84845A34937306C0AF65DA4F15E4A028592EE7CB997C212FF58E4AE58CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703290, "uuid": "251af5c6-9ba8-43f3-a3b9-1f002cce1a3b", "value": "12288:Fn6x51mPn/zGka3eYxzL6cZE8TE/v29SgYh6mKNGCpdwnyyjkg:F6mPnbkVxzGcKksu9S3h6mEGUdpyj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703290, "uuid": "69c7f466-5669-4297-8d1d-139535f01e6d", "value": 514141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703290, "uuid": "8174aa88-4338-4903-a5ea-cf61f07399c5", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703290, "uuid": "49506cd9-6d1a-415f-8fa9-02c414ac7915", "value": "PO Order Listed PDF_1.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a78c491-52c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694673095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694673095, "uuid": "bc2f0c7c-d71f-4336-ba5d-065f7e3306f6", "comment": "Malware payload (RedLineStealer)", "value": "cbcfab67801be2dead743d26a73b64eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694673095, "uuid": "e3df6ec4-6e30-471d-8242-31fd179df0de", "comment": "Malware payload (RedLineStealer)", "value": "2469e6632620289532f08e8aead0f39433c1a9ae98aa0440a9f70d93cfa7176c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694673095, "uuid": "f1ba023f-c9b1-4dcc-97a0-59f7589bf414", "comment": "Malware payload (RedLineStealer)", "value": "c35452420444ed456e7a174c8ad1aa2d2138840a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694673095, "uuid": "6d3c61fb-0fd9-4492-ad26-c408beb3e713", "comment": "Malware payload (RedLineStealer)", "value": "4c21972d668137f2824f7081be5af137761ff4758839dd146419b4db3750c9a474900b1026cf8e780d2673fcaa66f268", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694673095, "uuid": "4199e640-229c-4f2d-9e1a-739e91b1e8a7", "value": "T118151262B0C18072E1B2C63548E4AB74977DF4D10B599EFF97980B7F4B6D2C2CA32616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694673095, "uuid": "51fd5c42-cf8a-4951-91d0-a52077562f5d", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694673095, "uuid": "db15ab93-9e69-4c6c-9a82-f827977f92e2", "value": "24576:6iuBtZZ1sPM3CZZ1h0K3Ege+i6luNWo9u3Hw:RuBfZSL1hFEJ6luwdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694673095, "uuid": "60e1113e-0960-421e-9876-b9c3ed583011", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694673095, "uuid": "baabe77e-e429-49f5-a00c-923a3ea6bd88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694673095, "uuid": "786f6d39-acae-4aec-88e8-335d58ec5e6d", "value": "SecuriteInfo.com.Trojan.Inject4.61027.1808.383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3f5d40-5310-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694704242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704242, "uuid": "963b0c37-bf64-4008-85f5-d7b19107238e", "comment": "Malware payload (Mirai)", "value": "25ff57b8713ca3f441ff08ef76b1c0fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704242, "uuid": "b27650bb-0b8b-4886-a5e4-f85a8fb36455", "comment": "Malware payload (Mirai)", "value": "24aa8c11a1b0c4732ad2a1a50b702b7352554512054209421d16e2cd5a9ca3ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704242, "uuid": "f766f594-544b-4979-ac72-a2b29f064e2e", "comment": "Malware payload (Mirai)", "value": "df532979b828484cd7699aa2b0d60f41dc622271", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704242, "uuid": "91df52e0-9565-4d5a-8d9b-46dbb8effdd1", "comment": "Malware payload (Mirai)", "value": "462c5d88289de7630bb112d287453be1e476d3738d1945130e13634a679bbf1eb3c2653b4954b837989bd7964716bbf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704242, "uuid": "09b55a1e-16ec-4ec8-a641-5203e5a858d5", "value": "T1B1A2E11072632D56E3ED1C3DC96E835BF9A71BFC80F6327639415620C94D20A2E39A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704242, "uuid": "bdc48e03-15b4-4508-8323-3afb7c292566", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjEUbhymdGUop5hi:UvQn4j+ZO5fKAlxHbs3UozI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704242, "uuid": "f6647065-4d1c-4311-99ef-d97d7046963c", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704242, "uuid": "2a4009aa-d3ab-4bcb-b7cf-3a247c368d0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704242, "uuid": "3145c99d-bf13-4a11-8188-e240615bb558", "value": "25ff57b8713ca3f441ff08ef76b1c0fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d78664-529f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694655695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694655695, "uuid": "a5110195-6ce3-4a44-be06-b6329fd02df8", "comment": "Malware payload (AgentTesla)", "value": "38535f26390e9fea654aadb0d1ccda38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694655695, "uuid": "ced48364-c8b5-4df0-88b3-e47aa80bff8b", "comment": "Malware payload (AgentTesla)", "value": "24efcf6d1445b024b88fa6516cdd9ac045b7aec2a7a1fcd487f851799e06ad11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694655695, "uuid": "0ad837ee-f097-4bb4-9623-ff8c7e7ec584", "comment": "Malware payload (AgentTesla)", "value": "1e398b21de61cd3eec9672ba2b4ae24a53ef74fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694655695, "uuid": "a3ca3bcb-6334-4b94-91c0-250ef4c15b01", "comment": "Malware payload (AgentTesla)", "value": "d27f20173909ff8feaf5790358a6665b7497fb7be8f92161806396c7e8e6113802edfd7b5887da9ed5cf89306f4c6a42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694655695, "uuid": "3883e19e-6e41-4095-87bc-96ce8a972ad0", "value": "T106E401637A01EFADC63BC7F63C2596024662ED0E9810D74899CAB1F65C71713907AF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694655695, "uuid": "24449bdc-3a62-453b-90ce-85b8b4ecdf5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694655695, "uuid": "99c30532-c872-4124-95b1-74240792daad", "value": "12288:LSVPYyVFwYj21622H2Vx3Vg6WzNc9G12Vu48SOHU/5w:Log+Fla6d2g4LVxuHY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694655695, "uuid": "9482ef59-3074-4d3a-8e39-d4b71a27ca92", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694655695, "uuid": "4ea8afac-04ae-423d-a4c6-4b4178bb2362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694655695, "uuid": "559aa6ee-fe7b-42a2-bd02-692d8d408d1b", "value": "38535f26390e9fea654aadb0d1ccda38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c443415a-52b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694662965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694662965, "uuid": "6382d94c-8ef7-4c39-9ffa-f3fa5d7081b6", "comment": "Malware payload (AgentTesla)", "value": "ef31d3507f2d0107c818416a2c8c4ad3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694662965, "uuid": "af759c5b-a594-4004-b0ef-32f819863099", "comment": "Malware payload (AgentTesla)", "value": "258ba2294b8ea19b823246636fa593aad790a7cd333eeec5510f9b3642937a0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694662965, "uuid": "6561c663-8ecc-4985-b1a2-145ca018c750", "comment": "Malware payload (AgentTesla)", "value": "3a692313771549ca8749b2f04629b39ea86a6beb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694662965, "uuid": "4eb7c5c2-5e81-4d5a-b8a6-a5a7cbd2ae15", "comment": "Malware payload (AgentTesla)", "value": "a124193eef4bb3f49646718e246d59964c0f05b79e0ddf4846635d8c4c612a826d028c1cebedccc81c1a9b733e386ad3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694662965, "uuid": "cef98df3-1f33-4ab2-8d86-a6192aa361a8", "value": "T18734FE137E48EB56D6583D3BC2DF2D2413F2A0C71673A60BAF48AE6565412837C6E36C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694662965, "uuid": "2c717d52-4df1-4e99-abd9-2a57075aded6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694662965, "uuid": "c298faa2-5364-446e-a02b-dacefb4cdc3b", "value": "3072:EGZtLz5zFd6FYtuGD/f/zquSorajkYoskZpI2kjF:EGZNxWFYtuGjXzhu72g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694662965, "uuid": "3b29ddd9-aeba-472c-8605-6910d4e81cb9", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694662965, "uuid": "482dddfc-8642-445c-9061-988c53500690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694662965, "uuid": "4ca4187f-8722-4f39-b9ab-9d4163a83797", "value": "decode_aa158ece3749d5549f3c6680e33b8bc17af98a17ab52c4ccb24f6ee5efad4fa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcc3a02-5292-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694650066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650066, "uuid": "5298f7aa-ad57-426a-b092-11d1ed270a2e", "comment": "Malware payload (Mirai)", "value": "c400f32af96a250011ae3cc85ab6290d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650066, "uuid": "517adca0-7142-4bd2-916a-d2a7a4e041be", "comment": "Malware payload (Mirai)", "value": "275410d52a585d84aa43338cf0b91842dd71cb0fd3bd010008864ef4f1fe4aa3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650066, "uuid": "b5e4295a-33cf-4e9e-9c40-f5860bf6386c", "comment": "Malware payload (Mirai)", "value": "b80a5670d48b377757b5c9db1d79963d199219ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650066, "uuid": "fec0d4c0-3ce0-4ed2-967b-b751373a2cec", "comment": "Malware payload (Mirai)", "value": "cb5854975abe66fd0e11cb580095e9582d0131242dcfebe0428aec572783cd63fa244b30286ca4531b78f10ae5d99d33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650066, "uuid": "b5b2c9df-e2e8-45d9-ae50-43a558807263", "value": "T112830A95BC818A11C5D813BAF92E018E332267E8E3DF72169D205F2477CA92F0E7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650066, "uuid": "02ef3628-8b2d-4d10-9a85-2ba6dcab532f", "value": "1536:aUnnPM9miB3/SfboltisGSEILicNG6G1X0Rw6y5zpZ51Lhuc6BIbiQaUDGWbEfs:O9NjtfzEILiMFGVlbZbaUDGWbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694650066, "uuid": "2e78af8e-0f33-4c47-bc45-d4858885b5ff", "value": 87436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694650066, "uuid": "cd266b3d-f961-4719-9fdb-d3a61b7c2785", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650066, "uuid": "0bab5943-da53-4e85-91c1-bfd8f1d791c6", "value": "c400f32af96a250011ae3cc85ab6290d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78915997-5317-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694707076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707076, "uuid": "fe3c38bc-8be7-4ea6-93d4-286d2d14f0ba", "comment": "Malware payload (RedLineStealer)", "value": "3061a52bbd4dc8e82cc8afac74b3bf83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707076, "uuid": "6ea9d62e-f8a8-45b3-90e2-5118c5724dc9", "comment": "Malware payload (RedLineStealer)", "value": "2887eab305741f7baff6b1f780783cb10f3353d1b42a2aec44fc8f0c323d313e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707076, "uuid": "dfd6e2b8-6274-46ec-a99f-ff874c0abbef", "comment": "Malware payload (RedLineStealer)", "value": "16e49f7a5865399ebdd02c10a3e7cb3e5bb6912f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707076, "uuid": "a44a8f5d-91a3-42dd-91d4-e2c82021213d", "comment": "Malware payload (RedLineStealer)", "value": "995ec31728a7588518b0b269225761c3fe523f82b0ff1246b9dadc2c46976575d26e716c8921118205cfc532f77b27f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707076, "uuid": "973b82cc-cdac-4229-94f0-b177558756c4", "value": "T1AC16275176F94B59F7F34EB85ABAA611083AFC69CF11C2DF1251908E0D21AF08971B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707076, "uuid": "5a905b4e-f067-4b26-a74b-8e5064043194", "value": "62020f417898af4db9f3ac5ebd561fe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707076, "uuid": "4ee6fe00-33c2-4161-bdec-c1b99919c4b2", "value": "49152:x9ikGEBjZ+qUG6a3vPrzrpLE6gQ/6lZcGpHPvL0HTT7dVSxq28hxYaAqlLZ1l1:x9ikxUhSntmLkH/7dV328hV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694707076, "uuid": "dfce014b-45cd-43cc-a52f-cee15c301fb3", "value": 4082176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694707076, "uuid": "d8e9421b-9af9-45d3-b201-2190dc3b22fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707076, "uuid": "bce99c79-c0fb-49a4-b3e8-203cdd59013e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666180a4-5324-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694712629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712629, "uuid": "66605186-da39-46a0-8205-9725562e72f2", "comment": "Malware payload (Mirai)", "value": "a454acec69975274d98569e4848319ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712629, "uuid": "42704379-5819-453c-889d-3e08d4ae6534", "comment": "Malware payload (Mirai)", "value": "292a09427e14d8ccf88917493c95ba33ab9cb1126903c72635a3cc7a35499b82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712629, "uuid": "29eef1f9-ee0c-4256-8de3-343ff3cebe5f", "comment": "Malware payload (Mirai)", "value": "88626ed2c7e322609190096fa706ebd3c37672f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712629, "uuid": "ca48e1db-c805-49a5-ac0a-fa33f8da026e", "comment": "Malware payload (Mirai)", "value": "0234006d62b151412dd3a444e57e021a06b17aa47662d774ce2cba30bf301ac7923420852ae77a3a40b536ab203c293f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712629, "uuid": "8bb5e0c8-943d-435f-98d5-c54e01b57f4d", "value": "T176A2E11472A32D56E3ED1C3DC96E8317F9671BFC90F632B679411620C94D24B2E39A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712629, "uuid": "5f4aa3cd-2df6-4d73-ad15-90c541e6af67", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjPchymdGUop5hW:UvQn4j+ZO5fKAlxws3Uozk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694712629, "uuid": "d62c3de1-fee1-43ef-b21e-6299fe2d8714", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694712629, "uuid": "dcee90e5-4625-4ec8-b576-a8691d8a4d56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712629, "uuid": "402dbb13-f136-45aa-a5e9-68d0f9cbc0d1", "value": "a454acec69975274d98569e4848319ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8adada9-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694675938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675938, "uuid": "7f0e3337-7933-4bba-8502-b5216e23df61", "comment": "Malware payload (Mirai)", "value": "0ca389dca08940c3368623017ddb1b93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675938, "uuid": "f24ad82c-de76-45e7-89a5-130f5a3a80ef", "comment": "Malware payload (Mirai)", "value": "2952f7956d8be001ff92fc3b2543fe8844c5eeb6bf9280ba58b18defd2109f6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675938, "uuid": "8591c440-6288-4221-9e6f-8763c39c4a60", "comment": "Malware payload (Mirai)", "value": "fafef5a0a589b40a76072a751ff6140192bb10c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675938, "uuid": "1f98f759-ed51-4024-86a8-7b7a241dcae3", "comment": "Malware payload (Mirai)", "value": "a449c2789f6f4d46eaf4cc4ca8e94717de8d788a01b58a5533eee067f66ba87ba9858b0e6d6055d8a819089fdfe235b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675938, "uuid": "80f11380-6b94-4175-a066-876fd4388043", "value": "T1A4733936F9392A23C0D1A47E11F74B51B6F11BCE36A8C61E7D720E4EEF616506412EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675938, "uuid": "5cbc53eb-4dae-471b-8ad5-b82fa9e51212", "value": "1536:pMsk4f4UnhcUt+Hq/OyFU3+STWJHsujO9uIRcOy:CskY+K/mT+MuWRcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675938, "uuid": "a5aa3993-08be-4015-820c-9f3dc1d4f416", "value": 79792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675938, "uuid": "c507d75b-c89d-4302-8151-007fa7ad1fcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675938, "uuid": "876cf0ba-e40a-4fc1-8e69-393ee44702c8", "value": "0ca389dca08940c3368623017ddb1b93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b194b60-5296-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694651702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694651702, "uuid": "879be6c8-fbbc-4035-8949-58b4f5419015", "comment": "Malware payload (Smoke Loader)", "value": "655655e9b1744d3fc9c5772e7be8a48d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694651702, "uuid": "9282b29a-9027-4785-9629-b2224d2051e2", "comment": "Malware payload (Smoke Loader)", "value": "2a8bad21145b4d758332588fb79ef6bcb2aa95bd7de7a2d8c0777e6f7146b115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694651702, "uuid": "dd66eb0f-43b6-4fda-9f7d-3977b61eea26", "comment": "Malware payload (Smoke Loader)", "value": "3a11602219bbe119e5258ca15ef674735613e293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694651702, "uuid": "a938cb71-6458-4646-a73c-1d4448763c45", "comment": "Malware payload (Smoke Loader)", "value": "c69d03f3715398001be63c01873965cd82532cd6eac04f9a17371c7a810ae35eab0e287b72531702ccb37fe3b4ed845f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694651702, "uuid": "6eb1a28c-0541-404a-bfff-2b9eb5db3176", "value": "T1E7644B03AF91BC61E5264A728E1EC6E83B4EF950CF797F971258EE2F09B01B1C162715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694651702, "uuid": "c37185a5-72e6-430d-9f35-487548d4f87a", "value": "21da461f3efed5a7777f903bfcf58d74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694651702, "uuid": "38971499-ad47-4f99-9a22-1ca1bc79cd60", "value": "3072:U8aVnLG89UmwOTTk9Uhjlsm7yCKYmGV/6CWi0hHp0eUkqlK/Yg3:s9h9UmwOTTkSPTcIkG8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694651702, "uuid": "6b0491c8-a36e-4023-821e-ad22a8e438e4", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694651702, "uuid": "65ac3955-4146-4d1c-af83-6719eac11e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694651702, "uuid": "ee2e08e6-4e7f-40f4-93e8-c6747e03d6cc", "value": "SecuriteInfo.com.Win32.PWSX-gen.23908.1674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d056fcee-52db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694681454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681454, "uuid": "7921bd75-45d3-4898-89b5-a055db623b8e", "comment": "Malware payload (BumbleBee)", "value": "45f4c6ea59bc7a8c2d20098698104940", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681454, "uuid": "9e2249f7-ec3c-494a-b59e-f0f619275b79", "comment": "Malware payload (BumbleBee)", "value": "2aae03be2893a2d742528bbd737b4195d84f6d3663e9eeff8c646c53675d7838", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681454, "uuid": "35c84182-1723-4946-aa97-22abcb79725f", "comment": "Malware payload (BumbleBee)", "value": "08b4a0c8d7824a0dbd89680a70f3029355cfafea", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681454, "uuid": "26ccf5ec-0ed6-48c9-a634-8b5f10af1928", "comment": "Malware payload (BumbleBee)", "value": "d89f92ebaa3594cf55b8e2563680b4a9d764fd476de64cb41f7004039d6a1601b674dae0889db3e76a7a0f2e57d68fec", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681454, "uuid": "93cd8650-ea27-4c7c-9ad7-67fd487c1672", "value": "T18B35BE71A27AA677F737F53B08BEF83A561035E66173BB57101536830072682EEC760A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681454, "uuid": "2abfd459-94fc-4add-b6b4-61c4ee070b47", "value": "660e4ba65070c42e55f04efddf5f7d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681454, "uuid": "f54f3f17-2558-420f-a455-97fb948764e4", "value": "12288:yh/mUxV9yUJLB9hbJGk01nVJT24GUhKnsHwuDVPVIzI2mxFfokvqRLKAV55PH:yh/nBB9hSZGAwysoxFfooqRLb55P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694681454, "uuid": "f378c8a1-665d-4952-90f6-b13abec4bfeb", "value": 1119744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694681454, "uuid": "3b4eff86-f1ea-41a2-be4e-6b10993039f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681454, "uuid": "5180f050-5004-4c26-9b07-580c9ed70df0", "value": "45f4c6ea59bc7a8c2d20098698104940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb289d9-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694703302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703302, "uuid": "5519e235-9ec0-4006-9564-34270dffb534", "comment": "Malware payload (RedLineStealer)", "value": "42bca34183115d29155eeb26a0e9e4a5", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703302, "uuid": "525b92ab-3fd3-4ae4-b5b9-42d0c92747a8", "comment": "Malware payload (RedLineStealer)", "value": "2b7ce1a4dc8aca3d495ad5ce3ce2798399830b626c433389335cef92fb951b73", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703302, "uuid": "5833c3e5-9686-40ca-ab7c-985067aac25c", "comment": "Malware payload (RedLineStealer)", "value": "31bc4f27a56107752946dd1f1bbb0ee15246b207", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703302, "uuid": "844f4efd-0398-4421-a99e-a4edc83dcdd1", "comment": "Malware payload (RedLineStealer)", "value": "f911b985acb9a171cf58990d6635e39b529b2cf15c7343355f842606947ff9fa06b163a2acf6695cd7258b7455bde069", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703302, "uuid": "c7cd3f1a-4d18-4498-881b-f764f46873f3", "value": "T17FB30251D00B6CACB2E91092853BD458B1938FD943E77AD538EF3854F923A9D48C8DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703302, "uuid": "cb296c2f-61ad-4205-8e5e-bcd9fe7dc26f", "value": "3072:csp2h0LX++FP4aa9WznuZZOO82yTuLxnxYy:cmEgXfw0zuZZd822u9Sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703302, "uuid": "bd271380-9e52-486f-ae55-722a23943271", "value": 109616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703302, "uuid": "563e6db4-dac1-4b83-93a2-d338bf036fcc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703302, "uuid": "23514544-696e-44b5-be73-6243b39e7064", "value": "\u00dcr\u00fcn%00% Fiyat ve stok 28410 23.0 & 34.0 gr. W051 pd.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f04805-5292-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694650080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650080, "uuid": "b0232673-c9da-4525-91c4-822d62f26d91", "comment": "Malware payload (Mirai)", "value": "347473312fb02fca85ba9be0dff342cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650080, "uuid": "617e3b0c-f144-45ff-9e25-c9b6c5628d33", "comment": "Malware payload (Mirai)", "value": "2c010304d5df79cc40e27e3c82d529914564b69b15dc4c9fb24da4edeebdab13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650080, "uuid": "90f93fc3-afba-47d4-ae69-6d0365be7c29", "comment": "Malware payload (Mirai)", "value": "6bfa115059acfa350070b55b439beedea2a0a7b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650080, "uuid": "dc72d4d5-aafe-4e1f-99a8-9abf3b246d04", "comment": "Malware payload (Mirai)", "value": "3792a27b0ea720dbd242aec92ee934e678e45a3be9faa577c0e98a846a24b375bb218457d15846a6df2641020d1b3da4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650080, "uuid": "77f2c124-cb75-48cc-9aed-646b959be4a2", "value": "T1A763AE25E0058950C4864238B4E6CE751F63FCC483BB5EB6AAD581AB1447EF8F61CFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650080, "uuid": "33a2553c-4a58-4b46-a72f-190566cbce9f", "value": "1536:maPx+NOqFLF+wtHRHT11fIL/N3zqwT+UtSCzP:mrNOqFLsW1txwSUtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694650080, "uuid": "46c3488d-5863-4f95-9e07-56ff09fc3ee0", "value": 70648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694650080, "uuid": "d6ae02bd-2281-4e66-9421-36a4ec391176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650080, "uuid": "5ff78258-af09-4ab3-8d98-bd32a8ff94ea", "value": "347473312fb02fca85ba9be0dff342cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f841d53-5293-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694650314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650314, "uuid": "51cf173f-99e8-4e10-a77f-203d2114d2e2", "comment": "Malware payload", "value": "56bee14eeb229b6012d2c0eaaa7e083b", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650314, "uuid": "f6861c90-054d-4ac3-9c3e-57504cb9db06", "comment": "Malware payload", "value": "2c2c252d5fae28b23d1ee760ad6d9499573188c32ceb947df0da1a3600841ee2", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650314, "uuid": "d4fdd790-c57b-491a-a541-f2ade5c47c68", "comment": "Malware payload", "value": "b5c4fb415cb0690cbbd702238cfac44552f4655a", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650314, "uuid": "afac5dbd-cb65-4ed1-853b-a7be19dc9c3f", "comment": "Malware payload", "value": "26cd9855e7cccde0c144616dd8642fa637405962a25681b8dfb1259bea5b05f5c34ffbee6b84de6a5efc97e8110f005f", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650314, "uuid": "270f5a00-a408-4e54-839f-e1a1d3b8490f", "value": "T12BC533CC0CD42EB9D16C7F70108BDEBD12A77B55BAE5F265A17609203EEB5F8848602C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650314, "uuid": "bacee6dd-38b2-48f3-8ad2-809d3232f2b3", "value": "49152:r8sL3HYZucJ34vR7B4ezGJZBORR7ZH1FkOMb+HF6s0p6RBJp6RB9hMGrPv:ZoocWvxBiSlZH1eOmwF6Vp6Rnp6RHhxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694650314, "uuid": "95cb640f-58a3-45cc-9e86-90d8b60c19e3", "value": 2525099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694650314, "uuid": "340f2e82-c7aa-4087-8be0-0affafe6c3df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650314, "uuid": "ed4baddc-b91d-4e6e-a704-be14b7047236", "value": "ens-1594(msx).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b41d9c-52d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1694680221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694680221, "uuid": "d5056222-0ffd-4c50-b29a-4b651d44517b", "comment": "Malware payload (Tofsee)", "value": "f1941e95e5a1404dee69e7f6c38955b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694680221, "uuid": "0101cb0d-57a1-4905-b91f-eecd4edd0da9", "comment": "Malware payload (Tofsee)", "value": "2d8f3128585b01dde510e8c05b14f09e64329fa9bb18d78987f517aa452deec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694680221, "uuid": "95731486-6525-4943-97cb-1505a9235f23", "comment": "Malware payload (Tofsee)", "value": "ba9bd4374d1553b0b809b05dbe3f88508c2d7924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694680221, "uuid": "b8eec90d-9a29-4c86-8fb7-1d9d0a007414", "comment": "Malware payload (Tofsee)", "value": "44fddc55b3ea8545c0fac2da9099fa1d3fe76df0a75719a0228f23f6e60300e79836652435b08e61182540b8fee40cf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694680221, "uuid": "4d3e5e22-2c93-4de7-98dd-1b99902c4149", "value": "T1CF14BF0639A1E072D4A78134DC78D6E42B7BBC23AA75454B37643FAF3E313926B65342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694680221, "uuid": "b7e588b3-abea-4f3b-a69e-ab97e0d0c586", "value": "ef163fd1a1dfd01940ab083fe4660afa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694680221, "uuid": "b168694a-4c12-4a66-894d-ceb20ef6a803", "value": "3072:+5hefL6u3Jq8UENcOtoI7/j3vvn8+Ac7VRTNvk56ye0T3d4P:YefL6cYTC/jnpAc7VRhDd0Tt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694680221, "uuid": "cd7a0ee1-43fc-4f86-acb7-f1046d7c6087", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694680221, "uuid": "fbacc52a-0ee1-4c78-b043-47881f9398c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694680221, "uuid": "6511d546-bd20-4c1e-ac6f-c9da10f05cd5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e6735f-52e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694687530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687530, "uuid": "ae3a0242-9a37-40d9-b30d-065e76b60208", "comment": "Malware payload (AgentTesla)", "value": "5f7e0aa7cf90db6005497435f76dfa6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687530, "uuid": "a4b9682c-1de5-4e82-bbda-6a1dd3d7a45f", "comment": "Malware payload (AgentTesla)", "value": "2ec423eecd97dea1a598263faf7c83c09181f55524dde32011c8f14b1c004f48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687530, "uuid": "f437d376-d7fa-4afe-aba7-14ae3b200783", "comment": "Malware payload (AgentTesla)", "value": "507e98425ffcaa648499b0a084dfd7f1709d787c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687530, "uuid": "c88f93b8-82fd-4d5b-8eac-ccb98ed686ff", "comment": "Malware payload (AgentTesla)", "value": "976229d70af162592b56546ff4dc7ea9aa69fcb80461f5fa04bab052558bf5ddd823f57bef9655959994eb2cbcedfcfb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687530, "uuid": "932782f4-6fab-44f0-a90a-50f1213aa3aa", "value": "T10CB49D9DB65075DFC897C976CEA41C64EA60B4BB530BD303A41326AD9A0DA9BCF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687530, "uuid": "267ed920-054b-486e-8e83-5bd7f5852dbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687530, "uuid": "39e0cf49-4967-4210-9f87-2a37a0a39f89", "value": "12288:RX6JedM3HMhamvGZDBL+HxhtPn4VsZ2MIrvYTjO4rW:MJed8sEjU3tC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694687530, "uuid": "9314b0ee-32f4-412e-b726-50217c8cb4a4", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694687530, "uuid": "9bd09fcc-a5cb-4536-b386-45ef053135a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687530, "uuid": "48579c36-7381-430a-aa1d-f1b25583306c", "value": "CI & PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a6a3ab-5311-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Metamorfo)", "timestamp": 1694704432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704432, "uuid": "4d6851c2-9581-468c-a9fb-e17e83ca58b2", "comment": "Malware payload (Metamorfo)", "value": "83ac0d9a37ebf6e54934790466acf908", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704432, "uuid": "0acc925f-c0de-489b-af0e-9dcc951465ec", "comment": "Malware payload (Metamorfo)", "value": "2f022086614603e14c352bfc6c3d5da150c5bac59613f1b2d5b72ee8905ba167", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704432, "uuid": "59b4f358-6d19-468e-acfe-40358506d4d2", "comment": "Malware payload (Metamorfo)", "value": "27a9268eb2a3046a3fb2d65b5ab4ec4b310fbb61", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704432, "uuid": "51bd7565-b9c1-4ffd-85d5-f03584df8843", "comment": "Malware payload (Metamorfo)", "value": "2a6c22a164e60a66f84c5ee6e844ff631f84263eb3189bcf5d3f2d5053f786143af599617e414c2aaaf6c43b57de2429", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704432, "uuid": "6f23c165-6ec5-4b0d-9456-1857fa1d8670", "value": "T1BCB4E007B2D54B77E4D70372179B93628F72EC348762812B1299750E2EF16A4B7A33E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704432, "uuid": "16c50495-67de-4eb8-84f2-160d89bb1859", "value": "12288:fGk8sY5AITqp4nbIrKPzfGXSjptsrYI21wlD:fGk8sY5Azp4bIpXSjp2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704432, "uuid": "9e98f5a0-cb52-47ce-b403-3e1d865e7a02", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704432, "uuid": "c5fe4a41-fc8e-48a0-a901-8d7405c29ebe", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704432, "uuid": "a9cb8978-369c-4fd0-9934-931cc657bef2", "value": "NOT110923.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb543d3-5320-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694710927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710927, "uuid": "d6c5eea8-33ff-4e14-8dd1-bda9823ef6b1", "comment": "Malware payload", "value": "070c3a7209bef3933df6072d39590614", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710927, "uuid": "218f2bfb-157f-4dcf-b615-151261f790b7", "comment": "Malware payload", "value": "305d84e55287d9df2e1037340a32f712fec785c67416508044dff4f5db0b2e66", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710927, "uuid": "53819eb1-d931-4808-bd55-79b3f672bb31", "comment": "Malware payload", "value": "91f4112e68399b29c6263588580083c8ddb43c27", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710927, "uuid": "7b2daa7b-41b4-456a-a7fe-cc446d4922ac", "comment": "Malware payload", "value": "a48ad931e0db56d88c2e63c1251c0e4555eefedb864834afd2310eeb64c41d39e42333dd9b958485cc2699fc2dadf407", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710927, "uuid": "30421749-0dfc-43f8-9f0b-3c3cc16b3c5a", "value": "T11F456BC35CCCB682C71982B7EB17F8ED0A3BFE4D948524C63575EA4A2A331AD5C36065", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710927, "uuid": "3aa1ee00-d2e9-419c-a082-22cbfd9224eb", "value": "24576:SWQmmav30xSZy6w6Va6N/EZyLw6Vi6NMURnFQkTQhJvy/Cw+p:XQmmQ306+6VTMP6VLXFbTyy6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694710927, "uuid": "196a158a-c9d1-45e9-ac78-c7bc334f4d14", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694710927, "uuid": "2dbc58f5-db44-4e83-be32-b303661da1eb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710927, "uuid": "88a747ac-6acf-4ee1-b35c-e7f01228ee28", "value": "SWIFT_221036299-043825-sanlccjavap0004-6.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81c5bfe-52e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694683668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683668, "uuid": "b8a9868e-924c-4ace-bee5-b046ad1fc79c", "comment": "Malware payload (AgentTesla)", "value": "3942b37296263a608c746eb06574427d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683668, "uuid": "5f62be8a-8ca2-4c7b-86e5-97212c273c70", "comment": "Malware payload (AgentTesla)", "value": "312725334752c3728679010798e68be9b562765a32a9813258323885e732f010", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683668, "uuid": "70ea4df4-df79-46b6-be3c-a1794f590ac0", "comment": "Malware payload (AgentTesla)", "value": "ca7c1aab5af334ac357d11523b2d414c54fe5689", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683668, "uuid": "1252c5cc-55ec-4baa-b2e3-63847d692283", "comment": "Malware payload (AgentTesla)", "value": "8e6fd6913bc27d1e5dd506e0a2856587227c0b9185a5162c3ce7a61d6c3f096d6aa20982255f5705fdc8c53457d58338", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683668, "uuid": "ee2bdf26-b356-4c52-88fc-3b2a06d1620b", "value": "T122246A74A1F16ACEE896CEB28E60E919FFE71C519A05420FD13239F6553BB85C6040FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683668, "uuid": "a42ca9fe-0bde-4ef6-a58f-ce678ab3caa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683668, "uuid": "596a582c-2a30-4b02-b908-b21c310a92f9", "value": "3072:gDxQNQ/ZrC9RwbulLr5Lb71hEbaFSkjiRrPY:gDxQNQ/ZrKubaLr5L6a+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694683668, "uuid": "bcf90533-a17e-4041-8808-776d8834baf3", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694683668, "uuid": "1544b01a-8187-4e48-a3c3-06a64baf2717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683668, "uuid": "7534635d-3ee4-4293-a731-4517ac55c028", "value": "PO 9632 CARINA HOMEGOODS,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2229b2f-5298-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694652627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694652627, "uuid": "fce00c89-3a94-4dc4-92ca-a4b12dcbd1ad", "comment": "Malware payload (Formbook)", "value": "03e76b7a2245db6a2b342dae3fb3c7ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694652627, "uuid": "d9d1dc52-d744-4606-8fd7-000dac803fde", "comment": "Malware payload (Formbook)", "value": "314b0463e6de6de56467f023dd2ddbf799d883e2e65552ddf2b87f607eedc5ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694652627, "uuid": "bc596ca1-bf2c-478f-9ea4-9c04bd8bfe24", "comment": "Malware payload (Formbook)", "value": "028f49426cb8c0bf4979d6fa925177776b11effc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694652627, "uuid": "ca4275e1-18d8-4358-8cff-48d13e9cd5ec", "comment": "Malware payload (Formbook)", "value": "2162cdc1bed222ada744805245c7a259ec7c659c3121669ade2bc428d3f7e7cc64aea1f4c4f904916813c05bf0e92316", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694652627, "uuid": "6e6f7821-1a38-4b10-b17f-7b29e3784147", "value": "T10B74231479D0CEB7EBDE827508FE9B6E5BBB4A09116857C72720E70EB971641E80D332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694652627, "uuid": "8d71e6ce-8d92-4b63-a571-98ed8f88c71d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694652627, "uuid": "b895d285-b227-432e-8438-a39e8aabdcc9", "value": "6144:/Ya62mLcoET7vzuevY/XCOkFwUnUkYYD0k5LIb93y71avPgVIqVow:/YYmQTzwRgw9HYD7LIb9CBavP3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694652627, "uuid": "78e23a76-246c-4e2e-b0aa-da89ca2e3dca", "value": 368618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694652627, "uuid": "b8d35da1-66b2-4d4c-9e28-63c7569428e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694652627, "uuid": "6713b395-e4c6-4a0d-8013-9b2b22d0ebc8", "value": "03e76b7a2245db6a2b342dae3fb3c7ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b40a4b-5324-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694712662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712662, "uuid": "a9fdaab7-693d-42e2-b4d5-c2b3c49627ff", "comment": "Malware payload (Mirai)", "value": "774f94db315f06310b1600c8d3300ba4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712662, "uuid": "65ec0c79-dbf6-46fd-8d77-2ae81be03ae3", "comment": "Malware payload (Mirai)", "value": "31edae86917f0025d18fde843dc6f5573b2a496ddefa4ec7b287c19a15d3bb97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712662, "uuid": "521b3e63-9a4d-4e01-ac1b-ad389aea8ffa", "comment": "Malware payload (Mirai)", "value": "46201c21545e3df1e896fa59f8d4d9024902e3a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712662, "uuid": "97b76238-5d92-4b0f-b95c-033e41439218", "comment": "Malware payload (Mirai)", "value": "b7651d84bee300d38a74c3b78441b970e1569610a1538ecc8cd70875cf01c56df210f6da6af1502213bfc8e42942ceef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712662, "uuid": "e99d1f15-98d7-404c-a3c6-0a81a7902a09", "value": "T1A6A2E0217F1DE58FCC3BB23886E5E9C692907D21D29CC9476742C16FABA36846834E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712662, "uuid": "2ee6cd3c-27fa-48af-b5cf-0afde9e3006b", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtUE2wA:O98o08kxofBE+ZkXaT47C2EpitUE7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694712662, "uuid": "38d563e1-ea5e-4a9c-b7fc-3e6bbc8a3ff6", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694712662, "uuid": "7b1de30f-5c1f-4cfe-8fb3-33576b90ed43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712662, "uuid": "f3e98faf-bd9a-4beb-ba71-bad22f5604bd", "value": "774f94db315f06310b1600c8d3300ba4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323a20a4-52dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1694681618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681618, "uuid": "e4bca6c0-5bae-4e44-9071-d590936e1f50", "comment": "Malware payload (IcedID)", "value": "03677c4079fafd6413c5552f3d6da926", "object_relation": "md5", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681618, "uuid": "776a5a5c-03c0-446e-a27c-ca62a4aa154e", "comment": "Malware payload (IcedID)", "value": "32ee3a4074bff70f212b88233f37f72796982c3e579fcdcc7c773ae5c41ae010", "object_relation": "sha256", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681618, "uuid": "48c8a09d-30d5-40e8-b75a-381658946fc9", "comment": "Malware payload (IcedID)", "value": "28f14a816b7fb22630c7d59af9d404f51dab4f69", "object_relation": "sha1", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681618, "uuid": "a82aec9e-dd91-448e-91fa-17b7aec36abb", "comment": "Malware payload (IcedID)", "value": "ffeff9479168c7296767b47f75c6564729d72546da334121a8fcd63157a8ffa45ed68479012c4ca1f2c13b24675c5805", "object_relation": "sha3-384", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681618, "uuid": "cc5c6ded-ab7c-48ce-8b9c-9a5d2f23abf7", "value": "T11013DD6A766C6311061E16F3FE1E529CE711807C114707E9323CE39C7B2692B6BA9EF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681618, "uuid": "075a9f08-0526-4410-b7e6-3f82fb61e05b", "value": "384:eo/1qDp3h548/pzFhb2uhK2U2yoWmfrL4tuEsSRqQ1SDIJnjOsetOI88s8vr6z1d:/qHLi+lIR6J2kzqpaJfs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694681618, "uuid": "e4bf5474-b5e8-4cc1-ac00-6857f9b2ca87", "value": 44662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694681618, "uuid": "dcc1fcc3-123a-47c9-aa00-089b8c85521b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681618, "uuid": "38ebb878-4517-43c1-a442-b403c07da895", "value": "Document_09_13_927.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9b7cc4-52db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694681449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681449, "uuid": "9fa818f9-8940-440d-97c5-88d11ad7d79a", "comment": "Malware payload (BumbleBee)", "value": "fcbb53724b1df93a5d1fc45bb55b9069", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681449, "uuid": "e33612b4-149c-4b16-9f01-a3bd9950ba23", "comment": "Malware payload (BumbleBee)", "value": "33e80e854c0959e28b1f94cdcd67e28298dcfa3d80d160bc2042f00047a81922", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681449, "uuid": "bdb91b9f-cae1-45a8-a584-8cfd13a2f0d3", "comment": "Malware payload (BumbleBee)", "value": "890b9b2dfda3203dc1a65c926d45b4e55db7c01a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681449, "uuid": "ff8cafa9-9991-44c2-a2eb-9daf9d2d3c06", "comment": "Malware payload (BumbleBee)", "value": "258634600f99040113bd336e4171dfbec0046336acf2589ed5759dc9fb0db6f2b99e9697f3db1bc2015fb7aecd4702d1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681449, "uuid": "a78a11d1-0e55-4b30-b6da-7af5d240a3df", "value": "T15235AE61A27AB677F737F53B08BBF93A560035A66273BB57101536830072683EEC750A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681449, "uuid": "4f8f7648-2915-4f0c-8f74-7addb5893e06", "value": "660e4ba65070c42e55f04efddf5f7d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681449, "uuid": "4a626c93-d531-49b1-91e7-e2f955e73f8c", "value": "24576:IzGpwBNRQH5EcGOgDhb0fHgrak/05JROMdw8+:gGSBis4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694681449, "uuid": "9611e04b-5ce3-4d31-b278-65c0b885b11a", "value": 1120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694681449, "uuid": "81639574-9683-4767-957d-33e5a2f5727c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681449, "uuid": "4ba4726c-fdf8-483c-a0e8-1ed542e276e6", "value": "fcbb53724b1df93a5d1fc45bb55b9069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a61ee8-5335-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694719936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694719936, "uuid": "624a545c-3588-423a-96d4-044f35b10479", "comment": "Malware payload (AgentTesla)", "value": "655cdaaade154fc6e1a783ab86557bfb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694719936, "uuid": "ca9d3751-4d64-4f61-b5a9-d75868eaccda", "comment": "Malware payload (AgentTesla)", "value": "34ab0bd5cc0a4401b8a52a31623fa59f3ee33b079b99e14f2969cbded7f28282", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694719936, "uuid": "f34a168c-8bf4-47ca-8e87-35ceb812557d", "comment": "Malware payload (AgentTesla)", "value": "ce2c253dc92df982076714196b034b43a5e4e9b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694719936, "uuid": "12b191dd-db52-4c2a-aaae-10cdf68504cd", "comment": "Malware payload (AgentTesla)", "value": "9baaa0bc29cf864c5ede330fa7f4b2b149e99737a8a4e0f9141530faf3e0c29d01e3313074746a4282af60912c4729a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694719936, "uuid": "4d4f7638-8112-4869-b747-045e3b446218", "value": "T1D474933C4E8BBD37DB4F3674EC8B00B9D5F4940EED92E651AD089A51ACB6399BC01193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694719936, "uuid": "710d334b-ac2b-4603-bb25-5d39a1e7eb5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694719936, "uuid": "61f06a07-6469-4636-8077-d038e7507b12", "value": "6144:2FABeobSKPlp8fjjMXrSBRdoMi5MoPPdKkrU:neGv8farSBRdcMoPP84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694719936, "uuid": "cdd39e9d-f0ab-463d-af93-b718c35413e0", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694719936, "uuid": "bfa2f49d-5f2f-43ee-9cd4-1d0b78794135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694719936, "uuid": "806958ff-3d10-447d-a146-8f309ca9fa73", "value": "SecuriteInfo.com.Win32.DropperX-gen.601.11080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6025f8e2-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694675682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675682, "uuid": "8e0902a6-7970-450f-b280-e8d72f85d581", "comment": "Malware payload (AgentTesla)", "value": "a033a6b1d64b85a9158d8d384b444f37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675682, "uuid": "7febf1fc-d83e-40f8-80a4-e7f6883bf724", "comment": "Malware payload (AgentTesla)", "value": "34d90abc5ce0bb8fd7e52b762182968170955b06aa02df633f58a85d9a0846f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675682, "uuid": "143d0cfa-89c4-41f2-9324-02271cbc764f", "comment": "Malware payload (AgentTesla)", "value": "5a05ae30c6d247c36c1b31181222bac3a6e92058", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675682, "uuid": "7f6aa98e-b2a4-41fa-bea8-9cc7df46edc1", "comment": "Malware payload (AgentTesla)", "value": "2871dd85d49f0fdbb1ad31ddb2a448552916a3424a5f5a5543da49aa99a90484333f29c410c724ab28d32335563b638c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675682, "uuid": "ed81dca0-cbe1-4bdc-9e31-4383caaaf46b", "value": "T1B3059407A7D298E0F396BF33C5671408ABB8EE592657DF0F2189329D25733B65803A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675682, "uuid": "7e8defd9-d00c-49b0-88e9-f77975bf26e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675682, "uuid": "f28aa8c8-c7ad-45df-b1b1-e67a8749a9eb", "value": "12288:V2AvLRyQn+rwDoPa/p0ahIEukyL3ENtu5nq4pA/:V2qLoUOELuky2tOnk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675682, "uuid": "75eec8af-09d6-418d-a573-3c011d5f6ac4", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675682, "uuid": "47567412-8039-41f1-8389-6fba036fc4d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675682, "uuid": "246786e8-f797-4268-9af8-40c487eaaf4c", "value": "Sipari\u015fi_(PO4035247)_Sentes-BIR A.S..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4598beb-52fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Chaos)", "timestamp": 1694695687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695687, "uuid": "f2c5a251-517f-4fb6-a95a-f1ff989077bf", "comment": "Malware payload (Chaos)", "value": "5fc3bd9632a02f189d81f75fc3b12ebf", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "DoDo", "colour": "#841BEF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695687, "uuid": "7c315343-b20a-44a7-90f2-7e36cd18c321", "comment": "Malware payload (Chaos)", "value": "37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "DoDo", "colour": "#841BEF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695687, "uuid": "9beeff6f-ed9e-421e-bb74-78a081969c90", "comment": "Malware payload (Chaos)", "value": "6abbc78a6fb421adf80051365dbfaff0b3fb696b", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "DoDo", "colour": "#841BEF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695687, "uuid": "a74e04e7-24bc-4505-81fa-ed92d57ddf1e", "comment": "Malware payload (Chaos)", "value": "58667d1a19589ef939a4c78960937d32c21e4f9dc0aeb4d6e65f32bd0c57767cea00b6576a07c6ffba7d9215d83daecd", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "DoDo", "colour": "#841BEF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695687, "uuid": "44594c2c-e7de-4410-a1fe-0c7f37533974", "value": "T18E25172439EA5019F373AE754BE4F5BEDA5EBF632602941920D00F4B3623989DD8273D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695687, "uuid": "571ef043-ee27-4c37-94c1-bf052765b67f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695687, "uuid": "5ccf1e02-c684-45aa-85d3-ec34485c3afc", "value": "12288:OzEPMLC814R2hig4tHkg2W+AU+R2TjsPvEpv8LpgUO4EP3SL98l0zmWHQuTwYzz5:0ztQE1ov2AZ9HjkftWyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694695687, "uuid": "d0ba8c2e-4cd1-4ed1-a50a-ec0aefd85163", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694695687, "uuid": "f8d82378-1393-4ecf-82ec-29e69e9e21c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695687, "uuid": "c67be5ee-9ac2-4820-b74c-ff52a8bad8ce", "value": "0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec7c63c-5319-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694708107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694708107, "uuid": "9f396264-5856-49c6-82fc-811678c59897", "comment": "Malware payload", "value": "d07950940c8de2a1b8f05d1c581d1024", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694708107, "uuid": "ad21ac3f-3577-4374-b8bd-da0b0f5f746c", "comment": "Malware payload", "value": "39028dcca45dfa7cb2240e94e678dfd33f36c2d540fa0bcb7089562fb0b71cc8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694708107, "uuid": "19013de7-904c-4be6-8bcd-8e8471bd2853", "comment": "Malware payload", "value": "31edbefe247647d71d40500747629769a7911447", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694708107, "uuid": "007d8606-760c-4db1-a985-70f3e420d4e4", "comment": "Malware payload", "value": "629cf5d56733808d36d4a4f392c5f1678e06969a9c1fda106b3df47e61704621cd22afe8c15695735326e4883bc9d086", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694708107, "uuid": "fe786363-3acf-4872-b83f-f8b7d06f6e51", "value": "T1AC23F2BCE68A9550E24949FC849E09F9F60E1083E649FA3D38A89ACD4553D4F1F1D8CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694708107, "uuid": "89a9f1b7-3795-4298-a03d-7f31efe69e0a", "value": "768:AG1svnUccmsFQ6B8HHHY3LULwxIbu4ODxllNqW+wYZhXKK:+scJsFoiULwxkurDBFYXKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694708107, "uuid": "0373a9d3-762c-46b1-a8d3-cc53de6f5256", "value": 47364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694708107, "uuid": "8e783240-fce9-4e0a-abb1-f2016ecc77d9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694708107, "uuid": "237419bc-e31a-426f-b4a8-81df4d69d892", "value": "Vamshi Mannem JavaFSD.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceec879d-530f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694703785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703785, "uuid": "9745968b-f659-4ab8-9300-b5065cff2555", "comment": "Malware payload", "value": "341bc14d792c52d0972bbb0f809a5914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703785, "uuid": "dd3e7d19-19de-479f-a3f7-0d142451fc15", "comment": "Malware payload", "value": "3a2d74b3c238f0d0a4e01a765eac1ecd4204ab306ae4f2b28f509849b8380e18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703785, "uuid": "4c1f3521-a2d3-4b2e-a256-64096873219e", "comment": "Malware payload", "value": "fc2065c2738344dd27457adbbda9de26e0a9a67b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703785, "uuid": "c1038b64-4243-4697-b5c6-90c4170818ca", "comment": "Malware payload", "value": "0066f9b020c005a0c905bd86aa9b2aa17d58da79c2f9b26923dd60ee9fee18c5ebb919355eaaf965acedfb5d2f87cc85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703785, "uuid": "69f8c7da-b4b9-4753-8388-9b81a5a4eb45", "value": "T1B015234577108556E6546F36097BDF6B8F31DC50A0082B8A23B2731FAF3AF9694273CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703785, "uuid": "51d72575-9a3c-4bfd-9061-a3979460615e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703785, "uuid": "3f41b5bb-c710-4aa3-8f0a-57fd7d382399", "value": "24576:L2G0hVRLM5MXnl75rYuTv0y0NnziOPpqb+YvESzIkUGhb36c:WLMKXltZd0NGipqb7fJHt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703785, "uuid": "994a063c-a19f-4e31-a805-487e904fd6b5", "value": 903440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703785, "uuid": "dd8e72db-d584-4748-9eae-db297658faf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703785, "uuid": "5bc58ae8-33d0-4fdc-afec-073e6c43cdcc", "value": "Gangafstandes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e27105b-52ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694688564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694688564, "uuid": "4072e151-1e5c-4d14-a0f7-ec5cb37618fd", "comment": "Malware payload", "value": "b05f920d15dfa6884f8ac79ef37b6c0f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694688564, "uuid": "9c051f17-daab-44d0-b497-ca0364255dde", "comment": "Malware payload", "value": "3d4fc6583077d42c76625669ffdabc9e272e33bfe5f1ff166e7f7b596384ba63", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694688564, "uuid": "3c6e7250-b520-4670-bb07-d6970cc83cfb", "comment": "Malware payload", "value": "438c1bf2037c093f6213270e4f2581f4bea6912e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694688564, "uuid": "c9f5d879-bb8a-4216-ae3a-2d1580d08f6a", "comment": "Malware payload", "value": "c65d860e06333366c6a829865b7c5ed119c724d21c4f1c46b92de32c49df8ed375082ca06b84fa3d30f00e647fcb5441", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694688564, "uuid": "e50fa71f-0f5b-4d5e-aae8-047b6aadee06", "value": "T148E633B93457D90CD8EA90B3EA228517680E32C24E54FB9BB1F41345FDCAEB34E12D95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694688564, "uuid": "90853253-8f57-4650-8e44-bc187e00be08", "value": "393216:PWep5Dm2XFQghnwUlTviPnYlocqVmnQ0ILYvLJadUVlfC0T/:P5pNm2XFQgpwmvP5QpLAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694688564, "uuid": "39196395-e259-489f-8f13-9d7b9fc806a1", "value": 14075523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694688564, "uuid": "98ce7679-e421-4e77-9344-f0bc19440b4a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694688564, "uuid": "1409c500-4671-400d-a435-d7bd2727a94a", "value": "jennymod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349c1416-52b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694666590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666590, "uuid": "0899c28e-6803-4ccb-a851-cb7103b265bc", "comment": "Malware payload (Smoke Loader)", "value": "f4e8f176190abbbc6c31cfd0371d5478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666590, "uuid": "476fb922-0388-4950-8ae8-928bfbe35e24", "comment": "Malware payload (Smoke Loader)", "value": "3db5e0ada7aa377d38bb7a50353d6d6b251d8caef9a91903cd5d3debca317f0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666590, "uuid": "95876e01-b931-4e5f-ac5c-9e76197cbc5c", "comment": "Malware payload (Smoke Loader)", "value": "589a5253e70a05c3db7621eb15f91ab8059750cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666590, "uuid": "977410ce-0c7e-48f9-ba3b-94cba9a1a591", "comment": "Malware payload (Smoke Loader)", "value": "c5ae362c4f601d667b63502d56dec76f12c7bffe832e42449739a44ceaca457ce144529097ba80fb756dca5883a92539", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666590, "uuid": "2fe2539a-0d55-43e0-8be5-c028c72a4567", "value": "T126545C03EFA17D64D5264A7A8E1EC6FC365EF961CE1837662218EE2F08B11B3C163751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666590, "uuid": "f6c2ac66-34e8-4549-a6d7-de8ce93bf878", "value": "3c565fbe4eaafad8572e17176ac3eb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666590, "uuid": "cf4f1838-fd2c-4cd2-9be4-ecf331ad8a16", "value": "3072:Y2mjQ5XiFCJVmfEjmtZg1MHEen83xX+BJ7IoFgdk3g3:oj+iFCJVgEqk6z83xOBIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694666590, "uuid": "dc671166-b56a-4151-8d64-9d8489cf5bc4", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694666590, "uuid": "6bfd1f0b-6b52-47f8-a9ef-832a887b173a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666590, "uuid": "07b44697-c962-406d-a821-098131a1c0dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57f3b50-52cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694675423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675423, "uuid": "3b4f0726-3b74-4ae7-8b48-ccf68c4680ba", "comment": "Malware payload (AgentTesla)", "value": "89182afc3dd737547eeac188b53f12b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675423, "uuid": "c17dae24-38bb-49e1-a882-a1e6356e6ac7", "comment": "Malware payload (AgentTesla)", "value": "3e226f2deb6c162ef126f6b3fec10fe29c0a40eb6f096d4336ca5cdc15204045", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675423, "uuid": "a25e6b9e-b951-4a61-bdef-e674ce23038a", "comment": "Malware payload (AgentTesla)", "value": "ac6996ee02435e00a02f8b1aa5f73d2be5c985ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675423, "uuid": "628cfab3-5be5-44ad-99dc-b4cda19d73a1", "comment": "Malware payload (AgentTesla)", "value": "6d8aa1677f366f0dc2e6443b1a144319eedfae5a84cb655af380f8c66707846f16a2cce52b7bb0f22fff1451aec6ed78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675423, "uuid": "1c458ce2-231c-4b04-8c15-93650b0769c9", "value": "T1CCD423E88CA98479D7681ABCFE9ABC46758190492D93E743141DCF69A2330CDFD8FE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675423, "uuid": "ba5e3e47-062b-4470-add5-acd98a5d2f1d", "value": "12288:EdnWC0CiXx7JVEIIM6nmyZWZit5UOrKbF/maegVItzDuJ:oWXxf3Ct5UOrqYgV4DuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675423, "uuid": "c338931e-b529-47ec-a486-b86fefac79e1", "value": 614028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675423, "uuid": "6ad241c7-6bc7-4f78-87d4-e9e41e986408", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675423, "uuid": "b6a1141d-e6ac-4e50-a793-ab2a97416011", "value": "Invoice #3417-14-23.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfba00b3-5292-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694650073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650073, "uuid": "8a3fbb8b-34c1-4692-9d34-839c927ff17a", "comment": "Malware payload (Mirai)", "value": "c6f7e2ce19dc6638b6c6ee1903980c7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650073, "uuid": "f0d61ca2-5f7d-48d5-86d2-f7bb7b11f510", "comment": "Malware payload (Mirai)", "value": "3eefd765602a50f8084bb2e24ad5bae9e2bfeac6599cf928fc4104f3a5b952e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650073, "uuid": "744d3239-465d-40c0-bc31-7cc27c94a8b0", "comment": "Malware payload (Mirai)", "value": "3d6d33704fd5036b9d8f228c4c97e5c4dd886f1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650073, "uuid": "7dfd52e3-9b41-4efd-bbe3-e7748a669844", "comment": "Malware payload (Mirai)", "value": "1f452a2517b433cbfda2fb34d5a99a4cc61d0f4b2030a006b0058e4a021e6c56fa7f41df2f74cdf8326768ff32525bae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650073, "uuid": "ef7085c8-bf81-4b66-8f39-c55859beb618", "value": "T1A893B41E7E258F7DF799823547BB8E22964837C627E1C141E19CEA015EB034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650073, "uuid": "87f97d42-890d-4c72-950c-7f5b5f9abda9", "value": "1536:Z+NOusT2iv4UnaGZYfovI96ybjoFObugQu0N6O7VoXmLdmDJ:puGbvrNY+I3bjuOou0N6O7VoXKwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694650073, "uuid": "55c3861b-fcc8-429f-9589-76fe17f3689b", "value": 97584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694650073, "uuid": "94b3eef1-c61b-4d4a-aec5-902d7302d6e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650073, "uuid": "2338fd45-f3b1-4cc2-9cd0-1909da6aaff3", "value": "c6f7e2ce19dc6638b6c6ee1903980c7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5f2a6b-5332-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694718656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718656, "uuid": "342cab26-94fb-45fe-84b6-d4b7f1d6e895", "comment": "Malware payload", "value": "ee6ae17a571c0ba64030b7c5c922ea9c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718656, "uuid": "43526d52-5511-4ae9-beb7-18ca2613cfc5", "comment": "Malware payload", "value": "3ff5226dacd23a33f28cf1b3343c4db70b4ff4982e83ebddd7aceee3ad4a067e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718656, "uuid": "b33b7ade-f915-442e-beec-42d8e676f96e", "comment": "Malware payload", "value": "a3c0e6aca80c19cfc7ab9ebcd3af9b4cefe7e766", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718656, "uuid": "64d33d2d-d178-4069-9a87-e5f25a68b282", "comment": "Malware payload", "value": "a2c54ba6199a8ae750e341da7f82f124fc9a0731788d80819664db7dc549a62417266a152cb6650c7ee2a22e519e68ba", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718656, "uuid": "061c161d-f777-4a70-8d81-81cfbdeb6cdd", "value": "T186138312B7D6AF26E12726B488F3D296B325BD049FB7871F2198371F7C721701A42729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718656, "uuid": "2bd04025-d907-48b5-9140-43d165d79f59", "value": "384:gaaX6b9uFDTYOH0Rm73CSZqj9uy6TcdozPSmRqiOe6giSwvxjk+tnop:gaaXfk5j9uP7SHBeOxw+tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694718656, "uuid": "9c13614d-a1f8-4d63-aceb-4ba18b06ada7", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694718656, "uuid": "e2fd934b-66ce-407f-beef-080e2647ce2b", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718656, "uuid": "0afd852f-7837-4a2c-b2b7-a456315c3e2a", "value": "DY PACK LLC TX .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fabe9b4-52b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694663092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663092, "uuid": "ef17baab-e2ef-4102-a2e2-39aa39406084", "comment": "Malware payload (AgentTesla)", "value": "81c2a78ac19f048e31da4ca0fa9b001a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663092, "uuid": "a88a668d-83a8-4f81-a584-b197601d69dd", "comment": "Malware payload (AgentTesla)", "value": "4160b16dae4f640dba8de3c1da4446a689e9c7506f24fbf79f6f632184ab8243", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663092, "uuid": "1dfcc939-577c-4566-bb34-8ac2a9b6e026", "comment": "Malware payload (AgentTesla)", "value": "0eedadf5b413c86e0dff8af32020f5d19b67d639", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663092, "uuid": "16eb0781-a88f-471e-9360-c67bda3a096e", "comment": "Malware payload (AgentTesla)", "value": "90f05f53d5d78baee5a2c4bcf2a4b1dc8f9260e362f8b940949b0b6d7afe95508d285e810bafa5791737d9458ef3658e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663092, "uuid": "f5f2216b-ea46-4688-96b9-0d4babb8467f", "value": "T132049D2075C0C1B3C4B6113044E6CA7A9A7971710B7A96D7BBDD2BBA6F213E1A3352CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663092, "uuid": "d23a3c2c-5c75-4836-9fe5-c23e6ff0fcc6", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663092, "uuid": "52b335df-05a3-45cd-8e4f-616af06243b4", "value": "3072:jDKW1LgppLRHMY0TBfJvjcTp5X5KVyNsNL37:jDKW1Lgbdl0TBBvjc/5KMyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694663092, "uuid": "0171df86-0a3a-4c73-9496-243421639d36", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694663092, "uuid": "16ab09b4-ee50-4253-8f81-aa10344a8a9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663092, "uuid": "e450f8e5-2469-4ad6-b5eb-5affc875f777", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ae10f0-5308-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694700473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694700473, "uuid": "dc2358d6-9d5b-4caa-a8de-144ad128aa8f", "comment": "Malware payload (AgentTesla)", "value": "49698195ef5bc79d9723509d0fcb6bd9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694700473, "uuid": "3a59152a-13b5-40ce-89c2-e638e80c2eae", "comment": "Malware payload (AgentTesla)", "value": "421a2cdb38bab8dbe89a27d19656ac41518049efc0018e1dfe7580b93db7102d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694700473, "uuid": "334a4060-b7d7-4f00-9a86-41929c13cdb3", "comment": "Malware payload (AgentTesla)", "value": "ba57f98945f7bc616a8c55e8ef51792b8107b2da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694700473, "uuid": "48790028-fdb6-4646-b18f-db0cd0762341", "comment": "Malware payload (AgentTesla)", "value": "1aa0223f08a0bc644130ddc2ef539924385a283c50fc33f0b06fe1de2766f40d51b70d9f53294a44515530d13faba57b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694700473, "uuid": "399218d1-5db5-4edd-97be-38cb923f68ce", "value": "T107D422052298D638E4FB1BBE96F1440223F4C797ED8BEB498FC1A1ED195335127A436E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694700473, "uuid": "a125351e-936b-4cab-a51f-cde75a315d33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694700473, "uuid": "321d0112-4cff-4fce-9070-78e81e206b26", "value": "12288:dTj8FwLm/xGGD6lo44NIq1QTNiW76fitZxl3PZXk4FOGHDiTe18qxx5uu3:dTj8F6sQTNi3fitb9ZOQC+Lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694700473, "uuid": "21960fba-06f7-4c42-bb56-b4f5fbcc3706", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694700473, "uuid": "a4613480-3249-4ef0-983d-4bfb3c791243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694700473, "uuid": "a9dd806f-37fe-4145-9ea2-442c1b102f62", "value": "GEI REF 2177711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734a947a-5317-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694707067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707067, "uuid": "b30a1102-5ce9-4771-b766-6f9a8520b892", "comment": "Malware payload", "value": "ea03470e4d2eb49bcca1f29b73d95a16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707067, "uuid": "de309b5b-0200-4e08-b173-be38c479837f", "comment": "Malware payload", "value": "436ff29782ab339fa3e2f61ba3feb74584940d2d5ad482bf9c012c1f4ea392c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707067, "uuid": "3613467c-9c00-41d3-88f6-5d98f92e6934", "comment": "Malware payload", "value": "5e1527424b657dea87bbec27be0f528e7c0d4911", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707067, "uuid": "4e74a982-0655-4afc-9b03-8e918b74b0c8", "comment": "Malware payload", "value": "b25b2eb045f81582fc33f819db04e85fc804444705bbb7f3b5844bf484fba473df8beb4491fb43763360775d073c2650", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707067, "uuid": "9b398fa3-a36c-4368-811a-0b8aa23a4ee0", "value": "T1DE052382B191AB95D4FE0BF60934460003B8FE7AA894E25F1FE571D76BB37900261F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707067, "uuid": "7300e1d6-af4e-40a2-9b73-a4437dfba567", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707067, "uuid": "6107bd25-945b-4f55-9465-488b3bd393c9", "value": "24576:hhj8F6JkfkHL0wrtu+UCBnZjf9NvPloA:VWur8+bnBFNvPl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694707067, "uuid": "01192402-5e07-486c-b517-d3e471ac15c2", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694707067, "uuid": "a46764a1-b20f-4c28-a12f-c46dd32ed93e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707067, "uuid": "3a01c994-99dd-466f-82e0-9a707cedf3de", "value": "shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3136213d-5318-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1694707386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707386, "uuid": "c266f8b6-dc7a-49e2-9edb-23a71b7adc1a", "comment": "Malware payload (Fabookie)", "value": "2273152b5565d0d47b6c59cb5099dc76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707386, "uuid": "34a49654-3a61-4944-ad57-aa1610bb0805", "comment": "Malware payload (Fabookie)", "value": "4389fc9e95b214ac7cf515931ae9153450bcd4ccd7b7bad6a498da723ad602af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707386, "uuid": "0c8e3d64-4c26-4670-8d1f-100442104e63", "comment": "Malware payload (Fabookie)", "value": "9d07cd1365117a602b696fe15d0e49b7cb5322b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707386, "uuid": "77395c16-0ad7-4b32-ac76-a73aa76e62fb", "comment": "Malware payload (Fabookie)", "value": "e47ed7353cd0af487754d99cc132c143b028bf202dc07611acb859fdb73a6501bf65bd6274dbf64a765cfea36200a184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707386, "uuid": "9ce934b7-bbdb-427f-aa61-a9fca61bd15e", "value": "T16D742981B3DA4038E072C679CEB18363EA767C155B3096DF07609E6A6E73BE0D531B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707386, "uuid": "2597b06d-97b9-46dc-bf03-acd12bb29309", "value": "ce0c54abf9cb1706cf3f091f1f306b7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707386, "uuid": "d2608c4b-0b33-4c49-900d-108f095dd3f1", "value": "6144:zFH8RIT6Fam1StJ3rXDW49Vl7SkDHPiaODgKYleQ4S4P:zWdGXDzP7aMAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694707386, "uuid": "05644a03-b4fb-4e2a-978f-0e52328985cb", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694707386, "uuid": "c1fee18c-347f-4fde-bc19-ceabc18f2e46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707386, "uuid": "78cf54f0-9d4f-485e-a3d2-1c0642673364", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a316a445-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694703282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703282, "uuid": "a44bd499-bf69-473a-81bb-23254139f5f0", "comment": "Malware payload (AveMariaRAT)", "value": "17fcdc44e561a02a6981c29b1e4657e2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703282, "uuid": "a7f45057-253f-4cb2-908c-64d82ac1d81d", "comment": "Malware payload (AveMariaRAT)", "value": "43daa59b24a91abbba82920863fc34572d389b893f7f27f92efdf3972db887bf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703282, "uuid": "128d1e52-5259-4c23-9929-6f4de5f0c148", "comment": "Malware payload (AveMariaRAT)", "value": "ec8f8c7f5d7dce27de469b1f96002846393b8c5e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703282, "uuid": "eb8d3eb2-6ece-4e23-a176-43f81ab3c217", "comment": "Malware payload (AveMariaRAT)", "value": "f2b191654badb1142071de8674cb0dddd7988880b0d1fb63e53c1745bfe782c4f19526fd7929dc8df88670233379b015", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703282, "uuid": "560d692e-b14e-44ca-8e53-2fcb447f8321", "value": "T1F26533C39AD20814F679B3461733CB71A8852CEB794EA7B6429E4B0D0F2B532E3F5190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703282, "uuid": "443f959b-1324-4498-b136-7c23fb8c7363", "value": "24576:t0g7HsKjBP/tMERJLDUWaNGUwpFp62cjdl9o+9wLGW+u+781HkCv:t0g7Hb9tMqJLDW0pb6nrmDI8VkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703282, "uuid": "acae54b2-3573-47a7-8d4b-e40d5dd256fd", "value": 1411670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703282, "uuid": "d5bdefb2-3c2f-43c0-b777-0022b88c9c24", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703282, "uuid": "e0323898-b0c3-4b7f-b394-1e8212b2902a", "value": "charlesschwab_PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3cb679-5329-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694714627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694714627, "uuid": "838bda59-2c39-4bf8-b5c1-ce6fda4a7c6d", "comment": "Malware payload", "value": "32f656cc5303f65d433e18e906707f08", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694714627, "uuid": "92cc03fb-729d-4ffd-b657-b6e90ab47f19", "comment": "Malware payload", "value": "43e2ea4b77213066994908fabe94f958af86bcc4ab597e41b6f7c480cdb08de8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694714627, "uuid": "a4f0ae3f-f9fb-483b-a29f-db833be7af78", "comment": "Malware payload", "value": "b0a8f6f889a717c4f5e182d9dd097246f2b12b14", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694714627, "uuid": "44ec4e90-5993-4230-ac6e-456b9a4d8846", "comment": "Malware payload", "value": "341a6c2325f5b01dfa4b6dff4da076c7ca94c5e2187763e89f98735cdbf1d518eed6a9266ad8b4aa96a10b4b10ef756c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694714627, "uuid": "6423a3c4-7757-4fdb-bc31-28be3f8c6e1b", "value": "T1FE935406F62B3E29C16C4C74502663AC5B7DFDAE2F55632A62C13DBC7E705A0ED09B18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694714627, "uuid": "c20c3935-3465-4eb5-8a4c-bd8e053e4d84", "value": "1536:6rVhQTyHxrtRp4kUppNppNpRBhBWpuRLpAp8p4pvppRLpB5Sp2ti82kMDc3:6rVhxt08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694714627, "uuid": "4c8526b6-04c6-4961-a755-295a6eb8944f", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694714627, "uuid": "1aecf127-b21a-4a07-8ea7-9cba1e75ebf6", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694714627, "uuid": "55b81dc2-ae31-4693-a727-9d6c142b01f3", "value": "Monika_TableauSql.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e70e058-5355-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694733742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694733742, "uuid": "f0cb786c-43cf-4368-856a-31551c64335e", "comment": "Malware payload (AgentTesla)", "value": "0b165c27a9a4ee3c8db89832aee222af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694733742, "uuid": "940ff9b2-0699-4ae5-a398-c3e15ca3c742", "comment": "Malware payload (AgentTesla)", "value": "43f88b88e4e15400600d26a6bb19b4bae118c004dd75e6782d9cd16b7277854b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694733742, "uuid": "dc0164e4-b827-479d-89d9-c615d7c9b46d", "comment": "Malware payload (AgentTesla)", "value": "a88639debb117b54347097084667d31873825013", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694733742, "uuid": "ceb4477f-93c6-43bf-a07b-fae9c4bdbcdb", "comment": "Malware payload (AgentTesla)", "value": "253422fdae0b7563056e1dfd5991e6ebdd135ceb584494b60a5bb97dbea4c7b6b459d421c922057514309827c5ec6fcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694733742, "uuid": "0c8a6610-6082-4a79-9abc-60c8aa4ae662", "value": "T14D340F03BE44EB15D6593E3B92DF7D2813B1A0C70A73970BAF48AF6519412536E6E32C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694733742, "uuid": "da0eae7e-ac54-4ca0-bd03-5e6698cbd9f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694733742, "uuid": "27bf4b3c-0e75-4e46-bdde-4d2640f607d9", "value": "3072:N0mHe1cKwF1LHbzq/rlqkIgV4+QWfK8WvFG:N0dc7F1L7zq/rRIUCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694733742, "uuid": "d0c0c817-f8e3-45b4-9a61-f9b4c5973c71", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694733742, "uuid": "699f59b5-b01e-4a0a-b398-56f28894c4bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694733742, "uuid": "a0d552ca-bfbf-461e-8a08-bcec4c7d70ec", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da00d4ff-5353-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694733009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694733009, "uuid": "1ee523e9-7e16-4c85-9bfc-e6e173ca533b", "comment": "Malware payload (GuLoader)", "value": "299f2554d20333d81c5c9abaea4fa986", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694733009, "uuid": "620598fb-a641-4fa1-89bd-3f737f35938f", "comment": "Malware payload (GuLoader)", "value": "449f8ae5471b014f1377dbadf96b8d7aa0aa80c58a1fe83fee261dfb51324e46", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694733009, "uuid": "761736ce-13b5-4f32-9357-2c928a72fa86", "comment": "Malware payload (GuLoader)", "value": "cd5b077ce139e451fc0a92648ceda395f06ee2ad", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694733009, "uuid": "e6fc2372-711d-4208-8885-f6ba37b2d269", "comment": "Malware payload (GuLoader)", "value": "05fecf6111eed7816b39bd84a4649f677b1e8b2b7108bf59d8b4098e539bdce6bc74654786760619236137380a4150b5", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694733009, "uuid": "a866a54a-17a5-4087-a373-86860b0ebf74", "value": "T12F2412EF92F6A788BAF1B9C049755903FC734199CAAF5063F9838D0220EFB590C608D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694733009, "uuid": "46795e56-a4c4-48ff-beb5-f35d5829fb93", "value": "3072:mDFu5kmK1EQ9r0ZY4nn1o46SoeUaK/hDqZWgqJvfaydi8Upg:k3mguZYW1o4pUaK/hDqZqJv7i3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694733009, "uuid": "a0aa686a-bce4-48d6-8685-3d9bad4ba6c7", "value": 217552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694733009, "uuid": "f7364ecb-0ad5-4d2e-92e7-553ef385f370", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694733009, "uuid": "7dcf3978-83d3-4c3a-bbc3-8b5a4ce4d4f2", "value": "Order #007761111.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c911e350-52db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694681441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681441, "uuid": "fc07ad68-1f4f-473a-afe4-bfce60655975", "comment": "Malware payload (BumbleBee)", "value": "7d2156efddf126dfb4c466da06f15e11", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681441, "uuid": "584135a9-77ac-4cbc-89c3-b206cdae9ee6", "comment": "Malware payload (BumbleBee)", "value": "452bb497728f1eb2ccd56b83f7a13e51447bd79852085e68908cb6c47625060b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681441, "uuid": "71df11f3-3163-4987-8363-5790bac00551", "comment": "Malware payload (BumbleBee)", "value": "cf90131f73f72b7f32bccca438283a04a1001dbe", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681441, "uuid": "ad891e21-837f-41aa-a2b7-809b800e90a2", "comment": "Malware payload (BumbleBee)", "value": "399c08481d5651966f2e24f2ff592d480639debf969985d22b3c43d947aac7e9f0975b4efd83efed17851f43cd5bb1a5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681441, "uuid": "f6cd913e-4d66-455b-92a8-3b06c52ce1c4", "value": "T10635AE61A676A773F737F53B08BAF939560032E66273BB57101936831072683EEC750A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681441, "uuid": "ed34afbc-dbc4-4c09-ac08-a3e1e2dd0069", "value": "660e4ba65070c42e55f04efddf5f7d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681441, "uuid": "e5e4dfca-0698-45b6-9944-4b90b4665cd1", "value": "24576:drD2uxNbJd3BU7XFLH9io8hAGOAHxLrQ+P3U:ZDBxNvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694681441, "uuid": "dee56a9d-9751-4ecd-bafa-e6b740705a8f", "value": 1119232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694681441, "uuid": "ff711532-f5ea-4b43-96c1-19362950b877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681441, "uuid": "518e8e75-f326-4d4f-b0ab-8a64f2777c46", "value": "7d2156efddf126dfb4c466da06f15e11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a52752-531b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694708648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694708648, "uuid": "754db39e-0504-4dc2-a286-5f6a84b1c7c8", "comment": "Malware payload (GuLoader)", "value": "a2a94f99351fcc059a3dc3605879ac87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694708648, "uuid": "8d4a70d8-5ca5-44e6-99f3-80132ffb3670", "comment": "Malware payload (GuLoader)", "value": "475355b8bf2f2a68293c808cf959de00a8e04d6f48871a5a1fccaf9d318570fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694708648, "uuid": "d25ce15a-22ad-4dc5-8b4a-e8335078c284", "comment": "Malware payload (GuLoader)", "value": "b1502f7a1d3be4f21a6865bb31df2ff49d87db81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694708648, "uuid": "2b9d7bef-f5fb-42f0-93d1-4673f34ecd4f", "comment": "Malware payload (GuLoader)", "value": "f4afad7a5e1f91bfff4e41066f75561c8b5f36bb22c1900c2b962e087b6ecba548a1c263bb3307dafc57d65a61fd38d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694708648, "uuid": "43571937-dcf6-4e53-922f-243f507b22dc", "value": "T1D254F111B690D057DD74073CBA2BBBB685B6BD14F890CF0763943B4E38323929B2D669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694708648, "uuid": "cd51566d-ea00-4049-8ff7-46ed3d61aac9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694708648, "uuid": "7096a540-3130-4f9d-9b19-35b7595770ab", "value": "6144:UVGdx6x1a958+nUMe2VoPApuHuvVn5ALML2cbdIqCNO:oW58dP2MSpd52iyq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694708648, "uuid": "d6d05db2-f1d3-446e-8542-cdd161845ce5", "value": 286352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694708648, "uuid": "8527ff9d-9b7d-4573-96c0-f5ffdd125148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694708648, "uuid": "5f8c93e5-ae38-4812-a075-0c4231a51142", "value": "Order #007761111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6ca3d7-52cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694675976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675976, "uuid": "41c7eebb-8c3b-4874-bf3c-49fa2db2ae8b", "comment": "Malware payload (Mirai)", "value": "b735e750e93daefed62fcee2d4ba6551", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675976, "uuid": "bc9db9aa-fe09-4205-bbbd-afdfc60d3dfd", "comment": "Malware payload (Mirai)", "value": "47a78d33ff2b214b026bd92b16714844bf76dd40f7387c75d66495ca167e5569", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675976, "uuid": "1ff7600d-e470-4ee6-a538-3057e852c0e4", "comment": "Malware payload (Mirai)", "value": "b921e67b22b98b7a6a3656c11fbf2fbba6c5e93a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675976, "uuid": "2cb437ff-366d-45d4-839f-7037f1101b9a", "comment": "Malware payload (Mirai)", "value": "99266f67e7f996a445936d1cd2be8cd2c701536e0090802785c45f6618b7c3d22af4befb52136a9cee991095a5538385", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675976, "uuid": "b58ae3e7-21f0-4593-930b-54abe6781290", "value": "T1A8730751B8C19A23C6E4237BF96E418D372563E8D2DF3207AD212F6477C682F0D67A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675976, "uuid": "9e6b4fa6-6412-47c1-a2ce-9f201d8d5827", "value": "1536:r0TYdvgcgQvt8ybKsyicfjfS3TLpKVIahWlJs7y055RZTq35Nyg:r0FfO3ZKVThKS583C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675976, "uuid": "43b6c2e5-268d-4021-a4ea-1218465e17a3", "value": 78844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675976, "uuid": "581cac82-f187-4ddf-98ee-432473a53807", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675976, "uuid": "6929d9dc-b0ee-4e96-b970-fc4fdfede46d", "value": "b735e750e93daefed62fcee2d4ba6551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41fb0f9a-5346-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694727171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694727171, "uuid": "3e106a6d-8f5b-448d-9b61-7aa648ea9527", "comment": "Malware payload (AgentTesla)", "value": "b1e6a4300ddf51294c521d5cebc6c240", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694727171, "uuid": "794c17d1-4c59-4aa4-97a2-7ec79fe261ce", "comment": "Malware payload (AgentTesla)", "value": "4842082fa4563ef01ed73d0e10c46fb7f6502ad5e0472462766d283067cff9fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694727171, "uuid": "32d55e7c-51f1-4762-b83e-fa09dbc847a8", "comment": "Malware payload (AgentTesla)", "value": "97fa1307f4cc6eb0cd4c5f026635ef324e0505f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694727171, "uuid": "1429a13c-bbf1-4e70-adef-879b2e42e350", "comment": "Malware payload (AgentTesla)", "value": "282a4b2578acf9ce819992653d33dabb176b4069878c9ca5f62a72516b6e3320aa01fce04690d99f0f8c86e0b7993baf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694727171, "uuid": "161aa73f-85f3-40d8-a239-7b020568befc", "value": "T10FF4F08036E89F27D0BE97F4413196180BFBAC5D2866E7488EC630DE79B1F858F44A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694727171, "uuid": "00bc2118-7c26-442a-aeb1-47b824dd6593", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694727171, "uuid": "6fbf2f8c-e677-4c20-a0fc-af5619071ed8", "value": "12288:P41XQ4tM0PPFpy1UocUj1t/TgIll/YMrTmV5RDsKNAfd79fp69bf9Qj8FwLm/nP7:P41X1/PG1xjXdr05RDZNi7+tlQj8F6oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694727171, "uuid": "035f9f2e-1767-4ac8-8acd-8369dacfef7a", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694727171, "uuid": "6dd06caa-60e7-4738-98d5-f8d1ad4f9ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694727171, "uuid": "88bb7a21-ae6a-42b1-9b6d-d050078d3e5f", "value": "SecuriteInfo.com.MSIL.GenKryptik.PWSX.tr.21058.10140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e758b860-5310-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694704256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704256, "uuid": "8ba777bb-5e02-479b-b7e9-186d4aa4e8d2", "comment": "Malware payload (Mirai)", "value": "fb9866f4f2c11311ed01e487d3fcbd6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704256, "uuid": "cb855723-5651-413f-9b8f-f5032d69ed7c", "comment": "Malware payload (Mirai)", "value": "48e35de50d2fd12a934a0b107de095102b8f828ec2c82476cfab6e6320e12a8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704256, "uuid": "70386768-e688-454c-8ff0-99c48d65f65e", "comment": "Malware payload (Mirai)", "value": "eaddf4fd048e60e1cf635ee8a77038d771cdb888", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704256, "uuid": "4d887241-1808-495d-ad15-0f31c6eda2f8", "comment": "Malware payload (Mirai)", "value": "63a9dca5af3032c8ae5681009ea58001cc2077961f3e165dc2e25e1fd4739354337e84a3daa88789ee52b77ab2ca5d20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704256, "uuid": "abed9d0a-d56c-4e9a-9f31-2aeb69b008c7", "value": "T1EC230231890A9EF125303C76DA99D793B6E12AB1C5673123D5280A382F757231E5BE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704256, "uuid": "37d538f3-fd09-48ab-9721-d380bd86fe0e", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3f9q3UELbUXfi6nVMQHI4vcGpvZ:gECFd+A6YHAxOLRQZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704256, "uuid": "92e378a0-e4e6-4033-96ad-b5a29fde5201", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704256, "uuid": "ada46faa-38d8-40c4-aedb-43174233b1f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704256, "uuid": "9ffad044-73d1-4d27-8d7c-c24c4c26bbb4", "value": "fb9866f4f2c11311ed01e487d3fcbd6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950902b9-52bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694668040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694668040, "uuid": "c5069d74-2c1b-4c17-9af3-13bcb14f13af", "comment": "Malware payload (njrat)", "value": "8ae7f841045aed1f381a68caa736d94b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694668040, "uuid": "73562fd6-96af-4e26-8a9a-92f39669989b", "comment": "Malware payload (njrat)", "value": "491b1dfe9c3d8d0687339c3b12e07529d515f4bbaaa6c8def22032f223452bb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694668040, "uuid": "4d78e4da-c100-422e-b9b7-095d034ea54d", "comment": "Malware payload (njrat)", "value": "8a4402abc3764dddbf0944da5bbf6e74394a6095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694668040, "uuid": "5f5abe6c-fe9f-4feb-a23d-871f5c47e501", "comment": "Malware payload (njrat)", "value": "de39ef8bf2c02d5424604761c0578ca0e387d857e08c084b9d6cf56916bda90a133899ae4df678715151e43f35e29822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694668040, "uuid": "5b653503-3360-4b5d-8efa-12b38671037d", "value": "T1D1C2195D3B908166D2EF2BB006B2DB2502F2E10B5A27EB5F4CD844FA6B773C14D819E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694668040, "uuid": "b959c976-46d4-465b-bd24-f835d81abafd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694668040, "uuid": "8f6a4b07-32ae-4017-8b7e-6aaecd3e71f1", "value": "384:vLd6cufEYAA/XgWeyoHzCYe/iBY2OzRLTm3yilqr63+bJtVvGD:Dl8AA/6T5e/gsEsVvGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694668040, "uuid": "0161c6ce-2a09-49a0-af8e-a1622d5c3495", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694668040, "uuid": "7cc96f12-1439-4009-a8e8-45b9d880f1f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694668040, "uuid": "9b17fe31-bc9b-4492-bf2d-389e32ef70d3", "value": "bPHT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d5e204-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694675685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675685, "uuid": "312f0fc5-d919-4f9f-80f7-79788c88a310", "comment": "Malware payload (Formbook)", "value": "ef3d04a458241ac4fe3d02654fd92179", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675685, "uuid": "67c78025-738b-4f78-ac06-53843d9cb2fa", "comment": "Malware payload (Formbook)", "value": "4a053b5020a3a82c6b9f4a4e6ac3b3a2e3d628a3ae42a60cf94ddaaf42aafe98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675685, "uuid": "ec5509e3-4e4d-419b-83b0-1b9233f2f6f4", "comment": "Malware payload (Formbook)", "value": "f97b95a39bb838fda406839f802f6a1042723fa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675685, "uuid": "e5587f7a-0279-4dc5-8509-e02d6608759f", "comment": "Malware payload (Formbook)", "value": "fae1773c4f834ee7d764ea790a9de6fdb97261a0342706443cab773fdeb4ff686a9fcd6bc3517ce45b7f5ac12610fdc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675685, "uuid": "62b5cdc8-167e-4ed4-a1ae-fffe6080a490", "value": "T1BFD4126CC684975EE86A77F604E1972193B2E7234A19F78F1FC876AF1E813060610BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675685, "uuid": "7be050da-2e50-4f2b-99b2-1b83ccea2642", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675685, "uuid": "228d705d-694a-41b1-8967-6371f705ed29", "value": "12288:6WRF2iNyLfDWrLvVR/6tBmLkCg3b17RSldHlWJF8zdeYrVmRRo1:68F1ILf7tMLTgPSnH8JFCdeYBmRG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675685, "uuid": "a2c37a51-daf9-462b-97bb-cdb233a4753f", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675685, "uuid": "d8b82406-c7cf-47af-964d-f6135c65fb82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675685, "uuid": "5047cf31-da3d-444a-9db5-8d77891bec6c", "value": "ordem de compra pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e39e23-5311-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BitRAT)", "timestamp": 1694704357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704357, "uuid": "b87a67f0-66a2-41f3-96a2-bcc13b6a04a7", "comment": "Malware payload (BitRAT)", "value": "100a2750f01f084234fbd828f1f608fc", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704357, "uuid": "f17e2b14-5392-4484-b599-863c3285321d", "comment": "Malware payload (BitRAT)", "value": "4a7daa6f01efcbc7e6480e26f2f99092eb7c059929bc84debd13a7962d0a2a25", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704357, "uuid": "9f7435bf-eca7-45ec-b8b1-5e432bb6708e", "comment": "Malware payload (BitRAT)", "value": "e5c947d03ad2a7a08500275b2107d91f13295066", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704357, "uuid": "024ce065-51c5-41ec-986d-9ab11d30d90e", "comment": "Malware payload (BitRAT)", "value": "a3dcace80928d7b19ea287805b84803fb1491e21bbc12750bb43ad8330ed1b828b39ddf9794d2d6f5099510daeac256a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704357, "uuid": "0a6c2ead-19cc-4b88-9805-dd192ced58ca", "value": "T11BA39DE2FB5AE815C89D43350DF6C5912A57BC602A36938B3259F31E2FB3A908D43743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704357, "uuid": "02a4778a-427d-462a-954a-57eb458ef2a6", "value": "3072:YrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAPtJE2zuxq+fr9wBLa71ba2ryLTHeYjc:exEtjPOtioVjDGUU1qfDlavx+W2QnAF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704357, "uuid": "946746ab-dfb5-41ee-9fe9-b878c3bdc6b3", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704357, "uuid": "3a3fedfa-f2a5-491f-95d5-eb0910cfe5ba", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704357, "uuid": "8311fd6d-f659-4ad5-86b5-5aaed066b7a9", "value": "Declaration_of_conformity_INOX_MACEL_ITALY_09_2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddfe866-5318-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694707354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707354, "uuid": "3704ef1b-008b-4918-9b77-bc11546badd9", "comment": "Malware payload (AgentTesla)", "value": "21fed19368d44e0106f07f1aa60398d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707354, "uuid": "28658e83-4fc8-4ce6-a87b-f8e707934569", "comment": "Malware payload (AgentTesla)", "value": "4a81684c5c627515fa3dfeafb6d7feb73db552e3442403176a80edc9a670bcba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707354, "uuid": "473353f7-5806-4a5b-83a5-ceed3625d78e", "comment": "Malware payload (AgentTesla)", "value": "f26abab2a3e19bf9632b991dea6c2ea711f13762", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707354, "uuid": "a62dadfb-00ef-41c4-9313-57544ec4b2c8", "comment": "Malware payload (AgentTesla)", "value": "472531b55ff7da6104646f9b66223d7dd97bc1ad60184a870271309b3842d6cd53cb19d660630270126270c4f9ec0102", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707354, "uuid": "75572f10-cece-4a23-9406-9c77e1d19bd2", "value": "T108E48C9D76B1FDAEC957C477CA543D20AE2D6DA64307F206A00731ACAE7C997CE101E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707354, "uuid": "32980d10-a1c6-4582-8e57-e4d87722a733", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707354, "uuid": "821d6180-2775-490f-aa90-0756a7ee4662", "value": "12288:cPHnIG5K3hX60Ij3WrfjFT1LkLWSq4WScGh5nkx08xwuU95dlMH3:2IGks0Rr7nLkYhSFhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694707354, "uuid": "b4ce01a1-3f58-49ea-b328-211f89eac1a4", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694707354, "uuid": "5e54e6f4-3a4f-4040-8c39-01385f944a10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707354, "uuid": "d60a5c52-7b1c-4f58-a519-2d400e657fbf", "value": "Invoice 05-69400 with Po.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb3139d-530f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694703753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703753, "uuid": "8fb03766-ef80-4a7a-b5be-f67af08334fd", "comment": "Malware payload", "value": "a7a53539c31b96d92c46428ddb35340c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703753, "uuid": "06476a58-3c0e-4b00-9058-978ad5cd492f", "comment": "Malware payload", "value": "4a9a7570e166d8e761a0c4d1fece92bbf1a66e9c4c3601ec0cbe7c0880e5e63a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703753, "uuid": "edcf55f9-591a-4316-9daf-7d5153baf9ba", "comment": "Malware payload", "value": "9288c90760c7fd51ec7e5477e05bb09f37279eb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703753, "uuid": "1c27ddc7-84dd-4fcb-bd93-5287f30ffbaa", "comment": "Malware payload", "value": "8af842508e680a136e9217898c9ff7c4b4ee7338a75ec023a73a6f4a7d5dd63a30bdad395e22f0281d2836593df0f77e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703753, "uuid": "aced605c-a246-432c-bf00-ae59c41333c1", "value": "T1A5F3E00266D053B0F44FE770908F9ED69EE0DDE5C91443AB22E9B34E1F3C2E694666C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703753, "uuid": "2765382e-b5d7-4206-8e54-89cf335276c4", "value": "c459bc817ec6892e8239878cc4950376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703753, "uuid": "66561d9a-dbcb-4856-9dd7-b64198cc8965", "value": "3072:cz22Qd3I8BdvQuZ+zbo7mT/dbiYHqYJGBWzcJvHJo:c+YedvlCbzjJGBC4vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703753, "uuid": "67ea348a-e592-4348-9c74-d7d3b69b7b7a", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703753, "uuid": "b557483c-2cfd-408a-9f81-0fc549acf381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703753, "uuid": "4182b5c1-6025-4995-b3e4-a0019837843c", "value": "a7a53539c31b96d92c46428ddb35340c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0173e033-52ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694666933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666933, "uuid": "3c88407c-b96a-4fb6-8caa-71f49c2f047e", "comment": "Malware payload", "value": "87f6774e25128d080fecd3fe5e15daa6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666933, "uuid": "f3cb3cc9-c440-4d95-9b12-e3fe3391e23f", "comment": "Malware payload", "value": "4b348a11688dd83bf58edfb6020d5d3f5ea8cd017aaf6ff89592263896f055ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666933, "uuid": "f9d6fec5-5f43-4134-b4fc-af336c33be97", "comment": "Malware payload", "value": "7bfba488061550cde468492b67659cd112ec09da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666933, "uuid": "7720b533-6047-4662-a594-7153fb8ffb0f", "comment": "Malware payload", "value": "ebffad428d8d44654fadf567fd312ef310b55acbdaa0fafbfe2eb9df30545e736f530c0f9ba16906645f1b9840524dbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666933, "uuid": "92a56ae3-f746-4b02-b098-38675cd26ee2", "value": "T18F840151B1D18433EA3735311C91DBA50E2DFD610E61AEFB339066B90F356408AB9B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666933, "uuid": "d7874881-46e4-46b9-a92c-66818f489b77", "value": "9dcc2fb8fef0355edecee5c713257e9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666933, "uuid": "070b81e8-342a-49d7-976b-114d3457f6d4", "value": "6144:YRQoL09mu6CHH9CZWUQKcSemuu6C3qECHH9CZWUQKcSemuu6C3qQc1:YWokcudCnx6C3fudCnx6C3Rc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694666933, "uuid": "a3f9a603-4cb5-4e56-b921-98bdd28165cb", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694666933, "uuid": "8fc0817b-5e43-4247-afbf-90ed12e96aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666933, "uuid": "2ac7d34a-ea38-4b7f-a5c3-9c5ad83df56b", "value": "87f6774e25128d080fecd3fe5e15daa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02d83a5-52ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694661321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694661321, "uuid": "29ba2e11-3d94-4b1b-89ff-c09b8a284794", "comment": "Malware payload (AgentTesla)", "value": "01b5157dcb56db2036caf9cbec0c93f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694661321, "uuid": "83e5484c-4782-4b32-a9ae-ba27863bc70b", "comment": "Malware payload (AgentTesla)", "value": "4c47c20fb3e45ebc53361f59b23f49ae5cf6354606de41d2f005d5381d85a209", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694661321, "uuid": "d238504f-4d24-4084-922b-16ea9e56921b", "comment": "Malware payload (AgentTesla)", "value": "1c71bd9c8dec393ba0063eb9976f84ef29f044c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694661321, "uuid": "43f297fd-ca83-4bf7-bf21-89afd921a092", "comment": "Malware payload (AgentTesla)", "value": "8ae0bd1dd69765b8bd8e8b57dd5445d8a1d28ba7cdd0d935e94ba358ee893add161478ff45d812231f0bf01fc919f4a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694661321, "uuid": "e4fc25c2-b3b2-4936-96f8-add39bc2ada0", "value": "T1D184122039A4C487D5621675AC30CABD7E61FE228D99975B37C43F4FBA32292C81BF51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694661321, "uuid": "30a7fdd2-fbce-4813-96fe-22c4625b5f94", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694661321, "uuid": "00706428-d333-467a-8cf9-313aa54e7295", "value": "6144:gYa6C2z5avUGpbZcl+8dyKlUdaTdTm8FLGkAwgPodAC2otKObUqJGGl:gYQCavUGv38Yb6Y2AtAdFztKOnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694661321, "uuid": "602f48c9-953a-41ba-9eea-1688d8646734", "value": 388138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694661321, "uuid": "df0a5cf1-2d4b-46c5-a861-96f5fecb3820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694661321, "uuid": "b8c87e81-b08a-4989-9550-ef2f49478a80", "value": "01b5157dcb56db2036caf9cbec0c93f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7517f68b-52a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694658537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658537, "uuid": "e6701620-b2ec-49b7-8af4-69e86605d3a5", "comment": "Malware payload (RedLineStealer)", "value": "171f3b95bbb467f79211828af04caea9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658537, "uuid": "317d5b48-1d2d-4180-b478-38dc127ae334", "comment": "Malware payload (RedLineStealer)", "value": "4d7d37d8aa8fe79dc0d6362629030eaf4b5c9ab4b12b25af7e4eaa0aec67f91d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658537, "uuid": "cd3d05e6-4e97-4cbb-81d0-8c8111ed6569", "comment": "Malware payload (RedLineStealer)", "value": "af035f6618d6dcfc4d95c3869b3ebcd8c087a46d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658537, "uuid": "0420102b-1f4b-4c09-8211-eb6d2626b79f", "comment": "Malware payload (RedLineStealer)", "value": "b9ad7431c113d11371400f17008ad5247c5ba7b89f84cd0c5ccc64df03e1710429e64a21d244fafa299e35598d1469f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658537, "uuid": "2cdec0e4-7669-4978-bda6-451eaae626cc", "value": "T14504C6583647A97EC96F487E9C700CD0767CAC632242AB07988EF4E8797B7919F050F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658537, "uuid": "814d4d1f-689a-4122-8ba3-8956271a7270", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658537, "uuid": "2af863c2-4b0f-44e4-b686-d8e061a20ebd", "value": "3072:L2wokyQI0f1LHfORkZGHydQ1E0meWIrjX/JQ8e8hN:L2bQI0f1LHxW1E0drjX/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694658537, "uuid": "ae6a96a2-5631-46e6-aba3-c07059fa620f", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694658537, "uuid": "395727d9-7381-4bdd-ba2d-ecdff7104cf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658537, "uuid": "edcd613c-cacd-432e-90ea-aa73e456bbb9", "value": "171f3b95bbb467f79211828af04caea9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34658ae5-52b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694664442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694664442, "uuid": "b1b6c9a0-0bea-4e3e-9f82-6584c891c460", "comment": "Malware payload (njrat)", "value": "ef17e9505d21f198e22b4b221d3778b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694664442, "uuid": "df63cb2a-3559-4c67-b845-f21935bab36f", "comment": "Malware payload (njrat)", "value": "4f30d5ce5bbffe86314d9f9a60d2de416b0d85f07b7b9a96218fa4bb8c0aab52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694664442, "uuid": "dea5797a-75b0-4972-8ff1-2ed49242f48a", "comment": "Malware payload (njrat)", "value": "c2afd6367f95c9cfa5ef6a3fd242388454d5c66c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694664442, "uuid": "50d2225e-74a0-4488-a776-fdd0a34c27c6", "comment": "Malware payload (njrat)", "value": "c30675ca6df823e4458ac547b879a3788a93b4a764f52a65549c48146f2b30ec51d570384216b05653f66b88d7882d0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694664442, "uuid": "ceba38b9-41bb-4fc6-a5dd-171c5849fcde", "value": "T111E208067BE98215D6BC5AFC8CB313214772E3838532EB6F5CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694664442, "uuid": "0ced2f39-5744-41e0-bc64-ec71533c8ce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694664442, "uuid": "a5cf0e6a-9c8a-4a49-b586-f7e0c33466e0", "value": "384:s0bUe5XB4e0X+Od/w0Q0mS03AWTxtTUFQqzFjObbZ:5T9Budi55dVbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694664442, "uuid": "b3636b2b-a155-42b1-aabe-49c8e2706b76", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694664442, "uuid": "9ed8548b-90d0-4ef6-86e0-dce5b1329dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694664442, "uuid": "dacd37ce-3582-4135-aa26-63f418fe84e7", "value": "bPHM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d46db1-5292-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694650086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650086, "uuid": "fd8b38c6-413f-4989-991d-dab63ce162b0", "comment": "Malware payload (Mirai)", "value": "0c6bdcfb75799755c3ac73a8f759f735", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650086, "uuid": "d7ffc4b5-75d6-4ac7-af2d-dd71b012fa2c", "comment": "Malware payload (Mirai)", "value": "5043cb8e05c774047bb8667d001599a62cc1f441b9dcc6415e47e4d4e2dc6c90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650086, "uuid": "c6ac772a-31cc-4a03-bd47-4ace2cac8f83", "comment": "Malware payload (Mirai)", "value": "b9154b08b5410f501b475655f85416ad44666624", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650086, "uuid": "74586a31-f9d5-4fd6-8b8c-0191762fdae5", "comment": "Malware payload (Mirai)", "value": "8eb3129f0c6d65f5468e188c67aa7d4db00dd25b5862d615a1d273c7eaeda28d2933567d6dafcd21ca4cbe535c833a23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650086, "uuid": "723e7719-d272-4137-a259-b6c2ae463213", "value": "T16143F961BC915A26C5E0537AF9AE558E332077E8E2CF3227CC611B107ADA41F1D63F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650086, "uuid": "dff4260e-74ff-4f7a-8af2-41d30adbd8e2", "value": "1536:+n1pyUGLbFXsCmbnmcVBREee3mb1AVMoh+C+FPc0:+n/6Me2ZAVFhda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694650086, "uuid": "8551a95c-568c-4c9b-98a8-b2bbd34b0b53", "value": 58712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694650086, "uuid": "f41417d6-6566-4f5c-94e7-69713939eda8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650086, "uuid": "fa70f915-79a8-4dd4-81c5-7ed147635d92", "value": "0c6bdcfb75799755c3ac73a8f759f735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815a66f7-52d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Heodo)", "timestamp": 1694680033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694680033, "uuid": "37271661-5fbf-4869-bc7d-c3eaa6c7e875", "comment": "Malware payload (Heodo)", "value": "eb6c9dd67ac627ad54d1d9d98f6b779b", "object_relation": "md5", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694680033, "uuid": "c42a0df4-1f9c-4112-944d-46e0c714a5c4", "comment": "Malware payload (Heodo)", "value": "510af6dd87757c71cf084db4d924f5c7b6ff8cdfffc5084b98256b42078bcd5f", "object_relation": "sha256", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694680033, "uuid": "993dbaba-7f86-4e4f-b815-fcce50d30714", "comment": "Malware payload (Heodo)", "value": "253d0ec6919bffc194e1574806e3c8b1a7e7fcfc", "object_relation": "sha1", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694680033, "uuid": "0f581cb4-d32f-433c-a7c5-b3def153c8bd", "comment": "Malware payload (Heodo)", "value": "6ec087593197847a1c0ceb1b86d6421f41497ffd21277af6bfbcbb828d596e5bddd8fcd85ffd0e63e2f64a2335e50486", "object_relation": "sha3-384", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694680033, "uuid": "ab4e1772-e963-42f5-9a13-633855e0e894", "value": "T15BB523523E94C137E79B073645BF9BA5322ABC240731E0CF25A53DAD6B313C2A979316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694680033, "uuid": "5320cf10-23b5-4a37-9b73-b5c350ccadde", "value": "49152:ypUPhpzVy45pV1KnCx9HYMLEnYnHzIEdsvtyOABCRv4hMh:ypgpzVhpTKnC/4MLEizIbtUBCRv4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694680033, "uuid": "79eaf7bc-5760-4bec-b932-afa7dfea66ba", "value": 2347008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694680033, "uuid": "616d320e-aa31-4fa0-b004-0c65d3f4bf2a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694680033, "uuid": "7a2b7ac3-cf12-4dec-a2f2-04be22e548a8", "value": "darkgate.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db17fda-5293-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1694650311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650311, "uuid": "c015622c-00f1-4e9b-aab6-e9d40a6b4ce0", "comment": "Malware payload (NetSupport)", "value": "12e11aec09a12f714ccf9ab425ca70e9", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650311, "uuid": "69a7dd55-6af3-442e-95d7-bf4040b3fdb7", "comment": "Malware payload (NetSupport)", "value": "51ab827a541737c3612f61ec35e7c824a8f6df3a1b800dd0748c3f5a9901bc98", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650311, "uuid": "d86baa8c-3d17-4f2a-ba28-3ccd7f333df8", "comment": "Malware payload (NetSupport)", "value": "9dead6076a2dadf2c2b530038bd4c3f6c0eb5aaa", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650311, "uuid": "44522d07-2efa-4d2f-9ad5-b54a852dbd55", "comment": "Malware payload (NetSupport)", "value": "d99a788e63b6c27352fa97cc392454d6f191a3de40a550ad8ef0c7062df6a056c6d2ca9075b9c820571e5381edf6e21e", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650311, "uuid": "73f494a2-86ab-465b-a726-ab1a9757b844", "value": "T12D5598342979BC2847D7EE6335F04A950DE405AFE430393B1A8EE5768A762C125B12FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650311, "uuid": "b2a4e8ff-7044-4528-96ab-a10fcec0b67b", "value": "3072:rsas4u5vq277nFQX1OW9zBvG7+jY8iJgeUeBTfRtqvaZmcI2oZRa/FU:4aRu5vbFQXU653j0JDDDZmcI2oZRaNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694650311, "uuid": "ac69d73b-565c-4d5f-9565-de16522983be", "value": 1377667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694650311, "uuid": "1593d6e9-8e8c-4fa3-83ec-9ba41b92cf0e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650311, "uuid": "dae0fdc7-7de6-453a-a5a7-287600c129d2", "value": "ClientStart.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978b1965-532e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694717007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694717007, "uuid": "1a00662b-6c16-44f2-9e80-19dad7dbec93", "comment": "Malware payload", "value": "fefe1f121dca7c775ad46a48189670ea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694717007, "uuid": "b91488c6-c8c9-4f38-8545-e638ce4ea51b", "comment": "Malware payload", "value": "51bcbc305013e5b29cbb1765199a1df68e656352512206ca2c7a1fb3d8068865", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694717007, "uuid": "0be45932-2662-4914-926a-6941813b5137", "comment": "Malware payload", "value": "4c45bb01f80bf899e0056c9b5aae7de1bd9fef49", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694717007, "uuid": "af5ebd15-dc48-4998-957e-758741103df1", "comment": "Malware payload", "value": "a7c4dafc2bb48ce94417d204ffa1548d49c2985b9e10bcf7017c0ce34e3ecad91004dfc54e5ea2b7cc02ad5b2d0f6cff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694717007, "uuid": "fdd0fe5e-b6d8-4767-b718-279d8c2aea61", "value": "T1D7A50D5317D827370AD3399A244C608CDA7F8856D32A90A5F9FDC258281D468F369FFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694717007, "uuid": "9d79cc58-a3e7-4cfd-a6ac-2dc1f718b6a7", "value": "49152:k3HFBl5VBmtz5dzgTsY1YlYjYEYxYHYA01C/BL7o:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694717007, "uuid": "d8af0037-cd3b-4353-bb52-bd63f0f1d955", "value": 2197628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694717007, "uuid": "1395459a-268f-41cc-a2a0-04ee30e40bdc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694717007, "uuid": "72d23288-6474-45c5-924b-13977e128c92", "value": "Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abdb86a-5320-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694710918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710918, "uuid": "5f00ba53-c8cd-4773-b081-945f13592591", "comment": "Malware payload", "value": "5abb2872fdb53b4f6c4dde40b4f11974", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710918, "uuid": "407abfdb-6c0c-4ccd-b040-f0d1ac3ce35b", "comment": "Malware payload", "value": "522ef93b4d7fa03e2b8ccf91b91de23580b9a1ca054e406cb7f415672cf48c4d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710918, "uuid": "54399a5a-bb39-42aa-b1a0-a58c43a404f3", "comment": "Malware payload", "value": "085b1b7daed8e11b780603add6064dc7df712a29", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710918, "uuid": "a62542fe-74f6-4f4d-96da-63d7da2dd903", "comment": "Malware payload", "value": "c77c056bcd94ae362a501e0e710c1d7dcc6ba97e1a1a85e3fff182a353680e900ec87c2ee1093976d253e35b8b6ee207", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710918, "uuid": "9b902a77-8020-4e8b-a392-8772083843f7", "value": "T15084237110B676E9CCE686CDF2D19DACAAFBD8CEF064203A7E700693E845D57C619039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710918, "uuid": "5e1e5003-25f2-417c-b58e-f43aa50ca7c1", "value": "6144:r7OhTiZyYMe7/K/oJg7cHaTsS+ut5YrvXXCt3tXwzzBDZRhRHccd1NXTUIPOVY5X:1ZBH7/K/M03YrvXSt9XABptXYG5Lxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694710918, "uuid": "eb1322cc-c61b-4353-aad0-7e464123ce3f", "value": 397406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694710918, "uuid": "b78f7f62-1cf7-408c-8e58-35501a5d32cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710918, "uuid": "63b20306-5254-4245-af29-8e79fff48cc8", "value": "Invoice_09142023_7860786228.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce536254-52cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694675437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675437, "uuid": "11783c83-0963-4898-b227-b1e354816bb9", "comment": "Malware payload (AgentTesla)", "value": "8b906ae35de951cc2d12ece37ebdc3a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675437, "uuid": "2e8e020d-f698-471d-919b-2aac978634dc", "comment": "Malware payload (AgentTesla)", "value": "52b81a5a0c3fe5d856023b2c2fa5697000398082d9678e00a8844f693c24181c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675437, "uuid": "71465748-ce7f-47ff-8db0-87595f89cc02", "comment": "Malware payload (AgentTesla)", "value": "64c34a2d7fa696896a17ab968abc669aa1853558", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675437, "uuid": "2b1ab624-5f8e-4fd6-8625-925a871d322b", "comment": "Malware payload (AgentTesla)", "value": "9319f4acc07b9c3b37420be9a7245783c514a3b282ea86355f463a484e7aa1abb4a3d62faddc05386f3f2f8f28054961", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675437, "uuid": "68793123-d7fe-4b9c-a647-276ad4b5b73f", "value": "T183F4337DBC492946E9E485B10D823F243F4937F519AB80C6D15C8A604DDA9FF818EFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675437, "uuid": "72bf44ac-b654-4d7c-bfc4-fb9de9f6b64d", "value": "12288:utNuVn9ml90M1h3Kc1LGQPH/Hr7ZaZEliUgPfMLeKpNaITOzcyjdNP2oP8sBEo5:QulU9DVZPHfvZaZEcexNa7cCNP2oP8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675437, "uuid": "5fee1cf9-ab72-4567-b817-a9c7f7ec2aed", "value": 759709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675437, "uuid": "31e7b27e-ca56-4851-96e9-cfd899afd6d4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675437, "uuid": "e4055e35-2e00-4024-b204-4429b30eaa9c", "value": "dhl00782149.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b806a132-5292-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694650060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650060, "uuid": "fa04dd06-2c6a-4acf-8d1c-2188766e5da1", "comment": "Malware payload (Mirai)", "value": "748ce76892cee57fb6bbc869569fa39d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650060, "uuid": "0c8a8d2e-36a3-411b-90f6-b0dec26e4040", "comment": "Malware payload (Mirai)", "value": "53468bde277dc1b310fb808c5cb0d46c8cb647ea2aa4c944e45569c0627efdb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650060, "uuid": "d03ae718-fd50-4cd7-a6e8-af5290eee90a", "comment": "Malware payload (Mirai)", "value": "ec51c213a831b571b9f3a7024ec7bfabadb15594", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650060, "uuid": "5d228e17-bf4d-4e25-aaed-e5443a076427", "comment": "Malware payload (Mirai)", "value": "25d7be093e5f46bfeb442c4115f78c327819fa3cd00f1292d829da66041c1162f936b2a35783fe3899f53babbb998c0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650060, "uuid": "d344747a-5707-4416-9866-ca9fc5c63ab0", "value": "T10B733936F9392A23C0D1A47E11F74B51B6E11BCE36A8C61E7D720E4EEF616506412EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650060, "uuid": "fa451002-c57f-4e12-bc14-581fea260d2a", "value": "1536:pMsk4f4UnhcUt+Hq/OyFU3+STWJHsujO9uIRcOq:CskY+K/mT+MuWRcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694650060, "uuid": "5f6c54cc-0479-4156-ae9f-131b4d673c21", "value": 79792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694650060, "uuid": "5655f6be-9a5d-4c90-baa1-ae56ead70a03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650060, "uuid": "009a6abc-2bd8-4495-931f-56bf656636c1", "value": "748ce76892cee57fb6bbc869569fa39d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4294618-52d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694679259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694679259, "uuid": "35bf6d47-4bfa-478c-bb61-d71ededdbb48", "comment": "Malware payload (RedLineStealer)", "value": "17f49cdb1e24e847aca429dcc4f2ed80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694679259, "uuid": "ef0cf730-3536-4b20-82c6-215b014d8877", "comment": "Malware payload (RedLineStealer)", "value": "5351d265d8fa6b98b59be5067dcf00456debdc87818b973edfe310afc6bdc46e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694679259, "uuid": "ea0207cb-47ff-4639-bee6-8a5ca33bb3e6", "comment": "Malware payload (RedLineStealer)", "value": "18dc1275ff713cc2ca2ae26f1510be12389e8c9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694679259, "uuid": "2b1e2188-fd75-49f3-9780-65626ce584fc", "comment": "Malware payload (RedLineStealer)", "value": "608ce28865cf146bf8e0a64e3853984ae96ccbbef9ab897bfda1525289914ce73cfc016271629a78f76d014504f1f201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694679259, "uuid": "7c872bfb-0685-4fde-8473-d1da0b2b30c3", "value": "T1EA74015139A1D0B1D0E701399834C6F5623FBC73A5A1594B73283F2F7D31AE6ABA6312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694679259, "uuid": "317c1505-c3db-4045-bd0b-7d8a961c27de", "value": "ef163fd1a1dfd01940ab083fe4660afa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694679259, "uuid": "06037661-7939-499d-bfba-45970a896542", "value": "6144:StWLVglrwUfCB1refnrvpCDGFYooPovi+zTDIhZgX4EXBSTt4:GWalrSBkeNK7H8hGpxiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694679259, "uuid": "f3936ff5-6021-49f3-9fb8-8f4d82fad21b", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694679259, "uuid": "9b6ef525-3e4e-4e6a-b47a-6faf95d8f87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694679259, "uuid": "532ce888-e304-4c02-855d-344b4ec8c9da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3e0082-5324-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694712609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712609, "uuid": "4821115e-50f0-4ffc-b715-3ecb675e35d5", "comment": "Malware payload (Mirai)", "value": "e3c8b5018c4cc6f004188ac45ed99e30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712609, "uuid": "2d279c31-dd15-4993-b277-a9d11c2f6ab9", "comment": "Malware payload (Mirai)", "value": "53d39d19241df28342494914913ed518bae5d24d6f6fa08934533528004fed78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712609, "uuid": "92ba43be-ed2a-4b90-b6b9-b627bc432a15", "comment": "Malware payload (Mirai)", "value": "762e373466cec80a81c041e84d905aefa9ee0af5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712609, "uuid": "34453aea-05e2-413e-8a68-6060b4dcaf81", "comment": "Malware payload (Mirai)", "value": "4f7ab245e4362b565446ab6b363550a36e72c7cd5ba42bc77d64807d3075d1c5cb31ee900261cb282c174d7880eb2685", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712609, "uuid": "8e6eb714-e84e-48f6-aab9-e4867c19d16f", "value": "T1AB431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712609, "uuid": "a5b81301-dd7e-4957-8812-48e790bb6f83", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwj:RqtmZPuutfbltZFBSJsBcfDSTFI+BEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694712609, "uuid": "882aaaa3-46f0-41ee-bba0-9e5db14925e2", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694712609, "uuid": "345bab7a-8d84-4735-a654-1caa953719d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712609, "uuid": "fd2bf142-c325-4660-b66d-9d37188d3e0a", "value": "e3c8b5018c4cc6f004188ac45ed99e30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a075818a-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694703278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703278, "uuid": "55d48bbc-1190-46ad-a46d-0a485b813f3d", "comment": "Malware payload (Formbook)", "value": "68da0fc8238154152646c59bb3bc5eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703278, "uuid": "6fdcd218-1cdb-46af-a7f6-5d9837fa5c44", "comment": "Malware payload (Formbook)", "value": "54f5267dea7dfa571027e7ec1f9e8518231c8a9baff0cf49e098ecbaf86e051a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703278, "uuid": "b3bb6cd5-598c-4ac3-89bf-91444727a255", "comment": "Malware payload (Formbook)", "value": "5fb2ee22d31f84faaaa57c0562cf800c99397622", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703278, "uuid": "ac0915bb-090a-45b2-806f-72f5a2a4c190", "comment": "Malware payload (Formbook)", "value": "872e3e2517e10e670c48dae6bcba7c0b5a814ecb79e64040ed18b1bb2d8d274d67d56a54c54bcd7465921b8a25de780e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703278, "uuid": "0e0d85a4-27bc-47f1-8781-add3671ca7db", "value": "T1FC253BF563B408B9E4AEB57CC909B3D00DFB6AD96C64288995B93C4B19B7F503B2401F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703278, "uuid": "d47d265f-2718-43df-9122-b2e0698e12ef", "value": "2ee11402fede6929cd719a165d19a6b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703278, "uuid": "024cf94f-ad0e-417e-ba84-d38a81bac1c8", "value": "12288:+L5nRsetSwLTUSkRj2keaAigv4ixgKbR5hjy3H31RDHW4Qek5Dko:+RHSMTL3aKAod5h23H3fGes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703278, "uuid": "4e9947bf-f6a7-49b9-8a71-110fe5156793", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703278, "uuid": "572954a3-b0bf-485b-8677-61a3da5d3d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703278, "uuid": "d95ff151-4f1f-472d-bc32-45d2d277730b", "value": "0037827362762.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c225b99f-530f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694703764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703764, "uuid": "88c74dd5-0b21-41d1-b5b7-4de97ffa3c67", "comment": "Malware payload (RemcosRAT)", "value": "4109f03cb97ec1a10b10462b3a1cb072", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703764, "uuid": "dc658f1a-330b-4e70-aad4-f696fc0c8c61", "comment": "Malware payload (RemcosRAT)", "value": "55e92f7ce36eead273b0f804c56c6a5f2b3f88e8e9b9c2f6a89ef4149f7d5158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703764, "uuid": "2944eca9-ab7b-41b2-a548-9ff23b566ef3", "comment": "Malware payload (RemcosRAT)", "value": "a3d41c3b5eb60607fe3bc2fece01b28cf927357c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703764, "uuid": "62fbb52b-e37a-454c-a7ef-b6d6fd732acc", "comment": "Malware payload (RemcosRAT)", "value": "ed5360bde48d3a55f4af7b5d813560dc5b4a807ea11fb8219951d29e2c540720bee029ac8969a222dadc64b2ce586e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703764, "uuid": "565fa350-c89f-4585-baea-e2b2e6dc436d", "value": "T12715238432504263D7626B305037AFBB6F61FDB0640416DA27B3FA6E7B7D3E9096A341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703764, "uuid": "4f3682ca-e01d-4266-8dac-c9a4fb71311b", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703764, "uuid": "4024e1b4-7bf9-4a09-b199-92b7f4c469a6", "value": "24576:giSNaEGevQ5lFv30L5PfUiL2yLEYzHkUGhb36/:hSNM5U5z2yLREHtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703764, "uuid": "51d43149-f97a-4dac-9775-0b52ecf9ec8f", "value": 890400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703764, "uuid": "49e7b321-ca0b-49ab-a83d-c4ebb5232f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703764, "uuid": "e76ca3c1-6190-4af1-9e92-9d99cdbc7e09", "value": "[DURAE] INQUIRY_20230010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f901f0e4-52c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694669925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694669925, "uuid": "6564e514-b62e-4448-8705-daa5d9a4f8fb", "comment": "Malware payload (Smoke Loader)", "value": "f4d73b7bcfcdc85f236054d09e6ad097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694669925, "uuid": "0a86f26e-1c88-460c-9e0d-293e22a3405b", "comment": "Malware payload (Smoke Loader)", "value": "57023d355566b1bff7490a5bc5c4380e013b2b4fb68152c8118be21718e53329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694669925, "uuid": "3656f46b-18a4-40b2-a414-67f3a26e7af6", "comment": "Malware payload (Smoke Loader)", "value": "2a7159b0a2efd5f912886bc6bc2e0d29cee577b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694669925, "uuid": "a4fe6bb1-a64f-4c7d-9a45-30234a6b158b", "comment": "Malware payload (Smoke Loader)", "value": "04e9aa84a8a1e0825fef0b475eb681ef9a47d85e8cbb4720638e869f02afce878c1d35eb1a7078f426900b69b6440635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694669925, "uuid": "f37a3323-ee07-4a95-b43b-575327ad6ce8", "value": "T18E545A03AF907D60D5254B7A8E1EC6EC3A5DB961FE59377A221BEA1FC8700B3C162711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694669925, "uuid": "c0e310c5-b842-4cd5-8f1e-52528a126540", "value": "3c565fbe4eaafad8572e17176ac3eb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694669925, "uuid": "61020bec-4b85-4971-8f9a-bc34f7a005aa", "value": "3072:n2ufjT/ih9nQU/HGZg2fB8Ik5ueI7DwLRc9P2OIC/IM+FURL3:xfvih9nd/H7221udnwdclP/I0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694669925, "uuid": "1f4f3982-8b28-443c-8e01-56c4207df778", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694669925, "uuid": "7794c4c8-d4a9-4871-9a2c-d9ac9cad5f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694669925, "uuid": "893d7540-1b66-4d38-87fe-468a63de89af", "value": "SecuriteInfo.com.Win32.DropperX-gen.3148.24898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a96bfab-52b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694663217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663217, "uuid": "5f6752ed-5fd0-47f8-94a4-a6dfdd7136d0", "comment": "Malware payload (Amadey)", "value": "8e870fbe0d5856806043cba7d12a1cde", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663217, "uuid": "71421fac-5499-47a3-9fc5-eb7270eddaae", "comment": "Malware payload (Amadey)", "value": "5708789b5fb5f47fa7a4f585344620ca294a6c8f3c26a5b27064ce9ddfd19803", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663217, "uuid": "82f6ea4b-363b-46bc-b52c-357b0201516a", "comment": "Malware payload (Amadey)", "value": "8237b8be858849def3bd092a6722fb56db5eb03b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663217, "uuid": "c2ff7631-a5d5-45cc-bced-2c8b908ee4d1", "comment": "Malware payload (Amadey)", "value": "7f604374f85252d4ea8590271b66efe187c191ec5751af15f30c586879dbed9079a951884659e33eab183f2c7a04b25a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663217, "uuid": "a6e77d97-e7b0-43a9-94ce-9ec3c2a891b6", "value": "T1518623AC6B4433ADC01E80349933ED87B1B3952F5ED9B5A573CB7A907F92720DA46B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663217, "uuid": "e743e51a-bdb7-47cb-b5f4-c913932a4ab9", "value": "ee26deb5354c4489ff0dc7547168b2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663217, "uuid": "28b30ecd-4a55-4b3a-a171-3c154fd3e6ac", "value": "98304:wjvCRiSb+M+SpLE9bct5iANzolmyLsaIU07sQcLp2PaxsZMosxzRlbyHcP6PlpFd:84/+uJREjweAsQuAaxsZMoGTP6P9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694663217, "uuid": "3a2d804e-0750-46e2-a349-cd153a0d345b", "value": 7947264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694663217, "uuid": "9f572a49-cbf4-440a-b036-a3d886bf5433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663217, "uuid": "322bfa87-1601-4464-bb26-32755b87d0c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d874d3-52a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694658275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658275, "uuid": "1327fe94-ea35-44b1-b177-91546e7e93b6", "comment": "Malware payload (RedLineStealer)", "value": "69c0ce8858c37ee1e29fbeb4d0acc928", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658275, "uuid": "046e7305-c917-47ab-a4cc-00cadbed8ce7", "comment": "Malware payload (RedLineStealer)", "value": "58334b23c64f5926faf1201c6875c2b44d60fa9ba85fba7ebc15f1ccabd0f803", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658275, "uuid": "11a611b0-5989-47ff-9cff-e0fe95e8aa7b", "comment": "Malware payload (RedLineStealer)", "value": "ce762c0b569a59bbd8f8aee39eb56ca9be5421b6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658275, "uuid": "1e864a0b-9ae3-4210-896a-000e755e4534", "comment": "Malware payload (RedLineStealer)", "value": "d14d16626ec186c4b454b63e0659ef1e44f32cfd2cc9ba2990c8b2a9b059354e93d4c2b70df315a0244e35b01afa79a4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658275, "uuid": "28218155-b045-4ca4-86cd-623c2f5727cc", "value": "T1C154AD1977A910F4F1638278CD550A46E6B2B8190761A68F13E047BADF337E0AD3EB71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658275, "uuid": "e99ee4e2-cf42-47d3-ab50-47c9a0420904", "value": "8a8dbe6ecfacdaceac22d14c24917858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658275, "uuid": "1eacc528-d502-4b74-ae8b-590130812a6e", "value": "6144:CV+4tt25MIRakGNhYPu2p3QrhVaTpo5iL:U25MIkkGNwPWr7a2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694658275, "uuid": "c68ad3ae-47c7-48c7-aff2-40617a5377f1", "value": 292792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694658275, "uuid": "c987be46-b845-4005-8ca4-cd736ce55018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658275, "uuid": "83d25aa6-82c0-45f1-a5b3-c995ef954221", "value": "69c0ce8858c37ee1e29fbeb4d0acc928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e92c463-529e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694655171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694655171, "uuid": "46a4fdf7-0e40-4dad-8505-3a9e0bf4a560", "comment": "Malware payload (RedLineStealer)", "value": "e6a8c5e4b835072bdb7dd4561e3c33da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694655171, "uuid": "d590c746-8115-4f93-9d85-8e1f99290bd1", "comment": "Malware payload (RedLineStealer)", "value": "58c8fff83626e795b483897e11ed8e26f4857835982c0f49da3938ec6bd4eaf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694655171, "uuid": "56d70ac0-065a-4e78-848a-561bebf85faa", "comment": "Malware payload (RedLineStealer)", "value": "4a567fdbc3b87212dab1f59d829721e0b5bd64b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694655171, "uuid": "3e529746-4b53-453f-9469-da02fbfbc90d", "comment": "Malware payload (RedLineStealer)", "value": "81288e4b4b4e44e0700ac9f1b00f275fdc9102dc50f08a369374ad1b90be1ee424f0f2269cbdd1754a9a0c0a13ea3d41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694655171, "uuid": "686d2812-2ed3-463b-a39e-872d62229150", "value": "T12F15021176C18833E9B225358EE49AB9E82FB4A487524FEF2BDC477F0E143D2DA31549", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694655171, "uuid": "a93ca56e-d847-48ad-a725-b405a058a810", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694655171, "uuid": "654ee417-3415-4269-8a8a-b948e6ab70bc", "value": "24576:NiuBtZeHJ6uIHo1j227DjygKxdp8b8nqJt37X8:guBfeHJ7D2g0d+bqqHrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694655171, "uuid": "703d84ba-83ee-4205-8134-1d66a70c0d60", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694655171, "uuid": "f0113ca8-4434-4db7-8c37-6be59934356f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694655171, "uuid": "28b92018-3180-4347-bd07-c29552e7c48d", "value": "SecuriteInfo.com.Trojan.Inject4.61027.18253.7494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e28f039-52b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694666257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666257, "uuid": "df58bf50-1843-4964-be69-d39336ad0034", "comment": "Malware payload (RedLineStealer)", "value": "224deed978201c9667eb01cd10a9c722", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666257, "uuid": "9b685cd5-d85a-461e-b47a-511d3ef02ec6", "comment": "Malware payload (RedLineStealer)", "value": "5a2b1e44a58a0315e6b86f34d2712570c6363959368a9e38efb0a9a958356672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666257, "uuid": "44115216-57f6-4520-a21f-3e89a7cee4d0", "comment": "Malware payload (RedLineStealer)", "value": "b47155ea5ce8f7bc712f5b8f2411e58520045f68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666257, "uuid": "5a1a9390-eb2c-4b38-af28-108561535659", "comment": "Malware payload (RedLineStealer)", "value": "33faea1c573ad98c6ffef1799983e690999694c6c6ca6dd3423a51e62705c9416d0472794aca4eaa28d366eb46bb545e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666257, "uuid": "4bdab6ef-85d1-4e91-952e-8228d1ddc72b", "value": "T1D115010170C0CC76FB6752354AE89BF5283C78A05B5AADEB17A41B7E0F602C1C97F666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666257, "uuid": "c43f4e49-b652-453b-bd2b-ef9fc5e7368c", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666257, "uuid": "85511c04-268c-4fc3-89a4-22169934a30a", "value": "24576:ciuBtZdtibXtDVSRAdjJpFX209mL30ni28T+:LuBfTUXtpSAmPZT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694666257, "uuid": "428f624f-6058-4bc4-b2fe-66568db21272", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694666257, "uuid": "9b89c71d-1689-46a2-b5a8-d8e9f2d372ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666257, "uuid": "503c8e06-42f0-42f3-8dd3-8843f5655345", "value": "SecuriteInfo.com.Trojan.Inject4.61027.16194.11716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecf98ae-5314-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694705691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705691, "uuid": "f2e9fd7e-1273-4f17-8023-2a2b8eb4ce8c", "comment": "Malware payload (GuLoader)", "value": "aa6602c07de3a05603370c125da3d859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705691, "uuid": "bd540ea2-32d3-4a70-8154-b4710667dc01", "comment": "Malware payload (GuLoader)", "value": "5aa83410807241926fc5e3071a793699d025b308f082515a01431c53b02e689a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705691, "uuid": "19901eae-667d-4a4e-aed9-87dc92b98de2", "comment": "Malware payload (GuLoader)", "value": "de873f5a186ca68cde414a0fc237118c4fe0ca24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705691, "uuid": "8366a873-95dd-45fe-ab6b-71835b14e78d", "comment": "Malware payload (GuLoader)", "value": "0b676a11b86a8c55a6d63795c741f0bf37da71071ed17f09beb0ff645f25067b906d73f83a2e13642938e09ef72ab9f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705691, "uuid": "6bf20e46-eac5-423e-9454-84494e554e9e", "value": "T182B4D02E654CC9DDDEC7663AC890358CF2B35A56CF4300BD03546E861FA5E79C6A0BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705691, "uuid": "8c92665c-1e41-4007-9ae6-6ce19b7dbcc4", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705691, "uuid": "9d0605ea-1f78-44f2-bd33-da11586e0636", "value": "12288:hhtN9eZzji6r51TRpAqQsq3EPIZDbrqKcP8ugQ:vpeJ26rdzQhUAkP84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694705691, "uuid": "857a126d-c7b8-48ce-a619-c4b7b351a20f", "value": 512024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694705691, "uuid": "9a9748ae-b552-4baa-9728-8ffdfacc3a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705691, "uuid": "5762fb21-9c24-4a66-8d97-ac1f44e2c563", "value": "SecuriteInfo.com.W32.Injector.CUMN-3513.19314.24175", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61290b26-52b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694665805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694665805, "uuid": "01feb03a-cea9-4a88-93fd-d50ecda740d6", "comment": "Malware payload (RedLineStealer)", "value": "9cdddaae7fcc5308b9c486cd48c81c52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694665805, "uuid": "05fd78dd-f13a-436e-a4c0-dc1731535854", "comment": "Malware payload (RedLineStealer)", "value": "5b51fa7f29828fac3d89b78a1978c0734acec5ea232f84e761f02fa0afca2726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694665805, "uuid": "ceb8a3df-d089-411c-806c-92509acaec65", "comment": "Malware payload (RedLineStealer)", "value": "c39b07c7ad7b062c463249235e0962388e0b83e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694665805, "uuid": "21bdd55b-acbb-4142-a809-62150c3d4075", "comment": "Malware payload (RedLineStealer)", "value": "9ad991fbab2ea0a448c435fdb99cebfcbf6d91be3939a019ca1f921ae8802eb23db48a0f60c168eef5c36d0376bb79ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694665805, "uuid": "c09347c0-24ec-42b9-82e8-34ea48d37b92", "value": "T16C5512A038848172D87F5B3146D4FA74863DB86103A79DEF27A06BBE4F653C3E231566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694665805, "uuid": "f6bc20af-ac03-4bc1-ad2a-4d645d483a13", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694665805, "uuid": "39bd2c37-7878-4cb6-8be8-fd6aceeee35e", "value": "24576:2iuBtZZ/pc64FIMpcnHACqA8O+owwgV23EsttB3osYDsCy87CXUsSbAA2l9OFHIO:luBfZBc6aIMpc38O+owwNhosYDjySIUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694665805, "uuid": "981f35dd-5346-40a0-96e9-889aeb8f66b0", "value": 1408512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694665805, "uuid": "ee65cbe4-b020-43bf-85e0-9e7ee4209f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694665805, "uuid": "41d17f33-e8c5-42fa-abca-7fd7bfdcb8a9", "value": "9cdddaae7fcc5308b9c486cd48c81c52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a945c86-5345-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694726863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694726863, "uuid": "cd20881c-0633-42ec-a979-dc73f9264e3e", "comment": "Malware payload", "value": "568ffcfaa64ab5839567cd712dc89f3f", "object_relation": "md5", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marstealer", "colour": "#699C88", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694726863, "uuid": "0d346a92-d0aa-4f20-930b-202b8a3c0128", "comment": "Malware payload", "value": "5c860b74570161b2dd12484a69682907e6f48b163094be586e06fad45d580a03", "object_relation": "sha256", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marstealer", "colour": "#699C88", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694726863, "uuid": "0004c271-6318-4d01-a238-9c04c1c3f6c7", "comment": "Malware payload", "value": "54c20e8c4cd9ea9bbc2ad0556a123ec83538010e", "object_relation": "sha1", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marstealer", "colour": "#699C88", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694726863, "uuid": "393eab95-ed76-4cde-94ad-c9b42836217e", "comment": "Malware payload", "value": "73da15c07940cd614602fd0797df5f6360d649d7febcad2e316ad410b41c8610a611805c270527050996134177b8e401", "object_relation": "sha3-384", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "marstealer", "colour": "#699C88", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694726863, "uuid": "4b89873c-1123-474d-808e-ef0d4b911577", "value": "T1A496382439FA501AB273EF994BE479EADA6FB7733B07646D105003864723981DEC163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694726863, "uuid": "4b7addf4-092d-4ba0-a4bb-2d8314895989", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694726863, "uuid": "78cb3a9d-18d1-4499-96de-bab12e85580f", "value": "49152:Gdy+JISTQVusqLcj+Tc9X32FG4IQ8316uEtncZsdVby8kikrduPT803A7/01XB09:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694726863, "uuid": "b4cc255c-4f58-46fe-b00d-536da16079c0", "value": 9299456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694726863, "uuid": "fc26d143-8089-4a49-928d-696d7ff921d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694726863, "uuid": "d1f4330e-f9b4-475c-a7ea-751c97742e58", "value": "CuteWriter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501f2b19-52e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694683386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683386, "uuid": "45d0315b-1cbe-4acf-8647-158452800b56", "comment": "Malware payload (AgentTesla)", "value": "04cd2040b4d43189f645f8c6ebb5bb4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683386, "uuid": "38d01882-3de1-41a4-bd21-55d207edf76a", "comment": "Malware payload (AgentTesla)", "value": "5d200010b1e304c628c669df531476f099b0ca944a1c52e5025f6fc1af16ad1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683386, "uuid": "dc553d40-e7b0-43d2-8d4c-301f2dd37d09", "comment": "Malware payload (AgentTesla)", "value": "76d75c9a14448f60dcd9df95eb83c3ddad7a8b28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683386, "uuid": "23c1b99a-9d7b-4a19-82e0-ece5bfdcdb00", "comment": "Malware payload (AgentTesla)", "value": "3ff10dbda7a3938adffa35bfe9e17e4138151343a0d2cadc99451b244f2fac59587b97b22ed5f8469bbda5407a1a30d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683386, "uuid": "30be0f0c-dc21-4a98-9f64-20c40c03724b", "value": "T152D4238B32E4971BD0FD5BF1C4B0A1884771A6175264E74E0DCA70EC671AFD22268F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683386, "uuid": "cfa34de5-d803-4a4c-9f42-c90602480608", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683386, "uuid": "79c82b17-b66e-4344-99ee-227cdc0a8e1c", "value": "12288:Kv+j8FwLm/4DRp5gvU1M9JUbMkUdHF6pyrZySKbxDPrD+2Sk8gIp:Kmj8F6TtZ1uvtl6pMVKZrD+2L8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694683386, "uuid": "f00cbbb7-79d5-47ba-b130-f36d09f6d875", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694683386, "uuid": "52638b07-9843-49cf-8aa9-75303d506372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683386, "uuid": "f8de0021-acef-4d7c-9631-142b6d972a58", "value": "SKM_C335019110710.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b0d489-533c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1694723119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723119, "uuid": "0f7a2e0f-91bf-470b-a881-dcd7f13fe34f", "comment": "Malware payload (RiseProStealer)", "value": "9c812833cd8995513fa9a8b8de45d025", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723119, "uuid": "d313fb44-d0f7-43cb-88c6-6f3e1164d6ac", "comment": "Malware payload (RiseProStealer)", "value": "5e0be577617f189eb5f85f6e7d8040742b22c6dd806d0a1ae06db7a730361e27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723119, "uuid": "878229e5-9be4-43de-adff-3af86ba9e295", "comment": "Malware payload (RiseProStealer)", "value": "69ea609942aebe5ad4c7124058884ed03c809c61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723119, "uuid": "da51815a-e718-4c7c-978c-70982a0f0054", "comment": "Malware payload (RiseProStealer)", "value": "2af7bb96a69a7db9124d9f6a7543f71f25a12996a77f526c242122bfde261d9c9017363001e7a3a535b7decc291834b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723119, "uuid": "7cfaa1e2-eba4-4cc1-988c-30b3083325c0", "value": "T19AC4209D366076DFC86BCAB2DEA81C64EA607477871BC217901312EDA94D98BCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723119, "uuid": "256c1025-56db-44d3-8e6d-b0f906bb57cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723119, "uuid": "6bc6f5bf-5bc3-488c-8865-f0408f7869fa", "value": "12288:gvN5t4eoS9uamzDgZOwlRy2ZLZov5kTGJorAntVZKPMOsivwpi5Kw7JURFqOHkpf:CSzDclRyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694723119, "uuid": "42db97f1-ef2f-4f02-b0c9-30e43728bfcd", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694723119, "uuid": "d97fcbc6-6a8a-4000-aeec-45afb9dc13c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723119, "uuid": "47bf06fb-2d87-4eb1-b43f-5b23ab35c520", "value": "9c812833cd8995513fa9a8b8de45d025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f828fa-5310-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694704275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704275, "uuid": "86d2df0c-8ef3-4447-b653-cd9924bb0a04", "comment": "Malware payload (Mirai)", "value": "01c35f3286f0d231f5e6102dbc708f8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704275, "uuid": "72093670-4cc5-444f-bfb0-ea2a735bda62", "comment": "Malware payload (Mirai)", "value": "5f492441339109b98dd407cb9092899f090bd9e7e5897c4f53d1b5f2cb69c018", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704275, "uuid": "0283a317-2e8b-4ff8-bb12-de6f18222359", "comment": "Malware payload (Mirai)", "value": "c8d07aab8a16e949c4de24bc5259712b20bb4527", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704275, "uuid": "0dc53e8f-e2b1-495c-aef0-9747e63b658e", "comment": "Malware payload (Mirai)", "value": "1da088af1eb6235fb398f9ed82628661fd1c2bfd032595936ffcdaace22eb54fd7497bdd8c9c2a3de4c7a8ae9466cf23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704275, "uuid": "b78af14c-2350-4b1e-8870-20172eac3c2b", "value": "T15782DF20119B75E5DBE14430FAAECEC6971A0BF9D1FC36931658BB7CC94250611F82CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704275, "uuid": "601f0d89-b4b4-438a-a57a-99f3939caadb", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa+hymdGUop5h5lp:6/V0P6+kom0tVAoNvm+to1+s3Uoznlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704275, "uuid": "108e9cef-ae0d-4726-9c4f-dd1578525c72", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704275, "uuid": "4b637c35-cc81-4941-b35f-8108b26adab3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704275, "uuid": "225d7998-5a48-4d0a-a138-e7a133cb0d6d", "value": "01c35f3286f0d231f5e6102dbc708f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e1ce5e-5302-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694697948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697948, "uuid": "d4cf4eab-2426-4dbe-896d-4fa758de802f", "comment": "Malware payload (AgentTesla)", "value": "c2c93c43cc1d698abf6b99c9230915c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697948, "uuid": "5c68818f-07dd-4c08-b624-fa9357f75cd2", "comment": "Malware payload (AgentTesla)", "value": "5fd07dc149245f0e030ebc164f54ab264c41afee13f1015c59bf3bc10fdbc37d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697948, "uuid": "51b54996-4045-4f3a-af77-fbf3df3dc926", "comment": "Malware payload (AgentTesla)", "value": "9438317b95f0872d31b96615a21d72dec56d8cef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697948, "uuid": "e04163c7-be51-4a52-9516-d55b77d7036c", "comment": "Malware payload (AgentTesla)", "value": "fd3050133125cf45a3a97dd3bf1ef4bf1f254fbc2605cb78ca581b05280ec4f48fe131a3ed9aafc9fd1a5e5d6b03b9ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697948, "uuid": "2f47cbf6-45ec-4d18-820b-c6682e1fe4b7", "value": "T10374DF1062EF588CB2B37F621BEDB6E58F5FF7E12626519D2404030B9B62E84CD95732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697948, "uuid": "1f476dff-8384-4118-a394-e8e8d0059ab3", "value": "6144:xRR+KKKKK/abmKKKKKeKKKKKbwOKKKKK8KKKKKIKKKKKxKKKKKGKKKKKpKKKKKZO:IKKKKKvKKKKKeKKKKKVKKKKK8KKKKKIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694697948, "uuid": "41c72615-1aac-4805-a17e-538b3435d63c", "value": 354562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694697948, "uuid": "2ba4c2a8-6ff3-433c-82c9-f940c0175cc0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697948, "uuid": "a0e927f5-a81d-4684-8bfd-d5503ad8c6b3", "value": "LHU.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f415000-52ef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694689908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694689908, "uuid": "cb7c999a-a1ff-4361-9eb1-1a326a314b4b", "comment": "Malware payload (Stealc)", "value": "a8ef33f60772ebeeeeb85eb64403265c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694689908, "uuid": "0c05bec8-1290-41b8-ab09-8dcaee7ad076", "comment": "Malware payload (Stealc)", "value": "60514c1c51b359839c67819246b09fbd861afa3ff772ad93bf466fc3acab642d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694689908, "uuid": "2902dde3-26b6-4062-838d-f73e18c8bb8b", "comment": "Malware payload (Stealc)", "value": "cb166d55759c53538bd4a5a2dfd722ee174fe857", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694689908, "uuid": "eb26cd18-ddd4-47de-820a-15ebcc4c2165", "comment": "Malware payload (Stealc)", "value": "90499c97243324d15d4c4589bc87676f30c1e91ebf358f33aa69daabfbeb6bcbad4f5a32278725bbb0a9f55283bf6ab7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694689908, "uuid": "6580f51b-2ac4-4e9c-ac66-3232ac2e106a", "value": "T14614CF1639A0D071C5A741379474D6E0EA3BBC63FAA5854B37243F6F3E312A26B66313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694689908, "uuid": "46a26300-074d-488a-bf43-29303fd34413", "value": "0da159e8cafbc91f7a91683e99c0a805", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694689908, "uuid": "2729c056-9dd2-4270-8db8-c474010a296e", "value": "3072:ghRKL3TJZZachqyIQYASy1w/gNs5Df2pCYX5aSHkT3d49:YRKLjbDhNtbSy4gNs5DhYoAkTt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694689908, "uuid": "2807b889-b996-4884-9757-8fa09c1a5408", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694689908, "uuid": "5e4cd2b1-1284-4562-a027-bd41c40dc356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694689908, "uuid": "cc33bb56-e41b-4952-bf81-962507442452", "value": "a8ef33f60772ebeeeeb85eb64403265c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b1a759-5318-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694707345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707345, "uuid": "33882feb-b2af-415d-abd3-ad4bde170c79", "comment": "Malware payload (AgentTesla)", "value": "0316ccb6e45d56a03c88c6e7dd1e41b2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707345, "uuid": "1d7f1966-9b0d-4c7e-95bd-cc73b8f43adb", "comment": "Malware payload (AgentTesla)", "value": "605e93a277ba5e5b236d67136133ce6f6057cbd435ac89ee204d53d7ae6d0c90", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707345, "uuid": "e67b0f5d-a224-45c5-9391-dd2f0c23fe85", "comment": "Malware payload (AgentTesla)", "value": "41d49dc51a44230967cb4e2aa487c199215fd164", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707345, "uuid": "695a73b6-fb14-4775-a775-36e238f88bca", "comment": "Malware payload (AgentTesla)", "value": "7edbb26e96b221c94994b1ece3569985f90457310e27cc84de99bf57012d9647fde67dcc71c512adb1d795f57a9d9369", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707345, "uuid": "7b3bfd43-c913-4117-b942-25affbbf7013", "value": "T140A423B7384ECDC1D498E176F6CD1FB1A0BB0962905A830C69A44AF8FB7DA5CE439458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707345, "uuid": "18f771b3-c919-4972-9ec9-5f42b5adf6b4", "value": "12288:6PCRIj5K4hX808jydlfjTT1lNcWSg4WJECbth:VIjkf01l71lNlhJLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694707345, "uuid": "73d55898-2d02-47bf-b86e-1a0a9125469d", "value": 464235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694707345, "uuid": "1b84f32d-1e8b-4516-a09f-296f0b902090", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707345, "uuid": "16ad0fcd-8076-4498-8a9c-d5bf50ae5910", "value": "Invoice 05-69400 with Po.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36327fc-52f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694692599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692599, "uuid": "c93ff016-8070-41c3-939f-a6e36c2c4c5f", "comment": "Malware payload (MysticStealer)", "value": "1012df921cf8a8234ae93bb6b2d9a111", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692599, "uuid": "42f0e2d1-098d-4536-aea2-7e5231eee20f", "comment": "Malware payload (MysticStealer)", "value": "61aa16de4ea3a6c863851dedc64154b5c73a2f0cbec55ed291d1b45f9f99a34d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692599, "uuid": "5f2cf3de-3e8c-4d37-8494-fa9d348745e6", "comment": "Malware payload (MysticStealer)", "value": "212343f105b80c48b6d8a77bf3fe04021d136385", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694692599, "uuid": "8bf1798a-4a61-4381-b8ed-0c4a371fef41", "comment": "Malware payload (MysticStealer)", "value": "9cff476394933c20076b2567f97ef68689ac39748e96f42e1a517aed3b7fd355280dd9269a639395b1afd34c2c21a60c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692599, "uuid": "fe12f0f2-de3a-4353-a3b6-ab0cb7ecfef8", "value": "T14C152392F7E46026C5B41BB59CF613C30E33BE928D7D82963B885D5A4E722C4687533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692599, "uuid": "ce20920e-0bfc-4cc3-aeb4-0092f9d04c8b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692599, "uuid": "72d77626-8a04-420d-8171-9de3fe981882", "value": "24576:YymZBF11Sct0MyEX53xAJ0RXywhiEKUSSf:fmHcctSEX5BVRBPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694692599, "uuid": "2c436ca0-5453-480f-8459-64bb18f395ae", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694692599, "uuid": "555fa1a1-e52f-47b3-9223-9b53f4444fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694692599, "uuid": "e499122a-11f6-4c54-bb3a-86a27b112862", "value": "1012df921cf8a8234ae93bb6b2d9a111", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb85ac4e-5302-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RisePro)", "timestamp": 1694698276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698276, "uuid": "864a3714-0afb-48bc-87c7-37c73ac86a8b", "comment": "Malware payload (RisePro)", "value": "ff1ca929fe28719fd5130eed0fdd7eca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698276, "uuid": "207d8ae8-b180-4c41-8d05-c62abcb2bef9", "comment": "Malware payload (RisePro)", "value": "627e568c0327896d75d3c5a03546e48c8b8fb11b1608bb7740e3cf537bcb3f95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698276, "uuid": "20cdbd68-6ba6-41bd-96a0-caa736ef0ccf", "comment": "Malware payload (RisePro)", "value": "62a9bd920b1bc1ba09594e4918333cbffb3a661f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698276, "uuid": "06d7b21b-4e0a-454f-b3d1-da46e61876ad", "comment": "Malware payload (RisePro)", "value": "1d56bb30b9420fd464fc8a7a2019105c0f269552d172f956414d6b9f8623f6aa3a4be2e90504481235a47e749a882ea3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698276, "uuid": "91b08617-1f4f-4a87-8bc4-9887579ec120", "value": "T1D1C43F9C366076DFC86BCA728EB81C64EA6074B7971BC207941311EDAA4D99BCF150F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698276, "uuid": "b231c174-894d-4bba-9d42-7bd55319d734", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698276, "uuid": "53d15f00-37c6-46c2-a922-535a1d4fe6c1", "value": "12288:GE0JumCZY0gWUEBtDaN1F2tKV8t8JKwjPH1Cguzeo7JSsQ4+woDtCpIZVuJj+cZI:pBgd1F2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694698276, "uuid": "7abf30cf-a821-455e-a327-2d32dbe71018", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694698276, "uuid": "31a990d8-e2c6-4f24-84ec-f8acf248c0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698276, "uuid": "ba4ec991-9e69-4e56-8c7d-f31686d912a3", "value": "ff1ca929fe28719fd5130eed0fdd7eca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab60ba98-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694703296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703296, "uuid": "dabbd782-d223-4818-b546-5ce411890f9e", "comment": "Malware payload (AgentTesla)", "value": "03bf0fc793197b80caca13db36b5a44d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703296, "uuid": "ccc6283b-02cd-483a-98ab-49631821ae20", "comment": "Malware payload (AgentTesla)", "value": "6383bda7457444a662e5cb28f1925680538fe10753591bcb112cabc1f65bfbc8", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703296, "uuid": "9c519c12-f971-45f1-863f-81dfcb7db497", "comment": "Malware payload (AgentTesla)", "value": "c74179241c9e4e60e2381cb2d5884d6ea44982cd", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703296, "uuid": "1ecfe617-378a-4c03-9a1d-c35f8e494707", "comment": "Malware payload (AgentTesla)", "value": "12f0eaa7757aebb2b83dab1b8696905aa20b3c9f11aecc9bbe4d59d412310fb482057917c5e5bbc7a0763ac9d7549477", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703296, "uuid": "3dfe504b-13c8-4f4e-ba1b-9f10fe80b9a6", "value": "T11C94234391D889708B7A9722923BC2B137C069A7E448E0C4F5EF527DFF6E92D71A5848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703296, "uuid": "288f1177-930d-469a-a060-75435fcb083c", "value": "12288:XDumUQhRj+y4FuVQyuBG17PGzZqGRvLr6x:Xamp/jgFuVQDGBGzZq8PG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703296, "uuid": "eeea7989-5f47-4cf8-a64a-0ce6294a8e6a", "value": 447263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703296, "uuid": "652e8e63-a33c-4782-a139-964070d7cdb0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703296, "uuid": "94d10099-3726-4641-ab2c-a168008b5364", "value": "Request-020601pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4118c300-5311-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BitRAT)", "timestamp": 1694704406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704406, "uuid": "39112ba7-efcb-49e9-a876-d37cbd676d69", "comment": "Malware payload (BitRAT)", "value": "968a96fab78010b987e7a0b8624d2605", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704406, "uuid": "25c669ed-5357-4515-91dc-0bf5c3c6c3db", "comment": "Malware payload (BitRAT)", "value": "63e7d413f4653c4b84c8e4c1c4fd4516a245464b3e996aa733ce21c9c1c964b1", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704406, "uuid": "2cefad60-7b9e-49e5-8c79-46499d6fa3ec", "comment": "Malware payload (BitRAT)", "value": "1e42b6186f040b9868a978450fde05e39a267bf3", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704406, "uuid": "4f465af5-f070-440d-bae9-7d420910a4c9", "comment": "Malware payload (BitRAT)", "value": "879308cce70935f9a08e22d5caae84c3135981fd84da3ebb1863236afd058f508b79464c7cbbb1c316fa801bff325399", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704406, "uuid": "d9368918-e926-472a-acb8-b8bb52ca7f08", "value": "T1CFA39DE2FB5AE815C89D43390DF6C1916A17BC612A36834B3259F31E6FB3A908D43753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704406, "uuid": "61a6fe9c-5430-4008-b90f-988c1a2fd484", "value": "3072:irxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAftJE2zuxq+fr9wBLa71ba2ryLTHeYB:kxEtjPOtioVjDGUU1qfDlavx+W2QnAVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704406, "uuid": "3c2f64c9-aadb-47af-8d4a-4d870e331d21", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704406, "uuid": "7a44f0db-20e4-4960-949f-5bc4f0cfda39", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704406, "uuid": "b390bfc5-bb23-4646-b9a9-3ffd726bf487", "value": "Romania_Request_Imun_SRL_09_2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b63ae4-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1694675611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675611, "uuid": "13493db0-18af-4c2e-bce8-2c111c7b0139", "comment": "Malware payload (CoinMiner)", "value": "91ce76d90b6a43a8fe5dff08859b5114", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675611, "uuid": "fea05016-e743-4f26-a5a6-21b520cb0ead", "comment": "Malware payload (CoinMiner)", "value": "654b38416bab49483cc92fec6cb7ccff219ab4bc083519d6cda6d94b74ee2be7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675611, "uuid": "859e1848-40d1-491d-aa1b-30cb610e2d5b", "comment": "Malware payload (CoinMiner)", "value": "90066115e14f36cad6f435f63ae2235521896753", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675611, "uuid": "7d172817-db0b-4cc9-8f8f-2ca64c02f856", "comment": "Malware payload (CoinMiner)", "value": "0d1108ae773ce57765380ee2054056d8554d1ee8a1665c2debaf1341493db75edae88a17b7b3579b7f12664c5cd80709", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675611, "uuid": "8343b7a7-fcb1-4ead-8f48-3d7d9f911f40", "value": "T1A914C01239A1D072D5A387354834E6E06A7FBC739AA5854B37183FBF3D313926766312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675611, "uuid": "f4d53b82-ba01-4d3f-a01e-d6374065f481", "value": "ef163fd1a1dfd01940ab083fe4660afa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675611, "uuid": "5c5be010-1e3f-4a7d-856b-29ef55237c06", "value": "3072:dlhpDLMWqJqRxeroVr0EudxSt0MDGqSaorCJB4J56NcpKvTTR4P:dpDLMNY30oB/udxS0Pq1oro3GpKvTV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675611, "uuid": "88157849-76fe-49b5-94c0-4fc70d0df58e", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675611, "uuid": "a3bbf396-c8be-4812-b94b-286681d4f1f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675611, "uuid": "f1880e74-ab2a-4263-9e3e-de2db3fcf656", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2bd4c3-5324-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694712642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712642, "uuid": "9c9e640e-377d-4403-8673-eead40622ef4", "comment": "Malware payload (Mirai)", "value": "76f7359d98f20ee292c26cc21e2b07e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712642, "uuid": "eb8f0298-9a19-4c94-92cc-f10f45b0af60", "comment": "Malware payload (Mirai)", "value": "65e4700a9c6ecc832fd537c2c382f050331f8331e2eda455b449cfbd0e8382d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712642, "uuid": "20f74377-cdf2-4634-8444-033081be4ef4", "comment": "Malware payload (Mirai)", "value": "438bdb234f2056a3e3cf1d03ba811aa749b64cf3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712642, "uuid": "7e829654-c524-441e-a50e-d087cb509905", "comment": "Malware payload (Mirai)", "value": "3f75f6322768ddf45646bf7e9dce9f9fec042770b817fe54a2a8330fecc0a9053f8da2f901ea4d1b5b32826284e45e91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712642, "uuid": "e8b5c07d-372c-4d8c-be38-658eaf30b42a", "value": "T1A6B2C0CC65943084CA8E7C7C578D4A664F68A1D0BADD8B26E354CE9873BEA4F3858079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712642, "uuid": "3b2704d2-13a4-4ecb-bc0e-f18b5108ccf1", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpjZqEWvY:/QlS07FUXqIYSXQKqu1q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694712642, "uuid": "62e19170-2b21-4f79-bc04-093aea40e7fc", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694712642, "uuid": "227e8006-b9e9-4895-bb96-c94dc2119351", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712642, "uuid": "2dad74f2-da67-42c8-b2c9-7e6a9a737c25", "value": "76f7359d98f20ee292c26cc21e2b07e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6380e11a-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694675688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675688, "uuid": "c2b9ffdf-c402-4afb-9130-48214f39b601", "comment": "Malware payload (AgentTesla)", "value": "9da6ed76cdd799b6f7cb4dacfbd6c77c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675688, "uuid": "b9b6237c-c9af-40f0-bf63-98cb443dd847", "comment": "Malware payload (AgentTesla)", "value": "69ae42d05386d0d3b516c63815b8a06569c0a6179e2af2201af6b9d3ce05e0e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675688, "uuid": "b5bc155c-4cc7-4471-acff-986191cc321f", "comment": "Malware payload (AgentTesla)", "value": "a18d09d31332138c7af4b04bc2a32122415dce5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675688, "uuid": "fdb52172-5f43-4ec4-b085-2ed1b12ff65b", "comment": "Malware payload (AgentTesla)", "value": "4cbf68c2e63da44a059518099db24322da5fd5d79bf89604b3394bf5722898dec3439c4396c90798873f11a772461bc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675688, "uuid": "3c83b5d4-42d9-47b1-9b85-32b12c49791b", "value": "T110C412083BDABF51F2BE07788031595C03F6D616E262FA5BAFC669EE2D07F04C151A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675688, "uuid": "b2ce9194-dd7b-4e65-b2a2-2558e952aa66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675688, "uuid": "0752787a-7b99-4e1e-8ecd-e55f01f8fd1c", "value": "12288:C72cl6cRSV6Yr8nNwFpSMvgl5XIH+p5NuASj:s2cl6cRSTS8cMYIepy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675688, "uuid": "1ba4aa85-3e68-4901-8ddb-29c5b3beaf46", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675688, "uuid": "f8fd4e89-a3ae-4c41-8fa7-098fc7f55e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675688, "uuid": "3b3ec852-5d70-47fc-aaf4-864523a5981b", "value": "PO-890502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf7d3f6-5293-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694650308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650308, "uuid": "8e4d6367-cce0-41a3-bd1e-442fc5f4e762", "comment": "Malware payload", "value": "83d40e8ba2dd560fa25236fc8a23dee8", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650308, "uuid": "63323af9-8ba9-4913-993b-96d7754c69c9", "comment": "Malware payload", "value": "6a19eda1180cb66e013db974dda32968bd29d47257095bca99c01c50f6a0b868", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650308, "uuid": "d47725fb-f850-4dfa-aeb4-22c30a8019a8", "comment": "Malware payload", "value": "aebccc12ce11ed4855cc237965b61c39bc17933e", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650308, "uuid": "2a40ec00-ac86-40d4-bf41-0d3e67223296", "comment": "Malware payload", "value": "202406db044988374d9a2d2e79db8c03a872fd2db8b310d9d2408b216d27d421f76f7753126b7e7cc57917586f939c49", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650308, "uuid": "59f01f0e-bc17-43b9-aa4d-7e0fb5859a3e", "value": "T174412B641FCE401B0C6EA80E58EC68C1098E28829CE863B43C5701BABA2C5F93835767", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650308, "uuid": "18138026-cebd-4507-bd6d-314cc19687dc", "value": "48:ZSRfhq/hX2iYltj6qci3Tz33AixiIWYcAqOEI21b63UoEBOohs6T76d5:ZSRfhqJGi0c49JcAqOEI0b6E1BO8Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694650308, "uuid": "2b0552f3-548a-4444-a0c6-301e7389d35c", "value": 2199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694650308, "uuid": "007b0977-beb1-4b43-b5c0-7e5c40f885a1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650308, "uuid": "eaa9a427-3790-445b-93f4-e29c066d6dfd", "value": "upd-(cohort-M117ES).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb05da0-52cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694675413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675413, "uuid": "5f4e888b-d521-4047-a2e8-90909a8f4264", "comment": "Malware payload (RemcosRAT)", "value": "be7f3a961e31db70ef7251ac44c46972", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675413, "uuid": "a5f419df-11b5-443b-be4b-22d50f572d54", "comment": "Malware payload (RemcosRAT)", "value": "6a35f563a00243f0f06b2e81a8911b6cf55be9cebb8561a45511e3e115d6d3a6", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675413, "uuid": "d0e6a83b-db27-472e-9663-510d732724e9", "comment": "Malware payload (RemcosRAT)", "value": "b84c4321a2fc1bfcff4c5c915c820402b06940a7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675413, "uuid": "3ba33a65-f419-48bf-b51d-d6620fcc9f3b", "comment": "Malware payload (RemcosRAT)", "value": "81ab7f082a3b556cc9c9cd236d257785191027298aaae69c28d235e2b5bd45446ac238999c86d7c1a809544b009d2587", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675413, "uuid": "65dbeb7a-cb15-45d5-8d50-90b69dd470fd", "value": "T1CE64011026FF584DB2737F532BEDB6E94F6FF7A2571A619D2400430B8A61E80CE66631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675413, "uuid": "939a83f1-40ff-4dd7-8e09-35f904879a52", "value": "6144:DeeeeeDeeeee4WvwvMweeeeesMvlvsweeeeeIeeeee0eeeee1eeeee6eeeee4eeY:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675413, "uuid": "ba2af22f-2ab1-46bc-aa61-de12d86a5af2", "value": 328206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675413, "uuid": "bcabe1c0-c550-4231-8b79-ed3318f5858b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675413, "uuid": "4c41aad9-7828-4817-8fe6-a8293eddea7d", "value": "Payment Advice Customer Ref[7563774552].vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265c4ca9-5346-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1694727125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694727125, "uuid": "7db55839-6eaf-42c1-9ace-ba62c1786e56", "comment": "Malware payload (RecordBreaker)", "value": "7d2b87d76a65372655ef9f3ee0dc641e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694727125, "uuid": "9d96dd46-7387-4e5a-93b2-51f4b112c98a", "comment": "Malware payload (RecordBreaker)", "value": "6a3babfcd30ab8adcb217a57c60e19c2d75729af67004737926dec0391456805", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694727125, "uuid": "07891b44-ab73-4472-863a-4c3eaed5fc6f", "comment": "Malware payload (RecordBreaker)", "value": "9cd216d8529a8a5fa687f8692e761ecc2f93e752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694727125, "uuid": "8cd56f62-3452-4b93-b710-a7bb67aa7e87", "comment": "Malware payload (RecordBreaker)", "value": "628f9fc953715e1b64d9dce45750f8c195eae04ae8dd5ae7697de19d0b3bf4079c8535005c5642483658ee8a3b535aa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694727125, "uuid": "29c090b0-69ed-43b8-b8f5-7e807e0925ec", "value": "T152559E3039D2C736EDE620BA45ECB569466DE0B00B264AC796D81BEFD7207D17B325C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694727125, "uuid": "b457dce0-3448-4efc-87d1-d25c8a8254cb", "value": "8d5160aba42ffb2e8789bc5aa4f2911e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694727125, "uuid": "72319666-68a5-40f0-8c86-198ab30e98d6", "value": "24576:ZOxLX958dvLzi6t9a9cRMx+6dB6kZaD3t:cFIvLzi6t9eLn6kZaD3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694727125, "uuid": "20ada3a8-a36e-4114-aa2b-a4989f1cb60e", "value": 1352704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694727125, "uuid": "a9cc52d9-d700-4b37-bc9f-c7c845d6cde0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694727125, "uuid": "01f74327-c38f-4000-a5fc-c6da5d5ec47a", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbcd4b5-5324-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694712668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712668, "uuid": "8d6ccc7e-379c-48c3-a5cc-40a2affd52b3", "comment": "Malware payload (Mirai)", "value": "3e99c72736cbbd47f6769a5337599d88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712668, "uuid": "de59c401-f915-45de-a255-fc30d052c084", "comment": "Malware payload (Mirai)", "value": "6aacb1b778d3c947a2cf44107bcf5389d91daa483caed4d51f84342c182d06f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712668, "uuid": "50fa798f-c629-4d51-b44b-0d3a448b6673", "comment": "Malware payload (Mirai)", "value": "b4d6fa01ba4bc315b167c5cd103c21e520ab655d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712668, "uuid": "7b81cf87-dc9d-45ab-a995-c9d6ac19e61e", "comment": "Malware payload (Mirai)", "value": "e08b8f56df8a2c333147db492eb362d16df378340531dc58a9b4526589f12c2830ec1f3297e096e87dbdea91c4e2d91e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712668, "uuid": "46151f61-5f23-4ce3-80c1-8b44501233c4", "value": "T18C82D03051AB74E5DBE14430FAAECEC6571A0BF8E0FC36D316586B38894650661F93CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712668, "uuid": "b46f4e91-0cf3-43ce-979e-eff8004e6381", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaPdhymdGUop5h5lg:6/V0P6+kom0tVAoNvm+to1Pds3Uoznlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694712668, "uuid": "75c596bd-5fc5-4e26-8995-9bcd3b947898", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694712668, "uuid": "90987b64-57c8-46ca-918d-de88a95111f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712668, "uuid": "038ce302-0f6d-4e42-b303-4c8219b8f3ea", "value": "3e99c72736cbbd47f6769a5337599d88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0ef79b-52f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694693229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693229, "uuid": "b7450660-f324-44a1-9293-66f154bbbcab", "comment": "Malware payload", "value": "3a46dca129b073e601907d85c81b6d09", "object_relation": "md5", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693229, "uuid": "0d412a5b-2afe-44dd-ba17-2ac2ac24305b", "comment": "Malware payload", "value": "6b22de53abc8106b75cec7235928e410e31adbd7dd13d6351f48fcc00e4844f4", "object_relation": "sha256", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693229, "uuid": "b9e5ceeb-4765-4871-825d-58e573f73bd3", "comment": "Malware payload", "value": "cef32bb018c5875b8488261e2f2de1fa96c8b4b7", "object_relation": "sha1", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693229, "uuid": "899600b6-7ed2-43e0-9cd9-47072429af3e", "comment": "Malware payload", "value": "1d3e3be19cc48053cf4337b4b1906c4188baa5648ab62e4f242557f9e8057e5beb24cbf66475c77fd7e0c1429548d6f0", "object_relation": "sha3-384", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693229, "uuid": "d2bffbfe-3293-495b-901d-096a68f0b661", "value": "T1DBD0971A1A627248C8646A97C225C83E0E033EA8478209E1888AA04800000A7342D3DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693229, "uuid": "4d67ca17-a49b-4b25-a7e9-ff89afdf98ad", "value": "6:Gz2wqK+NkLzWbH9WF08nZNDd3RL1wQJRCmEWAIrMNmesDKHiM:GPMCzWL74d3XBJb/ZqmesDKHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694693229, "uuid": "7710d7c6-ae78-4d6c-928a-cf9b0f2910cc", "value": 237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694693229, "uuid": "a02a3425-dcc7-4251-af7e-b6b5b5f27227", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693229, "uuid": "0b3385df-714e-4faf-9374-844c24ec2cc7", "value": "QbSCtbPVqCXhklmw1Sq.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b03c57-52cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1694674883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674883, "uuid": "d6b173fa-598b-4e86-b2ce-44b67aadfc65", "comment": "Malware payload (DarkGate)", "value": "083cda04c8a1e778015a9354b4e76155", "object_relation": "md5", "Tag": [ { "name": "80.66.88.145", "colour": "#9E9003", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674883, "uuid": "82b014a7-061c-4e2b-b668-42d01e7d9c7b", "comment": "Malware payload (DarkGate)", "value": "6b5c5163edae524314762a092cec99048c13d4ead9d990e901d17dade365bbeb", "object_relation": "sha256", "Tag": [ { "name": "80.66.88.145", "colour": "#9E9003", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674883, "uuid": "4aa398e2-e70f-4682-b0e7-e3a859c0373c", "comment": "Malware payload (DarkGate)", "value": "a259afdfc343cfb473bfc396fe8d9b659a4b1f88", "object_relation": "sha1", "Tag": [ { "name": "80.66.88.145", "colour": "#9E9003", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674883, "uuid": "d016418f-5a79-41cd-a7b6-43bfb5538feb", "comment": "Malware payload (DarkGate)", "value": "b36e455612c3a41eee49ff9ecdf8a17f20820c46aea2ca484a096b8e8d3cbc4f3cc0cdff0134727eec8a4406bacdc4c1", "object_relation": "sha3-384", "Tag": [ { "name": "80.66.88.145", "colour": "#9E9003", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674883, "uuid": "93babd00-bb10-4390-8a15-88a5cc7a84e2", "value": "T1E6E523523BD5C536D2AE0637487B97292A367E344B20E0CFB380367D9E313D2A579396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674883, "uuid": "70052e84-acd0-478d-ab45-578fb1cdc618", "value": "49152:5pUPt3zSRaU9ha2gyQdOXAu3i1/GX/W05a0QVF31oJQ8SCwYrJRclbJYqbAKR:5pKSRaUF9MOXT3iMX/W0cVnsQ/ClRuKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694674883, "uuid": "6658dc88-1658-46c3-a6b7-106e8bea52c1", "value": 3043328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694674883, "uuid": "4a2a4ffb-4c6a-4fe8-822f-aaf3df955132", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674883, "uuid": "92dec43b-e108-408f-a9c4-d673ddaea9c4", "value": "scannerip_v1.492.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ebdb55-52f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1694693224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693224, "uuid": "80b948d4-f507-4a70-bbad-6a06e4fb564f", "comment": "Malware payload (DCRat)", "value": "f7cdd84f9f0f7eabdbf72d3c45ef7ba5", "object_relation": "md5", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693224, "uuid": "14fe44db-3367-42d5-8cd1-5850525444f3", "comment": "Malware payload (DCRat)", "value": "6c398c08d438498b4508e1c646f5249961d5646dd350e48398ee26be2643f576", "object_relation": "sha256", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693224, "uuid": "f25f4638-f4ce-4729-9a82-fe691b377c19", "comment": "Malware payload (DCRat)", "value": "bb91342ea2aef94a358885f614fc1a786ed615ef", "object_relation": "sha1", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693224, "uuid": "3fc807ff-5b6b-4f66-8075-eaa647e0c123", "comment": "Malware payload (DCRat)", "value": "db186dca212d972e56d0e739a6ddd4a85b2ec62a3aae44667c111b626111b3380987ec0179af8c08b4e3d73d1a2965cd", "object_relation": "sha3-384", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693224, "uuid": "101f4622-6670-47d6-b2d3-9826ed0e3c78", "value": "T1B3A57E2439EB102AF173EFB58AD4789ADA6FF7B33707589E205103864713A81DDD163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693224, "uuid": "82c16bd7-1567-4288-8eb1-d54846563a05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693224, "uuid": "62b9722b-03a7-43b2-aee4-14d6e21769db", "value": "24576:CjGzCjGICw7RIoYaaENzJ/jPe9s/8Q/Ht9UXGJ/SeI36KG:QGzCqYQ2JLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694693224, "uuid": "6e16291f-2267-4790-8b44-7360047632ec", "value": 2172416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694693224, "uuid": "027e6693-0dcc-41d1-a485-d0b59c779ed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693224, "uuid": "a0f3c4ff-4dd0-46d0-bc8a-a6f8a8ecd6f0", "value": "ProviderComponentDll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce0c055-52cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694675301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675301, "uuid": "3435e39d-b1bb-4d66-a750-cc7eb0e6cd78", "comment": "Malware payload (MysticStealer)", "value": "cc0cea0e7e6cd610ade27177dc9fb3b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675301, "uuid": "cfcb505a-6d8e-4c76-9947-cef5f8db56d4", "comment": "Malware payload (MysticStealer)", "value": "6e311c703ac8fe0522a0c796b3924fd7679268d893859a591e20e2e43fbe50d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675301, "uuid": "66fa5ca3-2582-448a-b459-b719aba6e058", "comment": "Malware payload (MysticStealer)", "value": "2cb7ab384aeaac9b66064ffc1d2c7a24745fc6f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675301, "uuid": "2f4f750b-4b2e-4d76-9147-2f236f34121f", "comment": "Malware payload (MysticStealer)", "value": "9027d7039f289b33fceaf6dedd6ab32a345cf7126c146a77104a56822dd2b08e08cd3cec007519f96b2aaa3a44909c1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675301, "uuid": "dc0946b9-a5f1-4b3c-960a-dfef271c0ef2", "value": "T18674AF2172E5C333C6B606364DF4AEB0983DF8E047A59AFF23944B7D4B641E0A235E56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675301, "uuid": "9707b65b-56d4-49ec-b3ba-beda8e535e45", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675301, "uuid": "fee54e9b-6d58-43ca-8055-ba39f589285b", "value": "6144:BcYiKL/yfYb5B+BO99c0s0ZVtAOJglscef6mJiE4BDY8hi10/fS/CsgE9:iY//yfYb5BIQZVtH2efZiE4O8EefS6sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675301, "uuid": "da8f5c91-3d90-4be2-acf3-40d35038ba61", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675301, "uuid": "8b471f97-564c-4e2b-9989-3f5f2ccd469a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675301, "uuid": "ff6e6350-d041-489d-aec7-707177372c54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa7b811-5314-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694705692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705692, "uuid": "4481fb64-5756-405b-895d-976ee6456676", "comment": "Malware payload", "value": "f40c5d672b89f0ea2412a42c2157ccdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705692, "uuid": "639af940-0be7-46c5-9256-a86eac9f2f83", "comment": "Malware payload", "value": "70dd30ba43b00bc3fa8f01629133d8f0a4338260b7299f899d8d0d97aa0fdad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705692, "uuid": "270e873c-6b79-468d-ace9-9d6c910a7071", "comment": "Malware payload", "value": "0e040c45921d58f72317e8ac191405f234d6956f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705692, "uuid": "fb61ae3f-4ba0-4399-98de-304115b4e2a4", "comment": "Malware payload", "value": "6ec9bd704b64b5502307571e6a4da9b462093d9bd30a0c27751acdcda6a929e5f196e773272a7ec8a6c9471ebaead293", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705692, "uuid": "71897c83-ca3b-4121-836c-5ec0f02c0006", "value": "T128F36A1174C1C0B1D9A342761AF8EB21567DFE720B725ADB77C90E6D2A742C06B363A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705692, "uuid": "ba89c473-9a1f-4d6e-b902-95e1a68bfece", "value": "327e49dbc5330d3838e89c17a931e259", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705692, "uuid": "5b1b57ca-e263-4f9e-9437-17bd7a89bb2f", "value": "3072:quiur1UBoSudokvYUv4OEN+qSBd+pFnnm52q6J:niupUBoPdoSdwOaqjYDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694705692, "uuid": "39e875c1-4f60-40d8-9369-befeb5f08fd2", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694705692, "uuid": "81c90dc1-da0a-493c-b4b5-ca7eff032cef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705692, "uuid": "bcbce198-1985-4319-9345-c2204639a6a9", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27605.10551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68706483-52fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1694695023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695023, "uuid": "ae306fcd-8aa0-45dc-8d92-048e70eff0f1", "comment": "Malware payload (DarkGate)", "value": "cdfe802f02d49696d04f13b9dcddcb70", "object_relation": "md5", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695023, "uuid": "b7ff7283-d664-4a89-adf5-4eae6d7216ab", "comment": "Malware payload (DarkGate)", "value": "711b9ebcf9aca14620ede45cff8bdf14f7a7e6943c9917fb9cfc91f3c272c7c2", "object_relation": "sha256", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695023, "uuid": "965d0c1e-d76a-40ee-90eb-c91ebe558805", "comment": "Malware payload (DarkGate)", "value": "9e00c572cef6b6704a289496faebe9d5d7ff18c7", "object_relation": "sha1", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695023, "uuid": "f44f585c-6630-47ea-97fa-9f8e88d27850", "comment": "Malware payload (DarkGate)", "value": "ea7e3716d6693dd68984b0f35a6f9183a59f576223fb081fb1beb1ed0b570b3190c2d92695b894c509ac464fbdd69f6c", "object_relation": "sha3-384", "Tag": [ { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695023, "uuid": "e697cf7c-3c24-47e4-a6e8-806077ad5cb9", "value": "T1DDB523523A84C63AD78B073645BBCB6A26293D711B31D0CF7655396C9B32BD2E934323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695023, "uuid": "b9fe7795-ffa9-47eb-82ea-886a59094405", "value": "49152:tpUPhy14oGZE/r3LUqMWYLbsYCF6q023sKylydcDMaXWdOq:tpgyEZE/zYHWUq0rK+yWDM9Oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694695023, "uuid": "ac71d87b-03dc-440f-83bc-75ae14434775", "value": 2334720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694695023, "uuid": "40b58e77-38ff-4f1a-a6ad-697edf241bc7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695023, "uuid": "80b3d60e-2f09-48fb-a54e-cb9447bd3ab0", "value": "open_ver_2.2.6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde41820-52ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1694660861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694660861, "uuid": "ca2ab4f3-fe7d-4b9c-bc92-42391a0e2ef6", "comment": "Malware payload (njrat)", "value": "95c33f809c42134af6b3d546c7aa98d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694660861, "uuid": "d85a5b25-3b54-490e-9019-efbfe59518cb", "comment": "Malware payload (njrat)", "value": "71aeacef3a99e2b7af179a22756e00a03a610a8cf612bce2ed729c4067fb119f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694660861, "uuid": "c48409a5-b6ef-42fa-9d7d-59395be99ac1", "comment": "Malware payload (njrat)", "value": "63e6b48ff74971f196d7dc28f2e2507c96ab70b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694660861, "uuid": "015cc492-b5c7-4d50-acfd-d859fbce278c", "comment": "Malware payload (njrat)", "value": "a0ea5a31bdab7486a36a19619a3cec428cd97bbfa920af6840edff4e0483ff118bab30548a52f115e302d2771674a26e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694660861, "uuid": "421a6886-7704-4959-9e8e-23f02921946e", "value": "T120E208067BE94215D6BC5AF88CB313214772E3438532EB6F9CDC88CA4B676D00655EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694660861, "uuid": "7e6ba7ff-7164-4d1c-bf8d-4bff8c227f20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694660861, "uuid": "af0f3f20-c531-4696-81f7-9f2edfdb84b8", "value": "384:00bUe5XB4e0XSOfOLsw0Q0mS03AWTxtTUFQqzFLObbR:RT9BuRk555dNbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694660861, "uuid": "bab19dd8-c7d5-40e1-859a-afb8ec2951bd", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694660861, "uuid": "d073f2d1-638e-478a-bf7a-bda4a890f6ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694660861, "uuid": "ab22358e-6dc5-481f-9b68-9835ca09064d", "value": "bPHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0864ff-5307-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1694700322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694700322, "uuid": "6494387f-5d60-44bc-87d8-83131f5039ee", "comment": "Malware payload (AZORult)", "value": "2cff60ccfe9bf21d3f98f749a278ac62", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694700322, "uuid": "0cd0cb5e-8013-46ea-ad34-1bd102136b66", "comment": "Malware payload (AZORult)", "value": "72465f74a5ef3b19cb51be862a02003bc406517bca79d5e4457223f95ee044b7", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694700322, "uuid": "2a630df8-6a6b-4e5b-a489-4549cee7bd2d", "comment": "Malware payload (AZORult)", "value": "e1e72717b047f2a9e08f208aa85f485c2115c89b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694700322, "uuid": "d4f3e8e4-340b-4f74-b163-fe6b4590958b", "comment": "Malware payload (AZORult)", "value": "ef6d97672c626a690ce0be799a35527eaa7563b9025a876eb94c553ddf116691926db793f3d0467a15f6c424ee4ccb46", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694700322, "uuid": "08b10eca-6387-4c79-b1bf-0a32f20b764d", "value": "T12A84DF656068D603E7D977311F74CCB52796AC6C2C28567732F46F8B76FE123AA08322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694700322, "uuid": "99fa13ae-d81d-4840-86b1-865c5e358f2d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694700322, "uuid": "d53a014a-8859-408e-9a38-dc67fcaafae4", "value": "6144:yYa6lMX3IjdMIQ5VcgYydjYku7NhM9bYqkazC:yYzPJMIQ5Vzm7zMtbzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694700322, "uuid": "8bb055f3-649f-4bab-a555-15edb31f58a7", "value": 398263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694700322, "uuid": "d0b87e50-6972-4f3f-9253-c91d361eeec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694700322, "uuid": "d535c274-99c2-4116-99d5-e7d6cf1ab121", "value": "FA010711pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d512c679-5294-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1694650967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650967, "uuid": "8918b92d-e41c-42ca-8850-4d6898c29ec1", "comment": "Malware payload (Amadey)", "value": "1f3111aa4f5336e730cc955eaeb6a20f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650967, "uuid": "46ad14e9-2fd4-41e3-8b63-a7908eb26a69", "comment": "Malware payload (Amadey)", "value": "734871091f713f83cb86b81489ffa8b8820cce9a613b6fba7e5057accabf7753", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650967, "uuid": "a910f4e5-9105-4bb8-8b1e-84aec97f95b2", "comment": "Malware payload (Amadey)", "value": "1560505c7f849205739ad8612dba54cda029ab90", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650967, "uuid": "106abea2-2afd-404a-8951-0b11f9db520f", "comment": "Malware payload (Amadey)", "value": "fbf4ffd724cc608926ebf4f724a8ad604afbd157206bcf7b973bc04ee4674eb88d6a69c9c9f189b66ad30e96d73af9b7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650967, "uuid": "4a6179e3-88e2-4cdb-ace2-5394cf696f7d", "value": "T149B649217246C12AD56A4DB0192C8BFAD12CAE667B7104CBB3DC3A6E5B747C31332E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650967, "uuid": "b3b2f47b-a983-4665-80d8-24726638db35", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650967, "uuid": "74a4517f-d41f-49a4-8dca-ea35891ee158", "value": "98304:M9iZasQra4ios7RjnRU4UApr2Y5ozo0v2jkGkVyISafENbHFwX0k4Qn8UspeH9/6:rZa5+osNbxrwo0jLywYzM0k4S0kr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694650967, "uuid": "f1a5d0a4-d071-4d1b-a531-94552727dbbd", "value": 10692712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694650967, "uuid": "05b4f534-55a3-44a3-8a44-675ae0a58514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650967, "uuid": "22dda5c2-c100-482c-8ea4-05ec17c88def", "value": "\u0421hr\u043em\u0435S\u0435tup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76e411c-52b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694665950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694665950, "uuid": "486b01c4-93d2-4128-b880-197eb52c7adf", "comment": "Malware payload (RedLineStealer)", "value": "72969a77b29330db64c0ce302dbc5a66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694665950, "uuid": "e61601c9-cb72-477d-9afd-8a29f83395b9", "comment": "Malware payload (RedLineStealer)", "value": "73b060c506f0149021cca3177672112d651bc63fa29e5067bc2a67abea9a5e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694665950, "uuid": "bc713248-a291-4881-bb08-6c1235cd62f0", "comment": "Malware payload (RedLineStealer)", "value": "599d590a23a0dbe64de492db177e8be00f86b8e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694665950, "uuid": "ab4c03b3-7256-46e5-9744-6060e976009e", "comment": "Malware payload (RedLineStealer)", "value": "158c08818d0db46507691c8185398acc29493ff380d6b260b29255f667d5bc79dad4f626186ccf2a19a56e174c0aa573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694665950, "uuid": "8be482e1-664f-4f5a-a8c5-3045ccb0b0a9", "value": "T12EA4B0C3AF91BD63D52A4A728E1EC2F8365EFA53CE5937561238EE2F08710B1C562711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694665950, "uuid": "5a957a9c-baa3-4253-9c50-21c72733b319", "value": "3c565fbe4eaafad8572e17176ac3eb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694665950, "uuid": "162fc6b6-8643-457b-8d35-48e65436ea5c", "value": "6144:QeWif+X76H7FN3H2lLbSLNB6yYiA3GnvKPhcTM3u65Vgm2aE:QEWX7AGOoyYiTnm3cZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694665950, "uuid": "5bd9f79a-9dd1-498f-a753-5bce7657dbbe", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694665950, "uuid": "5e2e1d67-b997-41ba-b309-418521fe3d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694665950, "uuid": "07ba579e-2b97-401a-8e88-dd3e6ccc31e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab380ed9-52cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694674949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674949, "uuid": "cacff8ce-59b7-467d-b36d-57363005b83f", "comment": "Malware payload", "value": "d3ed94c83e883c4a38e7dd431116902d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674949, "uuid": "cb63894f-4bed-414e-951f-16132f43d962", "comment": "Malware payload", "value": "73f0b2bce29537f03e4e037eaec22136c62c7fabd2771a40faf18979eddb84fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674949, "uuid": "60eb2fe3-99a0-4e6d-b0a4-c89708e9b9ad", "comment": "Malware payload", "value": "a81e953e8912343cbca3abe75c63d27c7bd2bf30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674949, "uuid": "e34f6311-2543-410a-8866-9474385f0091", "comment": "Malware payload", "value": "ff89789a27e42d1409aa54bafc4f3358998e51e04d5b76b1887273159055ad7dd228abde0d80340d9428c5b02b13c49f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674949, "uuid": "615a5f76-ae37-4666-8c64-cc913f13a860", "value": "T1098618C7F89050E4C1EED33486665212BA613C994B3023D72B61FEB52F36BE4AE79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674949, "uuid": "1ff910af-d106-4021-aa67-7d2ef3a70089", "value": "49152:1Q+d60JY9iPNK6+fzoPjEnw5DevIVo2cxvX/R3IZbSbmxAHVD6IKhdLJ4El1TIJA:7lQ6gkiIklcAR6ISLG7CE78qJGYJqoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694674949, "uuid": "ecb6d273-6e4f-48e5-966d-ed7a06932f61", "value": 8131925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694674949, "uuid": "d38cdd17-e2ee-430d-8d5f-438d7f05b096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674949, "uuid": "7f6fbfa5-214a-4f19-b64b-9d958db40765", "value": "d3ed94c83e883c4a38e7dd431116902d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a52609-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694675931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675931, "uuid": "9050352c-9b53-4a16-86a6-28972c005877", "comment": "Malware payload (Mirai)", "value": "b354d58b6fc73b6af6dc6ce4cb74afb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675931, "uuid": "5cb6f6fe-658d-4567-a764-64298e222c8c", "comment": "Malware payload (Mirai)", "value": "74128e05e4de21252f59e7df8faf8f25adff75182ecce3501eb09e2dc4fe7174", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675931, "uuid": "9067ab44-c8cf-4b54-b2c2-b8025f67cd53", "comment": "Malware payload (Mirai)", "value": "4047dc00e8b7ef4c342b59264d8b91dfad7e9fe0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675931, "uuid": "410920ba-6785-4605-b456-8ff0f1f3c521", "comment": "Malware payload (Mirai)", "value": "18ce79034c7e3b170a41e74bfb18170cb146fb2c9637916240a84f40818b89350d25dc4dd03a209ef50fe3778d80a42b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675931, "uuid": "9094789f-1292-41f6-815c-d304c34de6d5", "value": "T16943F961BC915A2AC5E0537AF9AE558E332077E8E2CF3227CC611B107ADA41F1D63F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675931, "uuid": "261aa272-96bc-4292-b226-cec00cc3d4ff", "value": "1536:+n1pyUGLbFXsCmbnmcVBREee3mb1AVMoh+C+FPcC:+n/6Me2ZAVFhd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675931, "uuid": "055ca18c-a0ae-46e0-8b02-221e4299fa32", "value": 58712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675931, "uuid": "2b898ee6-0015-4b69-99b8-fb7eca6be65a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675931, "uuid": "87bced0b-5ac3-438f-9c0b-403527e78e19", "value": "b354d58b6fc73b6af6dc6ce4cb74afb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c5877f-52cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694675963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675963, "uuid": "65b77492-7cce-4f00-ae2a-0892b8a9e723", "comment": "Malware payload (Mirai)", "value": "9d99e6c57d55c5bc2099fffd3a793fb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675963, "uuid": "4c6a0e34-51ad-4165-8ade-c3381bf5c2da", "comment": "Malware payload (Mirai)", "value": "74ffcad603e17dcc5e104d86e9e55a685ef6b3e120d2a256e349e8351cef797b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675963, "uuid": "67de59b9-4cf1-4066-a404-1a29410a6499", "comment": "Malware payload (Mirai)", "value": "6126888e08e9b979afc829885208bb0b0ba45e16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675963, "uuid": "fb6d7230-281c-4efb-ba7a-7dea62d49613", "comment": "Malware payload (Mirai)", "value": "bd13e63b43c806cb5307cc92c51660cc211c006093c035bf8f0c03da1afe65489490120018239fef62d34ed27ba508d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675963, "uuid": "f8fc511e-0a5e-460b-94a1-a361540ac646", "value": "T1D0734B0271280B47E5930AB42D2F1BE05BFEEDD035E4B688695FDB664A35E375086ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675963, "uuid": "6359b542-a549-4319-8a0e-c4c0bc36b61c", "value": "768:n5DtKwQ/uUHRAlfu4cC1iJUqv2LHH9Jnc1aGQyiWX7INHoOTrIC5RmnZ5UI7Et5b:uHOPcC1iJUM+Hnc1b7QPmvUIK5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675963, "uuid": "92952d09-2d37-4c74-b64e-127b268292c9", "value": 74848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675963, "uuid": "66f57887-7998-466e-bb09-ecff687b72cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675963, "uuid": "2ebe99a6-4c39-4850-8049-b28982c0094c", "value": "9d99e6c57d55c5bc2099fffd3a793fb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3482db2f-5339-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694721565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721565, "uuid": "3d52caea-e03a-4988-8d04-68278bca2bba", "comment": "Malware payload (Mirai)", "value": "e4ed82dd34d70222017740d550326f78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721565, "uuid": "3650c164-2e32-44a6-8da9-a481e67260ea", "comment": "Malware payload (Mirai)", "value": "75918300d12d8b674cafb867e031e42a4667c0b43dc30c6bb104b1dea1b0081d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721565, "uuid": "a435d115-bcfd-4f55-a21e-08fdb9adef88", "comment": "Malware payload (Mirai)", "value": "10b9a65e98843f02348b265a33c0c7e59c1571e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721565, "uuid": "4a34e70f-a868-41e0-a4a8-8cc93953efea", "comment": "Malware payload (Mirai)", "value": "f620ea4ba0724264032a14f0067b4f7522c1007384c7ed05d6853ce612bcf516706aff20afaaa0d9c433dc7bba8e6da2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721565, "uuid": "c5892ddc-966c-43da-b843-1dd2dc6113b0", "value": "T12CE2E1CDD2F967CBEEF2857209EFB11F2468800B587482B76A85369C4056D7B781CAC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721565, "uuid": "7e2432fb-dbae-4509-93f9-7a577a059acc", "value": "768:O4fRI53XvokA1PMPLsHZup5mt/5gE1RVFkJfhotu/amQnbcuyD7UHQRjT:nI53fo1UDsHwmNmEnVFkJJoeamQnouy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694721565, "uuid": "ec8dc615-db09-470c-8a33-6de204e6aa56", "value": 33256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694721565, "uuid": "17205ff6-861c-42e7-8d91-41bc56d54870", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721565, "uuid": "da4c5ab7-051d-4935-b2a0-f2b3b82cf421", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d342c9b5-52fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694695632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695632, "uuid": "6e120fa3-d59c-4c82-b2f5-09dbf73d171d", "comment": "Malware payload (Formbook)", "value": "bfc8e281847e667c4e3061adcc810626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695632, "uuid": "7a14ecbd-18eb-4544-9c11-bea8f4dc5b49", "comment": "Malware payload (Formbook)", "value": "75a9fc79b2513a8964a0dcf3a0749a399a857d3feb2fa3c0d62de6f51ea5971f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695632, "uuid": "e65b6147-dd68-42ca-a4c2-eb52b4b3d9c3", "comment": "Malware payload (Formbook)", "value": "cafcd9eacc4fef1f204f8065b7f4db6ce2310664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695632, "uuid": "b27b721d-7f96-4e4a-a969-e53f22045b89", "comment": "Malware payload (Formbook)", "value": "206aa36e42f269c9627944837410f2c7cd8bfd1234f3ca6b3a2cd33ba287ff7d0f26010c5af45b52b7054103ae9caf8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695632, "uuid": "10fa9669-4244-4eb2-a26d-8ee88e256ad5", "value": "T179D4238C336CA735D5D80BFD11B2804A33F8C572E646EA586EF142D9AE42F132B5176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695632, "uuid": "513ba120-b3be-4418-9145-71fa9bde3d25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695632, "uuid": "951993f0-dfa1-4edf-b776-ea530ea7985c", "value": "12288:WXj8FwLm/ZnZufquUDLHViC1igFdstGOL/81p0qeTIGsyEe2De:WXj8F6kngq3DL1H1igFWGacVyEe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694695632, "uuid": "4c6c326d-7d28-44b2-b8f9-a9eaaf903be9", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694695632, "uuid": "8bce1ab6-94f0-48d4-808f-5a0b73c79815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695632, "uuid": "f56e6495-f563-4277-a978-ac86a5347bc4", "value": "14092023 CYPRUS (PAMAMAX ALEXANDER) SP-PAL-0923H.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84e0bb6-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1694703291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703291, "uuid": "6b7eae49-ecb3-40aa-9ac3-095e44f5e588", "comment": "Malware payload (XWorm)", "value": "40f71e61f16bfac54bb65bfa5e4776f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703291, "uuid": "6ee0e940-5fba-4908-93a5-7d6ed1bf0c52", "comment": "Malware payload (XWorm)", "value": "76154878a09a8f464845a19cd299069d952e81ae4a5198c855960dcbfd15fe8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703291, "uuid": "003680cd-d9bb-4987-953f-bccda5125177", "comment": "Malware payload (XWorm)", "value": "f7991d0dc570c3f7de97c20ec269ee361c0f290d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703291, "uuid": "1efd851d-45d5-44a1-8366-e75458768e87", "comment": "Malware payload (XWorm)", "value": "4eaac8e99ed8390d4a8d50137003879e4e643adcb5c7ac0306c3a4709f4d8e6105a78a9c970fb7fa84d951cf50c69f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703291, "uuid": "1f6571c8-8cf9-41ed-9038-69acc0df24fd", "value": "T14235DA9C5C23920AD830057EB1A7B8F08A253DBEC49595DB1D62FD399A3D5C12FCCA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703291, "uuid": "9e954663-53ee-4412-a379-76bd0d9a1a28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703291, "uuid": "928f2138-80b9-43a9-a9cf-57d3cbacfc90", "value": "24576:AXO6MavWMO6MavWa1IEnwMAVw9ZdbDXKiqCI0C:UO6MavWMO6MavWyn5AVkdePCvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703291, "uuid": "e5ae2baa-1e6d-4a17-85f7-077bd50f42b4", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703291, "uuid": "e88ccd1f-a589-43b1-9031-81eec1eec801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703291, "uuid": "ed0a1324-02b9-482f-bbdf-d7d373fb265e", "value": "PO Order Listed PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc3afec-535a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694735700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694735700, "uuid": "089fda58-21a1-4c35-a308-1dbd20c0288e", "comment": "Malware payload", "value": "4e8a7901a8497a559cbb2c87cc7a9811", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694735700, "uuid": "fc3d05d0-36f2-4099-b5ea-029d73f61051", "comment": "Malware payload", "value": "766a45ca52353d1980821748dc724a02464865e709fe16e830025f64afa497d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694735700, "uuid": "fd0a1ab4-5093-4986-b165-75ffee9514d8", "comment": "Malware payload", "value": "83c928281278c68e7652b911ba08498e5d604f96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694735700, "uuid": "30610d1d-10b8-4644-81e0-7af811c33b1c", "comment": "Malware payload", "value": "32532f001157bf3046eab1211b1b518e7ea9b2797fc6d1c53befb94b2f7fbfd0ed8bae416ea2503266acb5b8a98ab352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694735700, "uuid": "7ab50328-21cc-436c-909c-193b54b72023", "value": "T131E4F18072B49F1BD0BE83F8813265180BF7A5193475E7888FD631DF6AB1F915B40A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694735700, "uuid": "05590f68-6a2b-4d41-b555-63668b36aa54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694735700, "uuid": "d52b3c08-cd5f-404e-8804-6d99f03085f2", "value": "12288:+iGkH16GpZ0eAB69C459/ZwqgwXLeHL0Nod+69j/j9IX/QIj8FwLm/EUc:+iGOzZlAB69C459ip2Mg36jRsYIj8F6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694735700, "uuid": "3e78b8d7-67ff-484d-881e-21a4b37a388e", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694735700, "uuid": "d36ddb69-9d51-4f2e-acab-6d6731743199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694735700, "uuid": "64ad0d7d-6813-48a8-a422-d51e229d7076", "value": "SecuriteInfo.com.Win32.PWSX-gen.32562.23736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd7e427-530b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1694702062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694702062, "uuid": "8217a0e0-adea-4aa7-a3f6-9ab2be4f5551", "comment": "Malware payload (QuasarRAT)", "value": "4a4efb3a0ad774fa1dcf4cdae90467e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694702062, "uuid": "93bf6644-363a-474d-b367-8cc0693fa0b7", "comment": "Malware payload (QuasarRAT)", "value": "770484f1254cff92bd6193b628cf851bb600ac1633d03293210a2c5c0878111f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694702062, "uuid": "290aeab9-1143-4b0f-b294-619df0554573", "comment": "Malware payload (QuasarRAT)", "value": "beedbc28dc322a4941393d57debc716610104a31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694702062, "uuid": "12c172ea-462b-43d7-8c12-54718a06d9aa", "comment": "Malware payload (QuasarRAT)", "value": "c9a4302f0f3b968b09ae72244bf0460df81e89e3b4a7edc26451f5ef65393bc5d04396c17a469d8f118f18b73e441f43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694702062, "uuid": "15398770-8e32-4252-a72b-b4f10c5790d3", "value": "T181748D13B3E4E63BD1FE1B3AE43207151BB4D883B616E38B5A5855F92D123868D853B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694702062, "uuid": "7a956ec1-a595-4552-bad7-b80f3730b3f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694702062, "uuid": "1c017697-48f0-40c4-8bbc-5b39d1716682", "value": "6144:a2NHXf500MbdnPqhFJ1FK+bUbbgXMIiWx1hNamJX7oC:5d50riVPUQYWxjNlJX7oC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694702062, "uuid": "c23c13a6-2bab-4ba9-9850-2399b82fa563", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694702062, "uuid": "4eaa7ebc-7fd8-461b-91cc-d51e5de4ffdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694702062, "uuid": "6bcf19ec-852a-48af-8a9f-e7c20a0d886e", "value": "xAvMum3X3lmL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feca66e9-5291-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694649749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694649749, "uuid": "051bc935-637e-40f5-9161-a5c46a5c326e", "comment": "Malware payload (Mirai)", "value": "9c792bf5cfe92bd321eeafcc22ca47bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694649749, "uuid": "5889cb16-5176-4d6c-8aeb-4703aa751b4e", "comment": "Malware payload (Mirai)", "value": "7812cc47ef757ec4d0ac17f6d8390bc55a51fe538afc09e6beb29ad4d8a6f6c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694649749, "uuid": "6bed4f6e-bbe9-4330-896d-3afa19cdba4e", "comment": "Malware payload (Mirai)", "value": "e2c766336c3c1d791365ab51075c207088879af1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694649749, "uuid": "8fbd0240-f9fe-48f8-b86b-ee9cacb79bba", "comment": "Malware payload (Mirai)", "value": "569c13d8a85354bb946c79e60f8690e1ceb5b7581af63666052dfa95885f539f4df3d401f6381876216b6079ee6fa0fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694649749, "uuid": "706d5f5e-970f-4133-83ca-eff79f05d41b", "value": "T165634AC8BA43D9F2DC1602B520B7EF338E76F5B6215AF983D3949937BC42A11950399C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694649749, "uuid": "82480c94-9125-48ea-ba4d-7471303aef4c", "value": "1536:Dc0fNarwa4HU8Bzi83gZP8SfjLBovCKe9Rbz3JZGH0ik:DOwa4HU8Bu83gV8S7LBo6L73eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694649749, "uuid": "f7c33f8c-7bcc-49cc-81fb-b7e913a109f9", "value": 68144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694649749, "uuid": "2d845777-b495-4a99-841d-6877faceccf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694649749, "uuid": "7c06860f-d29f-4ff9-a8e1-c67eef003c06", "value": "9c792bf5cfe92bd321eeafcc22ca47bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904ef199-52e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694683494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683494, "uuid": "544537a6-0c04-4d96-b8a6-cbe7e1d51d4c", "comment": "Malware payload (AgentTesla)", "value": "7a2b8d09f6dc551f122248349e1daaef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683494, "uuid": "ee781886-6cd5-4154-860a-55352c37fe23", "comment": "Malware payload (AgentTesla)", "value": "784d5fd5578f4872a9a987bfd62ca7bb8fc475503a9e9509a18a27ec253b83a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683494, "uuid": "bd1ed816-1277-4544-a54e-fe879a28a52d", "comment": "Malware payload (AgentTesla)", "value": "9881680fca81ee1a5a809a42e8ae4608f61f6967", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683494, "uuid": "984b5f99-5248-45ce-88be-2b4b689dc3fb", "comment": "Malware payload (AgentTesla)", "value": "f30c4468073b8b335870572c1134190fcaaee40b76eb36cd404e9aecdcaba5d7f727f71e4cddcb0243bc76f0f8b27caf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683494, "uuid": "f3fb5b35-a271-419b-b103-e73e8519cdfd", "value": "T15F143BD8971AC533D6DCC7B4F1D3161207F28603A162EB497A9850F24E5339C9B2A7AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683494, "uuid": "1dfc98f4-c1da-4fb4-b152-c7f7bb01272a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683494, "uuid": "c02582cc-0601-418a-9a33-bd13d473ac43", "value": "3072:1SKXewHM494hehFEIWRz3ZY+YwjrqLTFBTyuetxxdTM7GmCMY7pdkE/fxvPXj5:QKXews4vvipin3UrTxhvj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694683494, "uuid": "8dc78d5a-5e9a-4038-8bb0-4891ff4be2b0", "value": 195136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694683494, "uuid": "10113ce3-7379-4d3f-afb2-8d756b77f91c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683494, "uuid": "8e6ee465-46e7-4a19-841f-913efbb88980", "value": "PO 9632 CARINA HOMEGOODS,DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc507526-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694675944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675944, "uuid": "dd760e9c-dcb0-4a53-ad7c-632e9fffac61", "comment": "Malware payload (Mirai)", "value": "cc80c7691ae53ad57b55ffca30d5f265", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675944, "uuid": "68481dec-f865-4141-a156-b18d31935318", "comment": "Malware payload (Mirai)", "value": "796e305780032950a80e68e507082f2d0a242d4a4589fe5cbcb196f98aa85df5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675944, "uuid": "e04adf06-f1e4-42d0-9f84-9cc8462aa1c5", "comment": "Malware payload (Mirai)", "value": "aa93abfdcbacd75a966d4b0ab855f16e053880c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675944, "uuid": "409a6e43-c8eb-49f3-8f23-80fb3388e524", "comment": "Malware payload (Mirai)", "value": "580b8bdc40184166c13647fb8d8c566263d9537db0990721241f0ba212eeb2085d0b1ce1167a53ba3a9eea205a879b9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675944, "uuid": "5ad263a5-6b26-4387-816f-23a4ee3dcae1", "value": "T11A93B41E7E258F7DF799823547BB8E22964837C627E1C141E19CEA015EB034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675944, "uuid": "422f29c6-444f-4672-b99c-69123c638cb6", "value": "1536:Z+NOusT2iv4UnaGZYfovI96ybjoFObugQu0N6O7VoXmLdKDJ:puGbvrNY+I3bjuOou0N6O7VoXK0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675944, "uuid": "acfe63aa-720c-4229-8405-33e85d56b3e0", "value": 97584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675944, "uuid": "4e560de0-0fa7-4576-a3ad-c6268d7e5617", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675944, "uuid": "62d309d7-4f6b-492f-a525-fc42990969d6", "value": "cc80c7691ae53ad57b55ffca30d5f265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdd1fd9-532c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1694715920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694715920, "uuid": "a4682810-76cc-4bd6-ae96-585342728496", "comment": "Malware payload (RiseProStealer)", "value": "d91ebe56ba05bc3c870a4add71888796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694715920, "uuid": "c945f0fb-03fa-4e91-8a98-325236973622", "comment": "Malware payload (RiseProStealer)", "value": "7a2e179b971fd082d58bd71c62f5692c60af0f7a6cf53e68fb4e56b86277c7b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694715920, "uuid": "6637db78-f085-4e87-84f5-de0048c6450f", "comment": "Malware payload (RiseProStealer)", "value": "7a225155d17220fb7b4aa1ff7bf13665070b102b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694715920, "uuid": "5d046f1a-3d4d-4fcf-826e-64e9b675953f", "comment": "Malware payload (RiseProStealer)", "value": "b4fce3b1b5cf2803b4bc87e939c5e55efad5f788102154ae07c2246c610e31e4e645428ab3098a2d6b8012758ee359e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694715920, "uuid": "c9be4587-8e83-4ded-b2d9-16d63e5bc83c", "value": "T190C40E9C326476DFD86BCA72DEA81C64EA60747B471F8217942311EDAA0D9CBCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694715920, "uuid": "5ae286c3-6e6e-4725-97b0-5c8206a68efa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694715920, "uuid": "88bbbe7e-2169-48fa-bba4-2a81919c712d", "value": "12288:2wP3X9VO/BspKj/9HtuDd6ksJiwhwdLBr9i4C5aF35Ujt9h4IqqnvGt2WbIaVPep:f/8/2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694715920, "uuid": "ddc6cb3e-e1a8-4bcc-95e0-35cf08d45966", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694715920, "uuid": "881ce029-fa19-4df0-8ca9-8f87439fd0b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694715920, "uuid": "7357c190-f8ed-44e8-a04e-21fde0ae98c6", "value": "d91ebe56ba05bc3c870a4add71888796.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41799315-52cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694674342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674342, "uuid": "e4251a56-94f2-45a8-9775-7ce5ae4496fe", "comment": "Malware payload (RedLineStealer)", "value": "12a6c39de2a1d20e8d42aea0c88e72e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674342, "uuid": "f0ef72f4-c144-4aa2-b578-7db78ffad320", "comment": "Malware payload (RedLineStealer)", "value": "7d677a8473c3b0d8e7b10942064fc0d6165661036d1b5f1d3bbaf80d871c3b77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674342, "uuid": "571411d0-c36f-4489-b87c-2e900a5141ab", "comment": "Malware payload (RedLineStealer)", "value": "81e6f8a7c89aa63899af9ff90a82989e4ba15112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674342, "uuid": "c451e6d3-e3fb-44a3-8dfd-9c78f6583f4f", "comment": "Malware payload (RedLineStealer)", "value": "859473bbe0c0b096ff9ecd9661e8806bcb3ebbb58b5af3e82ad889b2f16e8a4eb978df350a484d52b098b33e15b5ee44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674342, "uuid": "7731c584-7525-4517-8b00-bf7498b164dc", "value": "T11874029179A0D432D57795388834C6F06A7FFC2368B4858B73683F7B6D31292A766703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674342, "uuid": "02550464-201e-4601-bdae-419544cf36ad", "value": "ef163fd1a1dfd01940ab083fe4660afa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674342, "uuid": "fe989f98-099e-4fa4-bd40-d2e327e4c912", "value": "6144:A2HLUin48BFrwRKsAZucFBq4vdkBhPMwx7Lck5rp/WP5xuHyoFA6GdjWeadTV4:HHDn48I9iucK4uhkwx0k9/AiPFz0Qpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694674342, "uuid": "e6e2c010-ebcb-4817-a988-33e18d501de6", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694674342, "uuid": "46207f77-caf6-4fe5-bc70-0bf29f6046bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674342, "uuid": "e768e3e8-28aa-4201-a464-2794dc3a4853", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2d87e0-52ef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1694690121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690121, "uuid": "6e1ae637-ac88-4e14-ac99-9a545ecfa4f7", "comment": "Malware payload (AZORult)", "value": "62b4021de4dfbdfd7f7be8272cbfc2c7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690121, "uuid": "06ecf0d4-3ec5-423f-a2ff-853bd822692b", "comment": "Malware payload (AZORult)", "value": "7d866f33d86d517e58175b598f292c82bce331c511091472ea8249998cbe5b8c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690121, "uuid": "7ccb8dd8-1b9f-47d1-8689-043ec5278484", "comment": "Malware payload (AZORult)", "value": "5060bb5bb232f2064b9bdcccacf99463248a9305", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690121, "uuid": "f73c6f01-f47b-46c3-8c06-ca9719f1e5c8", "comment": "Malware payload (AZORult)", "value": "75ac230a4918c6cddcfd9f03e6ca7fa5e6c969d55f2938f4a35dc0da118c59a2b2cf22da2479cfd25cdf51f889b725ea", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690121, "uuid": "b08380ea-7433-45cb-953a-759e5886c5df", "value": "T11684DF247118C54AEBE537312FB0CDB61765AC9D2825836B36F46F8F32FD067A609322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690121, "uuid": "3ce6dd1e-3431-412b-9056-5d001a2aa0f4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690121, "uuid": "c8e001fa-b6b3-4e4b-a24e-7808025b2120", "value": "6144:iYa6HIhVJ9et8OgP+UQitXPDyzPtVg8612Q9J63z/6cS:iYRwFebgWU9tbyYX1t9J63b6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694690121, "uuid": "9898b09d-799f-4db6-843f-61a4c95622dd", "value": 398465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694690121, "uuid": "b84963c2-014a-4aaf-87c0-71e998f043a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690121, "uuid": "45d52b87-4880-47d4-ba9d-a39f21dd14fe", "value": "NDUSTRIAS ALGAMA, S.L. OFERTA 1309202333822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09eabc06-52dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1694681550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681550, "uuid": "3d17b0ca-e171-4216-8ddb-781c3b65229f", "comment": "Malware payload (IcedID)", "value": "868912cc99260831d53307adaaba6e2a", "object_relation": "md5", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681550, "uuid": "4201b1a0-8fce-49d8-ba5f-c64576b0434a", "comment": "Malware payload (IcedID)", "value": "7e7d5c84776e2b69eefc5958ec2dab814218fd5dd2e9f6a107833e2553bba5e9", "object_relation": "sha256", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681550, "uuid": "9b8b5475-6924-4ce0-bc39-41f7a4e04b0b", "comment": "Malware payload (IcedID)", "value": "d5c932ae969dab0b88284d35682e87ca78aaf215", "object_relation": "sha1", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681550, "uuid": "bf2e91db-5478-47b5-8649-08dcfd2d82a8", "comment": "Malware payload (IcedID)", "value": "64f3f857b899c75e01829b80e840bc339fbe19d9816997a90a6637bfa76b56be827a5fcf35193dccb386e7470bea6aa3", "object_relation": "sha3-384", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681550, "uuid": "d3cf89f9-a596-406d-9430-fe1e58e7dc04", "value": "T18032B0CC400B5571F6C7843D742B95E90388FB5FA5B26151B809EED470A03EAE68491F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681550, "uuid": "7fc09880-50e9-4d0e-97d8-4bc11622e95f", "value": "192:YDATs1ByVsJz8vVvqE0iYxd7114WY5fxYUvzCIji39yzmYtPzExUO5vQdkWMCyb3:dio2AvklL7kWY5f+gs3KmUHg4d/MN/7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694681550, "uuid": "dc40fc5b-328d-4f28-abda-029c8b2369bf", "value": 11487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694681550, "uuid": "c1e7d12c-d6ca-437c-af53-15410d14c18d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681550, "uuid": "82a1d746-9d17-4336-8914-19a202f12318", "value": "Document_09_13_927.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5871f2-5332-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694718625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718625, "uuid": "08f491ca-9529-41ca-9d55-16e2be948a09", "comment": "Malware payload", "value": "1d70db1adb9512693565b9daa29782a0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718625, "uuid": "86043cb0-5d17-483b-b33b-911c72a563bd", "comment": "Malware payload", "value": "800712a67b091738fb1d2e44fbc928096127a24d5407b6db069ff779765347c4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718625, "uuid": "80be1a04-74fa-4d81-b005-cf60b94a8e2c", "comment": "Malware payload", "value": "849d59b893acd647d6e1d571af6cee43ca50def4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718625, "uuid": "f95297e6-529d-4319-a652-6018b78e4a92", "comment": "Malware payload", "value": "b9d789b5dd70303127daaae509cac2aee6b0c2db66c0cab988deb95b71f762fbb95d9a8cec9a3873bdea7163c8be9bf4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718625, "uuid": "97ff0620-242d-4bf7-9f40-996ed5ba0fa2", "value": "T129137512F7C6AF26F26326B449F3C295A325BD049F76872F2158371F7C725B01A82726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718625, "uuid": "e3da9434-a3f6-4a78-93cb-7aeee885e29f", "value": "384:7H3fhaauCbpgj3TZOG9bqQ0374CMj9SOZWw6vV4O/YPSmRqiOe6giSwvxjk+tqCG:bpaau7JeKj9Sp/2SHBeOxw+tqC7ACt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694718625, "uuid": "2e22d227-a7b8-4f0b-997f-63225d7e6ebb", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694718625, "uuid": "794e3214-2d13-4c9b-88b3-b904855b1924", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718625, "uuid": "4d5d0cba-051f-4f2c-82f4-5f997ee4caa2", "value": "PREVALENT LOGISTICS INC CA .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b9b952-52a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694658530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658530, "uuid": "393826c8-036c-4fb6-82fe-7515457180e5", "comment": "Malware payload (Formbook)", "value": "d16abef6797eb2213c83e9580a749314", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658530, "uuid": "169c8b7e-d081-4c31-b378-6be457ec6e90", "comment": "Malware payload (Formbook)", "value": "8326158d0aea2a3ee6a49cc3f88e1c3779eb479790a8b0451133a09c1ca0a777", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658530, "uuid": "2a9bf2f6-8849-4b83-8ce9-b5fce392d664", "comment": "Malware payload (Formbook)", "value": "e73431eb2f808b85ce47d85ef3da8554cc114ae5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658530, "uuid": "6230cc48-acf9-4543-9bb9-3509796ee730", "comment": "Malware payload (Formbook)", "value": "34d239f4e6fcfe49d5668755510ec20c6c06d356e516278be4861c2dae85dc116600dcd00b0f31d155ef13627ad18c3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658530, "uuid": "5676d3ab-eed6-43c4-bc2b-f9a64a2a27a4", "value": "T155D423862BEA4E35EB6F5FFB5C1543203A3EA46FD190EBCF5B980198593374982217D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658530, "uuid": "60a921d5-0dc7-49e1-98ce-55b0633dd956", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658530, "uuid": "bf2d9958-2846-41d3-a20e-04b2d852401c", "value": "12288:c2iNZ1DknpV5dXJzSUIUZkuY1zvWE7OCK9v73NUeDIIG2p:c1pDkpjdXJx7Y1iE7mRDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694658530, "uuid": "52c97695-ad99-4725-861b-6f775d44b03b", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694658530, "uuid": "cf81b1c9-23e0-49e0-b450-857716630e0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658530, "uuid": "fc2f1ba0-eb6a-40b5-b3aa-3ab5efcec4e3", "value": "d16abef6797eb2213c83e9580a749314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec154ffc-52c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694670333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694670333, "uuid": "6babd342-374a-4cba-b422-2e183fd8e19b", "comment": "Malware payload", "value": "f1851b8e5b0f4eb699d0c50002385313", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694670333, "uuid": "2148126c-717d-47b7-bfad-4c16815cef9b", "comment": "Malware payload", "value": "832ec1fbad9bde495d9274783ed1666ef4e32c75e520292444778e1aec4adc03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694670333, "uuid": "0ac67faf-7157-4df2-8f33-502772522487", "comment": "Malware payload", "value": "72ceb2f9daefeda7159e4dc66402ade7fb8ce1e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694670333, "uuid": "fb6826bc-65e9-4a78-8ce3-2c7b29ef5cf7", "comment": "Malware payload", "value": "c47b9a51a390bc98fd0e893546a3e84e99b7d5bf6a7510597db0b093f51fde5a2bd65c726f7ebc1c53a17e194477cc30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694670333, "uuid": "71b5d06d-50cc-4b18-9d0b-df7ad0670390", "value": "T1AB5401AA4AE4CE8BF7F55C780C891B068B3CB65D3467E3371D545A286CD337EA14B098", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694670333, "uuid": "5d1bee9e-b3cb-487c-9604-2f354381b52f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694670333, "uuid": "5133bfe0-0f9c-45b8-a99d-be657f14d861", "value": "6144:M/BDZJ8B0eRVg1AhSwgxvfJ9thGNzx7dbdUmhXe7Y2rI:Mp/k0b1qSwAbu17dJak20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694670333, "uuid": "2beb66ed-9942-4789-b013-0d571534fbce", "value": 297646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694670333, "uuid": "46159ecb-cb3f-4736-a1c5-c54e7aa85596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694670333, "uuid": "21da1dd7-89ed-4b6a-9036-db89bf3b89ea", "value": "f1851b8e5b0f4eb699d0c50002385313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b213caf8-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1694703307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703307, "uuid": "c635c21f-cfb5-4aa0-a8b9-bf4e452c7baa", "comment": "Malware payload (XWorm)", "value": "4cac3c740dc5c38cbe667df5a0293927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703307, "uuid": "309d5f8e-dae2-43a6-9433-53e282e61a4c", "comment": "Malware payload (XWorm)", "value": "837e9b44da47b21ddfc5b5441882c69794feb3fb6327517bfd38af9cee96ab86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703307, "uuid": "1fd3c78c-91db-471c-b5c9-4aa27a1729ae", "comment": "Malware payload (XWorm)", "value": "4524d1c0aa6a3e18c2583cba53514c24d4f3841a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703307, "uuid": "fc2ebb19-3018-4f37-b9a0-7e48e17005a3", "comment": "Malware payload (XWorm)", "value": "10ce2aad8b9973fed4e259ebb458e32a2717ab62ce6edd0439b5d8ad7ea5da6c4c80151ffd2a7341f9f4dee2b43fa84d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703307, "uuid": "94411604-3bde-4ca1-b155-2c340284247c", "value": "T18A25B89C5C23920AD830057EB1A7B8F08A253DBEC49595DB1D62FD399A3D5C12FCCA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703307, "uuid": "a0e93281-3fa1-460b-9716-3e89b166f1f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703307, "uuid": "170e8ccc-7a77-44e3-b80b-6da4898acaa1", "value": "12288:uXO6MavWMO6MavW8TeRoqr+ZA9IJwjvd0CVq:uXO6MavWMO6MavWKqaA9jvd0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703307, "uuid": "6563a99e-1ffe-4cd6-a922-5d9a565793e1", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703307, "uuid": "36149faf-3893-413c-a74f-4e1498a88ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703307, "uuid": "3873786f-2178-41b4-a5a2-1bd9b0e65849", "value": "XPO Invoice PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e564363-52e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1694683947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683947, "uuid": "e51c826a-246f-42e8-b9bd-4f9e5624533d", "comment": "Malware payload (DarkCloud)", "value": "c7bd753950a1aaaf860d79ab0cdd472f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683947, "uuid": "047353a1-175e-4169-ad6d-c4aec6c2847e", "comment": "Malware payload (DarkCloud)", "value": "839b5edf9f07ddaea5738ee4e1ca0e58bc8193ff874e0106440c8725d806c401", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683947, "uuid": "2c457058-36f9-45a7-ba95-0179a703042c", "comment": "Malware payload (DarkCloud)", "value": "b00c396d1bfdc7c1e657ca863acc05fda593525e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683947, "uuid": "86b74c8d-adb1-4f11-aebe-be82f05208f2", "comment": "Malware payload (DarkCloud)", "value": "2c6facdbdd1e81d3086848873042c31fa9e693b8e4961b8fd25e58e99039c152b81ee4f8d96aadbd089d780828cd4492", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683947, "uuid": "a2eaecfa-d367-457b-afee-35c17ea9b7db", "value": "T171B32A14538CFA36CA5EBA38D2B24302B3B8E1552783D79F5E40A0F639A3BD5E543791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683947, "uuid": "e11ea7d8-f281-41bb-b3b7-7fff72589b07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683947, "uuid": "57942c6e-ee93-45ec-b943-784c7a91fde0", "value": "1536:YVpqvK98grguo/MRHxZSbDC0BkSWfk/HDjmUbUadiJdN/+Cs2774y:YyvKygUuuQHxq20eQfDyUpdiDN3R77L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694683947, "uuid": "0b3c2b79-6c04-4243-9880-c8627808b920", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694683947, "uuid": "45016cdd-d62e-4246-867c-9098499fc61e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683947, "uuid": "399f3a77-7ca4-4135-bafb-dc115bb8bfbf", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.759.6980.12573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786df4c4-5300-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694697198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697198, "uuid": "32dce621-da67-4e46-b284-79e65abd493c", "comment": "Malware payload", "value": "eddf12123973098843bc7d7a59c61434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697198, "uuid": "aaf402b4-9a8a-4e11-ac9e-01e0479d3151", "comment": "Malware payload", "value": "84ee6255dc64f9e8c7a106f21ef48b11af8eb27c4d454c2fa952e876aee093f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697198, "uuid": "0d382a73-57c6-4bb5-82d4-414d18204541", "comment": "Malware payload", "value": "a3e6bbf320675c394e27063a1514139a927a216b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697198, "uuid": "7a6f4a92-6e8b-4001-a474-681f5ebb4594", "comment": "Malware payload", "value": "f9be70329c8820745f207c6900aeba43f466c8dfd325c93d4740baab38e357c570ba8174fac7bea5c8d6ab2d45df1ca3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697198, "uuid": "e0b8db1f-7caf-4c0f-bada-28f2c227dc90", "value": "T142941292AAD1A951C5547330C432CCA04A7839719E16732E872DEA6F7C713C7EE67B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697198, "uuid": "ce0efd30-38e7-4f6b-bb14-6988fb11a435", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697198, "uuid": "efd3084a-eab5-45a3-ac01-b52c35376298", "value": "12288:pz7hU5I5yuNHIgzSFKxWltRohBfSTso93Uji1Y:pf+iN57Gtene3J1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694697198, "uuid": "6cb37a89-18b6-48ee-aa6d-1aff85e3780b", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694697198, "uuid": "a58751de-a19f-41c9-a2bd-951c7e3b4155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697198, "uuid": "9f8d26a6-22f7-4652-9253-ca5088195096", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee1d4da-5310-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694704268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704268, "uuid": "8bce6eea-68dd-4c9a-b886-a70278b45b4e", "comment": "Malware payload (Mirai)", "value": "ae9394541defb5eb89569ffad466d19b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704268, "uuid": "3ee47029-7567-4513-87cc-32989d6f48e8", "comment": "Malware payload (Mirai)", "value": "85e79a60681c36496ccfe34ff551b9060ac3e088c67f78b36e37ac8d47815c13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704268, "uuid": "8599e016-0063-4bc7-abb1-29c66e31339e", "comment": "Malware payload (Mirai)", "value": "6ff04e148ec408bb000ae03731094ae755e91d01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704268, "uuid": "3b7ffc82-746f-4e90-9115-7864ece51e5a", "comment": "Malware payload (Mirai)", "value": "76e877a9d9ed548dfbee45875bb673af3588b6b5737d2d0056e41d47c77dbd6cd3d31aacb5fa587f1fb5cf02af9188d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704268, "uuid": "649077c1-cff8-49ae-84ba-5eb2ed013ed0", "value": "T15CB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704268, "uuid": "480be956-f38d-4a5c-9f2a-ba34b13ea40c", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1B/LWy:c9sSyzz36YaWWgg1Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704268, "uuid": "6c6ab9c1-1fad-4f93-87cf-c5c8a18410ab", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704268, "uuid": "ddbc5b16-5f2f-4378-954e-4e5ffc341256", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704268, "uuid": "85dc8b60-de81-40bc-a22b-52d117f98981", "value": "ae9394541defb5eb89569ffad466d19b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3765f00-5310-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694704249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704249, "uuid": "72dbff59-633c-4cc3-b689-c7513bfc9932", "comment": "Malware payload (Mirai)", "value": "973bc092f7129bd68a11d5d2ddf76e52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704249, "uuid": "3a56f8a6-dcb9-4867-883c-bb7925ab91c3", "comment": "Malware payload (Mirai)", "value": "86a44e9ee134a2ef99884792a5c092549effaac6ebd96e1142c4d8fcac151539", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704249, "uuid": "00811615-1f09-4a0b-9aa7-4a5dc15da7df", "comment": "Malware payload (Mirai)", "value": "d4241a6d791f0e9fcef9467cdcdb651eee5f9fb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704249, "uuid": "cbc64d6f-f71a-40da-8df4-bb830686c7b6", "comment": "Malware payload (Mirai)", "value": "9c92ea5b33135eddbf7507dac3968e40b034946e096ae4e0679d8647f9d61590ba633f2a6e9b15d09f79990945e93170", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704249, "uuid": "87e7cb98-2ba4-4783-a32e-7f2f497f33cc", "value": "T15DA2E059BF18828BC832693445E9E6D61397FC62F2EDCD4D2580C16BB0A33D96834F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704249, "uuid": "0f7c4736-878f-4a02-bb86-9d9e1e25eb05", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTp:x98o08kxofBE+ZkXaITbp2F2TWul0c5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704249, "uuid": "1d43510b-8527-47fb-b4cd-a9a7eead9994", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704249, "uuid": "4e906f55-5412-499f-9245-0a8a4ad729b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704249, "uuid": "0ab775b3-1c47-421d-bf3e-827bc3aa6f67", "value": "973bc092f7129bd68a11d5d2ddf76e52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0465d3f6-533c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1694722773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694722773, "uuid": "05e6e37b-8f6a-4193-bcdd-2b38ec9e4789", "comment": "Malware payload (Gafgyt)", "value": "f3e5782bc419b0205578678b663a6957", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694722773, "uuid": "dfdd5dbf-ee71-4f0c-96a9-423f4cbc080a", "comment": "Malware payload (Gafgyt)", "value": "86ef3094c09473457eda9203c2bb417b383883acb9d18685c4af5c3588f4beb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694722773, "uuid": "972cc60c-7875-42c3-8359-95d4f18736f5", "comment": "Malware payload (Gafgyt)", "value": "3ba7ce03b4343adfffd3f6f7529c3cd491dfd8aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694722773, "uuid": "f885402c-6757-4d1f-ab77-208dfadfceb8", "comment": "Malware payload (Gafgyt)", "value": "375636e514f23c9806e74b4d2dc0726b90138ea1efb27fb19ea771dfb555f4c53f7ed02804852c2d56277dd6ee4ad269", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694722773, "uuid": "5df9c534-9bd3-4d48-bbee-62ff42028d6a", "value": "T1709349275691C67FC48793F62BDBC6A59523B43D0B37620A73D4BDAD2F168C82D98302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694722773, "uuid": "345f3cbc-35ba-4c4f-a0a1-4925658e63f1", "value": "1536:47aIPFobybZqHvyjZlf1hD6AdWZG87Hyr3k5bDWmSolWHrIeMXshl:eabybZqPyj71hD6A2G87HyDk5bDWmZl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694722773, "uuid": "3a26c013-10c9-480f-8bc7-55b982089baf", "value": 96080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694722773, "uuid": "88814132-f5bb-4030-992d-e03d0d184fc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694722773, "uuid": "b74635e2-dc01-4d69-9ff7-d65b8caa8819", "value": "x-8.6.blaze", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473b653b-52f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694691102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694691102, "uuid": "7b9df2cf-443c-4e12-9c72-b567174c4e58", "comment": "Malware payload", "value": "d54d717c00038d84722051d742e8d41b", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694691102, "uuid": "0e951037-b0c9-42aa-afc4-a2ea7ae091d0", "comment": "Malware payload", "value": "8789f512044c8eb7c3a75d3b3b1cdb2ab54043292cc1dcaeb90f82c7c88d5de3", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694691102, "uuid": "37d6340f-aca2-4bda-b7b5-bb1eab960510", "comment": "Malware payload", "value": "9a251ceec3044d637497ff93afa98573642a0f12", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694691102, "uuid": "786f8b44-13c7-4269-b6b0-274ef076d649", "comment": "Malware payload", "value": "6730359be60920d8a1dfb846ffb6518b74e935430d2d94867802e45673cc3a9e1b71de14182c65f07ead62477b021b40", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694691102, "uuid": "17744872-410f-4a6e-83dd-29922f3aee2b", "value": "T124056D3BE24607A1C3C903B22F9A48C9B619427D13AE76D39465815D2BE7F1C42F6ED3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694691102, "uuid": "a8a18ef1-7c7b-4bc4-bf5f-9326fe1d81b8", "value": "ceea281dcf16f7ecbb3a5a6f67a8f9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694691102, "uuid": "b3a47d1c-1751-4c28-a817-f0f7f644f896", "value": "24576:UdXHfNIVyeNIVy2jU13fS2hEYM9RIPqcNaAarJWw6j0dFZg0ZktGlIOfSJbuIs8N:UdXeyjC3a2hEY2RIPqcNaAarJWwq0dFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694691102, "uuid": "e502adcb-4a1f-40f8-ac1f-63c29e889a60", "value": 853295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694691102, "uuid": "19bf4b07-6b8c-45dd-bf0d-5bc081925b64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694691102, "uuid": "20b27240-32b9-461e-a346-169f0e6ec915", "value": "d54d717c00038d84722051d742e8d41b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df31a61-52af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694662337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694662337, "uuid": "0c4cbe6c-3a3d-4e20-94ed-5c5dc078a277", "comment": "Malware payload (RedLineStealer)", "value": "966d7ba2970b78291e3c352da3f7b15b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694662337, "uuid": "d409ea67-0fbd-4d27-b820-2bc9dbf99e28", "comment": "Malware payload (RedLineStealer)", "value": "87bbddd03d6e386b35a160a563e51c8cadbc6c9c4296991c07080f32d8e4aa33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694662337, "uuid": "ebce9743-bdb9-47e7-a380-e1a768e29e02", "comment": "Malware payload (RedLineStealer)", "value": "6d77fd83f255921f968d47ae2b588341523b2c99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694662337, "uuid": "4e310701-a522-4283-9432-3d5ddae63884", "comment": "Malware payload (RedLineStealer)", "value": "260eae36bfdf6643e0d5d86757e375d8dba0c79c71e79558494886d85b7bb7b0e1535f4c5d69ba296127ae89e3f0e7a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694662337, "uuid": "a6754fb5-e3e6-4a71-8f79-de0c753344a1", "value": "T14615022237A240B3D8B3993B05DAF7B0993A71650B5D8DEB7FD40B2D0E207D2E631695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694662337, "uuid": "193b2135-d020-44d6-a4bd-3c0950d42485", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694662337, "uuid": "be8715ec-0f01-45b2-b20b-d3a9173be9ea", "value": "24576:DiuBtZAkEtDQ+VF6J6eAQNAhtU0QlWJE:2uBfAkKs6AcKkfQlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694662337, "uuid": "18f7f0ec-19cd-4493-9c01-b653303cc9bf", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694662337, "uuid": "5b57da82-ead9-4811-806e-5538ee36247d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694662337, "uuid": "87ab5429-e5a1-4029-9018-f7cb48a0d42b", "value": "SecuriteInfo.com.Trojan.Inject4.61027.8451.26770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798e03fc-52a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694658545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658545, "uuid": "a8c11671-96d1-476e-a9e5-070db808168e", "comment": "Malware payload (RedLineStealer)", "value": "e04f4435560f78707d402c06b8deb8dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658545, "uuid": "c0ca7f26-1700-4f5c-b449-e5e793fe374b", "comment": "Malware payload (RedLineStealer)", "value": "884696bd9335b0113cf3f2d8ea9741e09f80a11a2c1eb2cc1bd3fd8835c62e89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658545, "uuid": "d2a60645-c699-466e-8355-08748b14c25d", "comment": "Malware payload (RedLineStealer)", "value": "6652b253b32d35b5162972b13a2c1158a106a536", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658545, "uuid": "d9943384-dbdf-4ace-9964-808b390a61bc", "comment": "Malware payload (RedLineStealer)", "value": "f0d0bff98d0e64375ff3ee8f7baa3a17dbbdeb3c5c6099241e8158c12122760b8cc3c4685275539643a9b7704a8439ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658545, "uuid": "82259dda-1e8d-4bae-a627-babde7db1339", "value": "T1DA85AF207F828D3DF9D632F64FBCB9B0516EE4B01B650AD7918847EEAB301E29735641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658545, "uuid": "c3b2e811-e0e1-4121-a40e-41d19162fd88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658545, "uuid": "6f4a033a-893a-4dfc-9684-ca87d61a1b25", "value": "24576:lWb9XTk00r/e+LPbHTbbK8HgneChMxHoi7QvsP8IizqifCmUXMV:lWbxTk0SPbK8HgnePxcOwuifC9Xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694658545, "uuid": "0e7df19a-0ec0-4192-a336-afeba4fbe1b6", "value": 1718272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694658545, "uuid": "184d10c9-b3b1-42c4-9b78-9525b430a814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658545, "uuid": "ae2230dd-f84a-4abe-b224-4918b7135774", "value": "e04f4435560f78707d402c06b8deb8dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b2ad0f-534b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694729546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694729546, "uuid": "84f3e3c3-b4ed-4c71-864c-1a542a5dba3f", "comment": "Malware payload (Stealc)", "value": "8816dec1704461c24f7575c00f7f86d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694729546, "uuid": "829c5a15-ca42-4833-ab12-9cda408ea9fe", "comment": "Malware payload (Stealc)", "value": "891daaeaed0ec160ca3c06fd3a5a896b776bc22a7f42cb9cb02afb49b989d4ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694729546, "uuid": "980c77d3-8733-46cf-a3dd-29636fa9b907", "comment": "Malware payload (Stealc)", "value": "fcf92c87351d810816a655946b5541d9aa638788", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694729546, "uuid": "22803912-8708-4beb-a7db-74b55087221e", "comment": "Malware payload (Stealc)", "value": "dce757ed435e086d9b15be7bde2bca19e8a2f284aed1f06f0b3111cd516ad8ca76798d208494b9a80a38bfb0b96cebb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694729546, "uuid": "fa3d587c-6cdf-48a2-8369-8c2413ba99f2", "value": "T14B34D01174D6C873E16303398855DAF45A3BBC725DA5868B3B942B7F6D323E2AF21342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694729546, "uuid": "4aade7e7-0f1a-4025-9c68-726399c808f8", "value": "85f93ec750e6f7137bb7fe5a5261ac14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694729546, "uuid": "a53e5e1e-cb6b-46d0-bc09-c5a3b2bb2cdf", "value": "6144:SdUPmv4LosfleBHL+Pd0rs9fPAzFI6Lw9T1K:S+e4dlWHCPg0OFJwJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694729546, "uuid": "e41c895f-6418-40df-9294-044dc48b84cf", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694729546, "uuid": "37799b8f-5ea7-4b88-a8a2-4694688f9b7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694729546, "uuid": "db1a8c54-eaee-4418-b686-9cbd9be3db04", "value": "8816dec1704461c24f7575c00f7f86d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aea1244-5311-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694704396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704396, "uuid": "0d6aff80-0d75-4ae3-9c61-dab8ccc148e4", "comment": "Malware payload", "value": "a68941570bd6dbee2d498e23e150ea08", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704396, "uuid": "19529d09-4f01-4df9-af09-8568beb75173", "comment": "Malware payload", "value": "8975304884fa73b88506ddffda56954957351310144282866cdd1f2a201f88eb", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704396, "uuid": "17e145e5-eb27-40ca-b90d-e7a1b6a851fa", "comment": "Malware payload", "value": "96e4b0dd8c33b4baa5553b204aac041b79f01a8e", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704396, "uuid": "fa8290ff-4d07-43ef-b286-727f962a53aa", "comment": "Malware payload", "value": "9887be6ebdddf27da22790a4a2c74478141e6766b70eef22321aacf4d9b30eef4f07a5048d76be80a5761794f16a47a5", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704396, "uuid": "f651dec7-c17d-442f-bf45-3b496dec7423", "value": "T1DE63EBD337C5C640CD5907348DEF879A6362BE509FA6474B32AA739D0F333C89926629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704396, "uuid": "df0e6fba-5057-4eaa-ad3c-2b535fd0f84f", "value": "1536:NQk3hbdlylKsgqopeJBWhZFGkE+cL2NdAkyyBQHuJmXxMj:NQk3hbdlylKsgqopeJBWhZFGkE+cL2NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704396, "uuid": "81bb4b6e-5b15-4197-89b1-60b109ec4cae", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704396, "uuid": "03bb4241-6dcd-4840-84cf-cb8728042ca8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704396, "uuid": "2d2d6707-0268-47a9-a9a0-b4de596eb618", "value": "NewORDER001300044.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ac76a5-5311-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Metamorfo)", "timestamp": 1694704437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704437, "uuid": "bec09285-9e65-436b-952d-3acda0fa1a79", "comment": "Malware payload (Metamorfo)", "value": "11d55e5169c31b2db85c84da3b4796b9", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704437, "uuid": "7f9a8660-8575-4afd-9ca7-cd1bbe9ece91", "comment": "Malware payload (Metamorfo)", "value": "8992eaf8626893b65bc38c6bad413db4e0f244e15da07ddcb185ec34f9425dc6", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704437, "uuid": "fb523f42-985b-48a4-9c53-0efa0e7f0152", "comment": "Malware payload (Metamorfo)", "value": "32b32c50b8233709edf210480534c8582496861f", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704437, "uuid": "7473d9d1-7793-4b25-b1f3-dd6fef3cce52", "comment": "Malware payload (Metamorfo)", "value": "a5e5c85cdc1acd2f6322e79692ba91b1cebfb37c7946d56bb06aae0492672d528dd93ce73740944b7ef38c4a3dc65694", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704437, "uuid": "1f2e004d-7d04-48ba-a2d9-4c6838e83cb7", "value": "T1C2447D06B3D5437AE4D70331279F93628B71EC788673422A1699760E3DF1564B7B32E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704437, "uuid": "4fd456d2-8e9f-4359-b634-31c8c725f1a7", "value": "3072:PVqdp9g3DUY5ArU6ij4qpXqnnDibAJBVkRMcB3RUN46ILJ9+ZB5yOanVx:PUdk3DUY5ArTqp4nwE/rWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704437, "uuid": "cd78a844-37ea-4737-b391-cfadd7da459d", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704437, "uuid": "d547f1dd-5d6a-40d4-a9cc-491a0ec933ef", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704437, "uuid": "4d47c8c7-9712-4825-a943-694c410580f9", "value": "BOLET0_140923.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360550da-52cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694674752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674752, "uuid": "f56d2f5a-5941-44e8-aaae-1e57b7c1f604", "comment": "Malware payload", "value": "0c451c0d7708f643f512af163ce3507c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674752, "uuid": "f1018c7b-70c4-4baa-9fa9-3dc277979b3b", "comment": "Malware payload", "value": "89fd4118df47ab33f4663b73c7fa4e0f62848684be7f23a5f62a7a40903e1067", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674752, "uuid": "8094c968-2851-4796-9a63-ca2fd7a67fab", "comment": "Malware payload", "value": "d936baca1791526050df4adce7b8e42a5c197a92", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674752, "uuid": "3e028241-eb94-4c8b-8313-2fcfccd8b8ba", "comment": "Malware payload", "value": "3c10c0e541860703364464c30c58b06d6102daa3eb8123c44b597ceeb7e1d09eaa8d358dae63053811ebaef80526dbc4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674752, "uuid": "26213b31-4929-444a-b32a-b0e8aad49725", "value": "T112D533B115D9A142DDE52DFE80AB65C3972409D4B3F8A3A35FA6677EB304FC41CCA980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674752, "uuid": "131eaa10-9589-4126-93d0-1efd103727d2", "value": "49152:4WYYoJ1iewSzmPtyzef7qnUnuAcV2gvJoN3hqoW6u1YRuEWjQfxFZtOKL3kMVuyE:hYYoJ1iUmPoqGnUu97qN3hqoWv1YRuNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694674752, "uuid": "1f73f8b7-4831-4719-893a-12a81581f47c", "value": 2830105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694674752, "uuid": "7ebb04ab-4e58-448d-8a0e-76c181955466", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674752, "uuid": "8ebb349d-c295-46ad-95f6-bbe26cd5b356", "value": "Fact0074778734705132.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a392b80-533a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694721923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721923, "uuid": "f0068395-0351-4287-a587-c0a81d7e84b5", "comment": "Malware payload (Stealc)", "value": "01649005c39b68e96038ecf1326f8036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721923, "uuid": "f4bf49c1-ab94-41eb-b1ff-5f81d20331f1", "comment": "Malware payload (Stealc)", "value": "8a73b841f8c01a43987ba35ed668896b4787efc87883f5fad1b510be4a96accc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721923, "uuid": "1361859e-24bc-4f07-94dd-c29eecbb0049", "comment": "Malware payload (Stealc)", "value": "87d5d13b98b0dbae31def0540f015199f48415fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721923, "uuid": "7d81e718-cc22-4347-96b2-17b2a6600429", "comment": "Malware payload (Stealc)", "value": "6da28d8e83539b41f7964640d2b949c8010e76592ce8a5f909b5e43dab6e17868c818713261c4f7ac1204672bc9c0500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721923, "uuid": "fd3abcbc-b12d-42a9-ab7e-a9aca80002be", "value": "T18114CF1635A1D072D6A74134883CD6F03A6EBC639BB58D8B37583F6F3E313926666312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721923, "uuid": "2ffa20e9-7e28-4302-9bca-01b30a163b1a", "value": "8c460782c9c445fd4dad4a424cb2fc57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721923, "uuid": "7a7a02dd-5cf9-4d5c-bb6c-114b66a80db4", "value": "3072:gPzLyh5OYUkm1GHzcvUDeGGXaGDyfWZ2vl5KeJqTfN493:wzLqgZizxe5b52vSuqTV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694721923, "uuid": "69275d42-97e0-4385-8560-466e9cbf45b0", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694721923, "uuid": "361a56ca-f2ca-441f-9cf7-5b8de6363a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721923, "uuid": "125362bc-10d1-48d3-9871-4e7f0c685478", "value": "8a73b841f8c01a43987ba35ed668896b4787efc87883f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db36cec-529e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694655169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694655169, "uuid": "14e48f9b-4851-49ae-ad4f-726eb41c7954", "comment": "Malware payload (Smoke Loader)", "value": "04439e826dcb2e4487b513b47f70281d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694655169, "uuid": "8974769e-69d8-4fd8-b7dd-8998ccf52c35", "comment": "Malware payload (Smoke Loader)", "value": "8c8545f91021086b21437241273005f51f0d05c46a434e9dd4076d6b98aa5c76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694655169, "uuid": "5d3ab174-189b-4250-8fc9-6a6ae8c40d1c", "comment": "Malware payload (Smoke Loader)", "value": "61a457b1f1e826c52456131bcfa9dcab54571799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694655169, "uuid": "63803103-52cf-4b6d-8a68-a20fb13d6cf7", "comment": "Malware payload (Smoke Loader)", "value": "c3507403c58fa8aef72b695cfef92967518340c551720aa1b73df242ce3a6a2192884713e1d771dbe78894165c02ceba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694655169, "uuid": "badbff10-e659-46cf-bb04-94f75eb6acb1", "value": "T1D4645C13DF90BD60D5664A328E2EC6E43A5EF961CF5927AF1218EA3F18B01F1D172712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694655169, "uuid": "cfe37855-7df3-493b-819f-437534a1aba6", "value": "0f300ecf1964cde7c4420d52f8a9784e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694655169, "uuid": "bfbeed11-e7b2-491b-be64-5a5b2dc3b862", "value": "3072:4PKOnklY9rnLDSyVV0kVGlyGTYMewbJV7Na8gc/lo44hNZ0brnx0c3:ts19rnLDSyVyIIy0HbJV7g8V9TyNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694655169, "uuid": "268809dc-877c-4855-946b-898f5b349b3a", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694655169, "uuid": "b33eff9d-c83f-4002-86d4-8397b6ff111b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694655169, "uuid": "bd86e329-5a5e-4b11-a790-19bfb2d705c4", "value": "SecuriteInfo.com.W32.Kryptik.KMY.gen.Eldorado.30089.27871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df28e3f8-5318-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694707678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707678, "uuid": "3cb26658-88f2-418a-8f0f-639e80f4c246", "comment": "Malware payload (AgentTesla)", "value": "9378f26af2f583932f75b54c25869bcc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707678, "uuid": "d2c62d65-82b5-4f2c-832f-23df96153e73", "comment": "Malware payload (AgentTesla)", "value": "8d39b7c6c1483f3238f367e08403fbe71d045b4ca2d56d8742c48a672f8eaf83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707678, "uuid": "a47e712e-ee7f-461b-b917-c080c16dc80d", "comment": "Malware payload (AgentTesla)", "value": "0a98acd98ab6dd596f2fe06734892d8176eec58a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707678, "uuid": "a334fc5a-6af6-43a5-9fc2-c9de6f734d6f", "comment": "Malware payload (AgentTesla)", "value": "63c226c259e9353fdb5c33166b7559ae85eebce573f722454975b1cd44c686926f894fcbd6e378f202485f0bdf4d3524", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707678, "uuid": "6251ad2b-ecfc-4f73-abd1-97ee00d309e2", "value": "T1F7B433E43789D624525F25B714EFCEAC48CDBD31A094836DE47B99AAC70C693883FD00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707678, "uuid": "e4a1a30e-46d3-4403-a9a6-c04d9e4861cb", "value": "12288:4Vswew0K+8hFn5Ed6/Ux2utqsbibSCTtOLdLBFndFQRczeG0jfZ:+szwLb5o1RCTYLdLjnwc6GKfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694707678, "uuid": "1275e738-f268-454a-bb8e-b07594fac4ae", "value": 519687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694707678, "uuid": "3f6c9bc6-8ed1-4741-b352-37a946974c17", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707678, "uuid": "37fc58a4-8a84-4fcb-8b37-c5e2aee99256", "value": "BANK COPY.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14fa1c6-52f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694693535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693535, "uuid": "d20115e5-5cc4-4f73-8aa7-e1fac16bc10d", "comment": "Malware payload", "value": "913967b216326e36a08010fb70f9dba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693535, "uuid": "14bcd524-d958-44b6-b135-f66d1cc575b2", "comment": "Malware payload", "value": "8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693535, "uuid": "90271099-73c8-44c5-8ed0-1fd545becea2", "comment": "Malware payload", "value": "7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693535, "uuid": "e52798c3-65b2-437b-b8c5-2f74b47aa0fd", "comment": "Malware payload", "value": "f399e78d6d6a9ad0f4f26df04417f4ca28159bccd8546f695750ba4b2f2b155af7ae8d4ae75182d36e5cd081c1841117", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693535, "uuid": "7b446919-c255-4b08-b19a-b06fb2b43525", "value": "T1EB12EB4AA3D8C772DDAD0A7E6C6353610B71E3819527DBAE188C615B6D133804AE3B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693535, "uuid": "f154bfa8-46e1-4788-8615-1350da3452a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693535, "uuid": "6993518f-7fc7-4963-8976-7c7f8b80a777", "value": "96:jmqLxbUsEIoD6sO4IcAh3VnRk3ieU6fsPC8+hKkBLiWTSFThPATlHNUpjbGxdRzj:jmST5dnhTgKXPCPhvBLiW+FFAoSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694693535, "uuid": "eee979db-e477-4430-9bca-61b515033da0", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694693535, "uuid": "bdecf5b3-9bea-4308-8a64-efc9432b397f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693535, "uuid": "75d7d38a-7317-42e9-a3f3-2648ca0f6ad7", "value": "svchost.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a71e8e-52f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694693539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693539, "uuid": "fe2491a4-d9d9-4db8-a8e3-7d3db0188aeb", "comment": "Malware payload", "value": "e6fcf516d8ed8d0d4427f86e08d0d435", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693539, "uuid": "7a49bac6-983a-4755-9933-1bace962eb83", "comment": "Malware payload", "value": "8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693539, "uuid": "11f7c918-5471-46ab-a65d-b03ba67cd21b", "comment": "Malware payload", "value": "c7691731583ab7890086635cb7f3e4c22ca5e409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693539, "uuid": "cf0c058e-3882-4be2-a5ec-70a06e42d2bc", "comment": "Malware payload", "value": "be682d26237c3e79214bc1b48cbe632bfb60fabb787948156a47844d7dee4f01aca8f616044501e9ada900bf44c702e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693539, "uuid": "366e8956-4963-40e7-a6c7-2edf2bad80ee", "value": "T16CA22BA557E8433FDBF80F3CBCB3134002B3A849AD22D76D4B74956D2C26B9A6460B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693539, "uuid": "e91d7435-4e8e-4bb0-bcd2-36b75a6c9a2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693539, "uuid": "5ab47730-0ebe-4df3-89ce-32ef6bb726bd", "value": "384:v4I7s3DhDXbdCEiWByrv0/5OPovw+BdkDGIMA10qKpWn:gggDhDXxeWwDgOD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694693539, "uuid": "cf2aff7d-809d-46cd-aff9-61c7232c2e01", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694693539, "uuid": "67db2903-781c-4a5e-932d-3f0034b1315c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693539, "uuid": "9a91a887-d2c2-4250-9c26-215b1521e96d", "value": "WindowsInput.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f77364-5305-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694699208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694699208, "uuid": "50c08fb1-496e-4a8d-ae6d-f8b636317ce0", "comment": "Malware payload (AgentTesla)", "value": "adf83ea05fe8134c1554b0d9c3c0587e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694699208, "uuid": "c34feaf1-92fc-4a7a-87eb-ba994c0a95be", "comment": "Malware payload (AgentTesla)", "value": "8efd01e16b7b5df71e84c907b47e98fa8b40700c956547e15a8d05961e6d2821", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694699208, "uuid": "a00b47a9-7931-461e-8416-816153c3b5b0", "comment": "Malware payload (AgentTesla)", "value": "133ae36717b5c79da1fbae8067649df9ae185ddd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694699208, "uuid": "7ba62b87-c938-4bbb-88ab-d45f01c46041", "comment": "Malware payload (AgentTesla)", "value": "4520b267532a2d89f3dd7d82ffd65fb3c28629343b098b9df048afddd65ca5d0525be549a6a2d12963248c4ae6c269ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694699208, "uuid": "28aad370-e758-440c-a823-de25c7b410b2", "value": "T104C4AD9C3650B1DFC957C872CEA91C60EA60B57B530BD703A42722AE994DA9BCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694699208, "uuid": "7239a3c4-2294-46fc-8873-23ffba44535a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694699208, "uuid": "f81b3802-adf0-4efb-b261-697c184b073c", "value": "12288:PbPhkksokQZu/5Ifw0qNGBoZVhGUxIIOAC/E2AL/KE/1S5qY0uLsJ7n/RwKi:jPIokt5uqeofhtWInJ7J9S5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694699208, "uuid": "8676f76b-6c0d-4bb0-85a0-01daed7f114d", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694699208, "uuid": "c29f617e-4b5c-49f8-a504-619abfb0120e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694699208, "uuid": "e92479cb-8a23-4b6a-b543-1df821236091", "value": "CI & PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f3a81e-534e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694730906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694730906, "uuid": "dd603d80-0896-4136-9cdf-99ab7c2aefc3", "comment": "Malware payload", "value": "7ca82baa3e7eddce41a25bf071216d1b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694730906, "uuid": "386adc0a-c7c9-4344-ba7f-f2d5d1db243b", "comment": "Malware payload", "value": "91a2d790366e433f18036a85d935d7e628c652c35b00427f6ef809fa9ec1f69e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694730906, "uuid": "4de42f32-9319-4bcd-ba40-7792a45a58d1", "comment": "Malware payload", "value": "fc1d45f0f81b6da49dd57d4342d5510dff5dbee7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694730906, "uuid": "a45d23f7-a33e-4b27-8db6-c9a21da34a47", "comment": "Malware payload", "value": "d2eba705a489552280ca26cea8d78298fcfdebe0edbe392372571bd67667fadccf76e536833c27abce88eb24320528c9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694730906, "uuid": "2f878ecb-6f2b-4e92-ba6c-fc0c73afe483", "value": "T1C6F52327F621952BC8F6D33620B42635A1778E28DB07BB5B3918B7BD68B79DC47412C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694730906, "uuid": "54423989-fcc4-46fb-9679-2c1900cbb1b7", "value": "98304:7SP56efffnRcj7jGPJqRvlZ+OSxM/9nLPDqyMNE:7SRXcXgqaOSxM/FPuyMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694730906, "uuid": "0180554c-f312-413e-88e1-d5ab3873792c", "value": 3634085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694730906, "uuid": "57f35053-1d83-4229-b674-f84efd7cffc5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694730906, "uuid": "d2885d78-6312-4d2d-b0fc-0120964cfde7", "value": "KissLand.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131bd2ee-533d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694723227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723227, "uuid": "5d79f036-bc28-4040-9342-357c5c633bb5", "comment": "Malware payload (GuLoader)", "value": "029dc4ba8de27ec16b4d0945b24c7572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723227, "uuid": "4be8bbd0-f4cd-4bbc-b473-f94165412fc8", "comment": "Malware payload (GuLoader)", "value": "91c7542c5c3f36571511ed146cb83a35b7b1c0dbc954466e9700ba638b7c14c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723227, "uuid": "20195d8c-62e9-46d6-bb01-9799bf9d2be5", "comment": "Malware payload (GuLoader)", "value": "19a0eae5daf93657a2d5626619b00b941386052d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723227, "uuid": "30e5570e-aa09-4a43-a6a8-c6dfa5e82854", "comment": "Malware payload (GuLoader)", "value": "abaac7d9aac956045e8f3bfa69c05ba374561a7f24f26474d60f4b54739d3500355897a2da7ea1c0dd632045bd92a5ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723227, "uuid": "3c4d30d7-1d82-4388-9f58-96d9b07822a7", "value": "T19AB4CF2EA44CC8DDDDC76A7AC850754CF2B35A46CF8700BD13546E8A0FA6E38D564BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723227, "uuid": "1048faaa-becc-41f9-95a6-5a322facf0e2", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723227, "uuid": "0d16edd1-66c8-4d4e-9d87-e9e16fcdb364", "value": "12288:lhtN9edy1Mtk8GqCdE8eOAuN6N1zxCve8cP8ugN5C03:zpedSMtkx/jAMmDP86s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694723227, "uuid": "cbc7f3b9-dd11-48b8-b149-594c179124e7", "value": 504136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694723227, "uuid": "67754999-af80-4f86-82ca-e1f83040794d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723227, "uuid": "9432974f-230a-4d78-aa8e-9aaf6f73a7a5", "value": "pedido.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ec9c79-5358-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694735128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694735128, "uuid": "58d386cd-c740-4657-be5d-4437f1689ca1", "comment": "Malware payload", "value": "e9476ead29f19bde9b3d61f166e63aef", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694735128, "uuid": "28c9f789-58e6-47c7-b607-42bc331b9ec5", "comment": "Malware payload", "value": "91e5c5dbb6e64f5399cd4786f2e91192525b6582a088a8b583a7599a82838567", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694735128, "uuid": "03ebbfe1-cc75-4b3d-904e-4853d50a7212", "comment": "Malware payload", "value": "78805a1d5b1f9c9c2c6dbf83752d39f27c795b3b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694735128, "uuid": "7319d6d3-b08a-4e13-b135-81ae897a4d1c", "comment": "Malware payload", "value": "ae354af562c96e8128469b006e250fcbba417378cc66b6464eb8100a04291ad8b5ffe853d5c1fcff0dedb8e2dec3d428", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694735128, "uuid": "91dadd00-5991-4fa3-83f7-9ec0b46796e8", "value": "T197C51213F326686BCEE2D3722171133665364D29D743A78B2A1877BA74FB8EC0B951C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694735128, "uuid": "668e37dd-1934-4053-9b7d-10e856083a1a", "value": "49152:Z/n0bBpKmG2gU9bK8G2SczKlTddI+tYno0xOVB/4qMzYhv2m+Ku974l9Re3Sr:B7mIUU8G2ScaddI+tk5YB/kzYhvd+N9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694735128, "uuid": "52881853-5c45-410e-8c31-0653997f3992", "value": 2660154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694735128, "uuid": "5c4f4299-6f59-4c4e-a0d7-c5c7cbe14996", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694735128, "uuid": "da0bf71b-36e6-445d-9563-7d680b2fbe53", "value": "sana.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1411cc6f-52cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694675125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675125, "uuid": "71e54396-6dfb-475c-850a-ffafca0fff0d", "comment": "Malware payload (Formbook)", "value": "5964fd617333fd8a4443b52074c924e6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675125, "uuid": "8b0252d0-3cd1-4c2e-8279-4e1839db4071", "comment": "Malware payload (Formbook)", "value": "92bbf36e72ad88d79ce01e26ac68113eafc29a8f0dd0c9785339929c8aae74b5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675125, "uuid": "c6b3b7cd-ebb4-4f9f-b2cc-567e711e460b", "comment": "Malware payload (Formbook)", "value": "9e36c524959215f35564d567f1c2597afe2550a6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675125, "uuid": "fa8153ba-b320-49cd-bf94-72c49c279432", "comment": "Malware payload (Formbook)", "value": "7ff4457fc3535d52c23034a655f5080896674d823fd6b7578dbe969b7088119f2b76e26f6afa4ecbb366711202f01131", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675125, "uuid": "a610ae8d-dd42-41e4-aaec-c57ceeb7bf13", "value": "T18124CE10F39090B7F0A696387885959B9114AC37B851DD2A30D77B1F2B73FB68E32E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675125, "uuid": "68f99b5e-4459-462e-89dd-73f340ea22da", "value": "3072:3o8kJAg15bBPTImAsN2HsPK4ZVDxPoPDomiptY92KZFbkqj1NRcHV:3o8unbBPTks0LMo7oXY9ElH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675125, "uuid": "4af40e84-20e8-4a55-89e7-0b2956e6990b", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675125, "uuid": "27a7aed2-5e74-49e4-a7a4-61e8ea742c35", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675125, "uuid": "fd211282-f083-4ca4-b54c-980e619d873c", "value": "Invoice Statement .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1b1b2d-531c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694709262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694709262, "uuid": "620a132d-d546-4e99-a90c-f146a5e993b2", "comment": "Malware payload (RemcosRAT)", "value": "e03f3b47c6d571d7638d3ad73250c959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694709262, "uuid": "c5190ce9-c40d-467e-82bd-6199fb93347d", "comment": "Malware payload (RemcosRAT)", "value": "92fc579cf2e7c705d2d4140228805f9254449ed058c8d909eac38c9e71d3e532", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694709262, "uuid": "aa60405c-60ac-4570-940d-5c658e6b5942", "comment": "Malware payload (RemcosRAT)", "value": "5171e195c7f98f39cf2a8be99455d31c1db20281", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694709262, "uuid": "299783d1-171e-423f-b86d-e6b580902318", "comment": "Malware payload (RemcosRAT)", "value": "49b51be13b0bbc72730a4d5a7a99c6488b2f121c2092451ccf7c0acf9b9642e3c65d2e0b0de7ad5a97b868b8d4447283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694709262, "uuid": "6256950b-ad22-49bb-9855-1ff8ac67d40f", "value": "T1A775F11D6782B455CB5E8C35C6A6A62C03F186BB6782D3699CC623F68B1370B7C035E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694709262, "uuid": "e5ae0b18-7c39-4425-944d-a6f19d445ecc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694709262, "uuid": "45cb6353-d705-40fc-886c-78da5dc9b1e6", "value": "24576:pYo90dNh/HQ8B3axWSyU0ZYFAqyX8OQgJtjBuMZB3d2CRNt:pX9INh/HQ8haxWSybZ1sOtj1ZB3d2CRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694709262, "uuid": "9d06e8ad-811c-4203-9a8e-fb38e9c2f6f4", "value": 1552896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694709262, "uuid": "fce65ada-d415-44ef-bdc8-8d51066f13da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694709262, "uuid": "ff13b45c-43e2-4e2d-95e5-9483d34515af", "value": "SecuriteInfo.com.Win32.PWSX-gen.1731.6918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c4d9f6-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1694675603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675603, "uuid": "6d99abcb-0cf8-4bb2-b36a-2614d4bc4a14", "comment": "Malware payload (STRRAT)", "value": "a2e53b54dafce3e0ee71ee8bf2130469", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675603, "uuid": "855b1d3c-65a3-4075-94b0-02ad186eb66d", "comment": "Malware payload (STRRAT)", "value": "9420b4ac6d09e02a25d7d3ef4e5fa8288fb09b7fd3a47d4d747593edac4162dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675603, "uuid": "efb37900-6dc0-464c-9f27-b5094fef26e7", "comment": "Malware payload (STRRAT)", "value": "f91791883e6f7b598afcd083f5a634d17ead167c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675603, "uuid": "0acfb06e-77d0-4214-a528-ace2395d32f4", "comment": "Malware payload (STRRAT)", "value": "73997800c878a840ad56f7f34a303c09b839d25dda5a296127b5fedb8f6e9e32f2c3812f4c3a643032b92acc952c1ad8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675603, "uuid": "ee9bb233-2062-4b53-ba5f-fe88b59adcfd", "value": "T15755C7952664391FD3E3EE24C321E222AC34F8232D9711D37DD43A59BEBAC5459EDA30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675603, "uuid": "97f5f397-c989-4bc7-83e2-592a8454ae7b", "value": "6144:MQIpfpXlmrDEsm+5n+43TX+wtvohc9PLtd5C7JyDRZCNTgb/uXQOmmFqZLhz2dTQ:XZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675603, "uuid": "e1932449-7ed3-48d7-99da-62e74cb053b9", "value": 1317498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675603, "uuid": "618b605e-8ef4-4be3-bde7-718ed4722540", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675603, "uuid": "607ef499-e5c7-4891-85b4-f2b718bf9ee0", "value": "statement1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7365b73b-5332-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694718664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718664, "uuid": "7548c5d1-1de0-4711-b03b-7ad5edf04564", "comment": "Malware payload", "value": "e4ca8032ab1f3447d1110613fa4310ad", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718664, "uuid": "642fc0ae-519b-49d5-aee6-875f4cb0eaa5", "comment": "Malware payload", "value": "9639375141c90bada0ae1fd71319b95997380748374750f8a8b02c36f35ce5cc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718664, "uuid": "6e689cb7-468d-4deb-911f-a60f4ff5d9cc", "comment": "Malware payload", "value": "2dcf78e70c4c09306de6347e090172e00c8402e6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718664, "uuid": "ca5fdcbc-f9f0-46e9-a611-0de76b323976", "comment": "Malware payload", "value": "67e2a3f7cf10c554b6daf876edce09beff7ffa5fa844d61e9e36b1716f128acac2d4c8fb0dc95dbafd6960ec49380dd5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718664, "uuid": "facdb2fc-b2d2-41a7-b369-3144b16d9080", "value": "T12413A813B7D66F26F12726B489F3C299B324BD068B76872F2158370F7DB15701A82762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718664, "uuid": "8b2fb700-06d4-44ed-aa77-2beb8f2e78b3", "value": "384:xdvIGebLocTUOnIe057kLCPahZwj9+v6ZP8PSmRqiOe6giSwvxjk+tNoT3+Y:xh9xoIYEakj9+8aSHBeOxw+tNy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694718664, "uuid": "0c0c4f57-edce-466d-a1a3-596e414766df", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694718664, "uuid": "4176b588-4437-4d9e-8cf0-db289a32228f", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718664, "uuid": "5415cb5b-aa15-43c3-b2e8-9cf1f02d1699", "value": "A TEAM TRENCHING HDD GP SC .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffa2e6a-5320-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694711115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694711115, "uuid": "c40d7e38-9f7f-444e-b65d-445583cf5e25", "comment": "Malware payload (RedLineStealer)", "value": "fc87b15ae486d4dc9071b06f293301dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694711115, "uuid": "7a90c940-d7b4-4a08-8076-025fbf59a407", "comment": "Malware payload (RedLineStealer)", "value": "9679bd82b97cef2666a160a0511b96b40e794466ee9d00a5607ba51b2ff95236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694711115, "uuid": "451af8af-5542-4784-ba7c-94966465a923", "comment": "Malware payload (RedLineStealer)", "value": "d1d0c61ecca209894b7016987752bd217e8055e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694711115, "uuid": "67ba325d-b9c9-469c-ade1-c3af44878ec1", "comment": "Malware payload (RedLineStealer)", "value": "5fedb910a017550ed8ed086fbe28dfa91641e34988f6b96ff54a3cf93ad16234e65a0f04737e996382dc364225e44e22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694711115, "uuid": "df8c6fdb-201c-4f56-9a69-86823e85556c", "value": "T1F614CF1139E1C871C5A791345870D6E06B3FBC639AAA854B32643FBF3E31392A765743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694711115, "uuid": "176fcf07-3cc9-498e-880a-1a2b05a2310d", "value": "8c460782c9c445fd4dad4a424cb2fc57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694711115, "uuid": "4463e2ae-2f42-426a-9860-625f6cc09d70", "value": "3072:jrenLJF5eSQtqsF4nT5y775sPlUtUy847N7I55Ko9P+TfN49Q:2nL3MSOF4Tw7kmWB47N7IOEP+TV4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694711115, "uuid": "8959dc40-7fcd-419f-9b43-b626a1fc00e0", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694711115, "uuid": "118b9914-73fb-4541-a758-7d8001852eb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694711115, "uuid": "237f586b-9964-468f-b4b7-6bc2cc2b9d71", "value": "fc87b15ae486d4dc9071b06f293301dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4778cb15-5311-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694704417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704417, "uuid": "b8ed0f6d-03eb-4e32-8684-a223943aa739", "comment": "Malware payload", "value": "6d28bfe2447e21a17a61dcbf695a7da0", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704417, "uuid": "b4955c0e-607b-4223-ac7c-04662d913814", "comment": "Malware payload", "value": "96e6ea363e1df3de9f59bed0b732f38293b343d3192e3c69d69475232ff0225d", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704417, "uuid": "ef1b00a8-8e37-4d99-86e2-ed84f8eefeb4", "comment": "Malware payload", "value": "7120d286ecdd775bb25f387affd26248aff7d5bf", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704417, "uuid": "e86a5f36-039d-479c-ae93-222d1dfa0130", "comment": "Malware payload", "value": "8481da8ff15bd710c66a848fb5ebd89e1e830707e8f3ffb9a09f4eb789dab39f25c4fa3cf8fe781235e794b228fca3f3", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704417, "uuid": "466edfa1-6b0d-46af-97b7-81a7d69fb556", "value": "T1EC63B6A172C4D705CDD02B394DAAC7FE23367F645E32860B22AEB74D4F72B85850538A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704417, "uuid": "50a814c5-cb6a-4c9e-bd18-79bbe04d6638", "value": "1536:kQk3hbdlylKsgqopeJBWhZFGkE+cL2NdAFyyBQHuJmzt2UgeqyAphfoAApfamZiL:kQk3hbdlylKsgqopeJBWhZFGkE+cL2NI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704417, "uuid": "933efb9e-4317-486f-b166-f3c6193a6b09", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704417, "uuid": "b64594f0-f98c-4369-9925-0c6cbac009e0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704417, "uuid": "389c6044-0ef2-4e97-aab9-ac543e029beb", "value": "NewORDER00130092-01.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf25ca73-52e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1694687465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687465, "uuid": "61d396c3-8d30-49a6-b280-2d8407c2bf01", "comment": "Malware payload (NanoCore)", "value": "68009cdd2529871592a32554ee184abd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687465, "uuid": "82ababde-1a99-42ea-a602-86e01a5e403b", "comment": "Malware payload (NanoCore)", "value": "983ae7a9c8a9751973adcf400c3e28674c737801f7ce4496b95b56545b40028a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687465, "uuid": "36d09442-906c-4bcc-b312-13e324a0ff67", "comment": "Malware payload (NanoCore)", "value": "4ce31d4c9209464b1ca3c9746a0293f6eea96961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687465, "uuid": "8dc0399e-4409-4a42-ae51-a8e55961a71e", "comment": "Malware payload (NanoCore)", "value": "aecf60d61ab3e0cfad9aaf28f1bdeed5821e6ebb92713737a1d33aca065b5f01909f11ba5577a156c3f9cf049c9931a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687465, "uuid": "7b48b873-5421-48f5-865d-11a103acfb72", "value": "T13A9422A13DD6C98BE5A14A32603A855ABFF9892B58D813830BE97B593C50341FC1F336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687465, "uuid": "c2ac7569-7d67-471f-9ef4-f24bb29ea3b4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687465, "uuid": "1aa57934-c731-4e77-aa7b-d4accfb3c640", "value": "12288:GYIrvW+1NizkjwHkpa3QptjmSUdeQwmuKWQcUxWU:GYKvW+1NpKkI3/ndevEtxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694687465, "uuid": "58ad5fff-0381-4f47-9098-e131e8603d16", "value": 445941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694687465, "uuid": "a4f5373d-6200-491d-80d0-25494b02e267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687465, "uuid": "24207b5a-ec06-4213-a1cf-34dc1a3ec388", "value": "SecuriteInfo.com.Variant.Strictor.281873.886.14991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00313b24-52cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694675950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675950, "uuid": "eb201a58-8a50-46f7-a0f6-bbf08eecd411", "comment": "Malware payload (Mirai)", "value": "f5f6850efd39ed5ddf73245b23b05cff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675950, "uuid": "0fe47b92-8e5a-406e-95a3-425b48eda94b", "comment": "Malware payload (Mirai)", "value": "9849bf81c8b37276c8c0f0210aaa73e3a3e62e07598cc732f2cd8ab60463ac59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675950, "uuid": "2daef99f-52bc-404c-b1a4-4b6d0535c8af", "comment": "Malware payload (Mirai)", "value": "2830b3fed8bbb085cc29fb0068d46ef4744c6579", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675950, "uuid": "2a6b7b3f-3d3f-46cb-9410-f9287d5152fe", "comment": "Malware payload (Mirai)", "value": "781d20b5c4374afce59738b22be3d0358fc9235159cd8dcb31f53b41f06f3c68230f61d421e7c2b37ef60e922e2ad067", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675950, "uuid": "d5b1610b-2a0c-4c36-bc6d-dcfcd500c2e3", "value": "T127E35C46FA818B13C4D517BABAAF01493332A79493DB730689285FB43FC6B5F0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675950, "uuid": "387b2ecc-8c66-4f83-be9b-378ea91eabe7", "value": "3072:L5NaIYWV5IRXKW+wbIqLkzT8Tx2XULVLhlXB8lM/9OgWe:L5kIYm5IZBQT8Tx2XOV7XBOM/9OgWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675950, "uuid": "a11d0002-64ff-4d16-be0e-e081be8c87d5", "value": 153251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675950, "uuid": "423b8d89-e90e-4232-9f0a-8bf25169b813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675950, "uuid": "0e009c85-95dd-4257-98aa-67f60a1d0f49", "value": "f5f6850efd39ed5ddf73245b23b05cff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75dc662e-5324-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694712655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712655, "uuid": "df55c082-2bcc-45a9-80a1-c36658422ffd", "comment": "Malware payload (Mirai)", "value": "724e4e9a783ecd5f9630af64a7bbe496", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712655, "uuid": "54acc4bd-d3ef-4612-b93d-fd271d41d93c", "comment": "Malware payload (Mirai)", "value": "98dd541f020889687e618fa978fe7b38ef228f6344300c730314b79b88887a0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712655, "uuid": "30f2c9d5-6f16-41cc-9184-13f3b8693515", "comment": "Malware payload (Mirai)", "value": "a751a96a59a115131d36062c17a86c1ac8f55c58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712655, "uuid": "02204d02-609a-408d-835d-9622ad5a87a8", "comment": "Malware payload (Mirai)", "value": "6d8d14122e8901bc0d92699a092baeab1307f9655b6b27c6ac3539d96ae4cec11e2029977513ff0ba5d29017ee77b343", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712655, "uuid": "be28fdd3-2c8c-4a72-b61e-a19fad150432", "value": "T164A2D025D345AEF4DFAF9CA492C2C2C276E647C7279AC8E240FEAF016506042B789D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712655, "uuid": "b2e890bd-98ff-4ca9-a58f-2c1676402842", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5FM4uVcqgw05VxJH:MRxsSVsMD6xiJJE5zRWNI4uVcqgw09p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694712655, "uuid": "e4904b3a-9b02-41a0-8089-450ea6e4c9e6", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694712655, "uuid": "6f11ef47-0a3a-4de5-945e-f5137d4c490b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712655, "uuid": "0ffedfbc-4cd5-4317-8d9f-a73f6327ec40", "value": "724e4e9a783ecd5f9630af64a7bbe496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787cc8b6-5332-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694718672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718672, "uuid": "b4c720c5-b9f3-4409-b22f-3ef8a8e99627", "comment": "Malware payload", "value": "cc5407db7bb020b61e7c6bd27b513d26", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718672, "uuid": "6a4b18bb-42d0-45d2-8c1d-698de6ea45e7", "comment": "Malware payload", "value": "99add043826e64110dbe89875bb0d360be65f6b9de3d799858a0f7294cdf42bb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718672, "uuid": "a0d0e107-2bbf-4a12-9761-32683a7e983e", "comment": "Malware payload", "value": "03107cde08e6fd6ccb190eefbd96f97cdcd476e5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718672, "uuid": "e05d0a99-a516-4dc7-ba29-0c2848830659", "comment": "Malware payload", "value": "c19f18817cbe7b90d8961e9d02749184c4289b3ad8e67511929842972a439aad002c5dfd00dabb2f53c0ef00e140988b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718672, "uuid": "a6b78fba-eb4f-43e4-a069-b637d90dc1b4", "value": "T16CB2BF60F6139405C1B201BED85D12D1ED19014BFB95E3BF5CA17E8D8D46AEB031BA4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718672, "uuid": "1e6f2b86-178f-47bc-a34f-5b9cd80d88de", "value": "384:ExmewBuE541if13hgvoYX9gC7vNxt/ZtNNFhOEr5lkGmaDiu1Od1LPmj6U:ymewBuYrknNJlxllNFhXlHDiu+Pi6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694718672, "uuid": "d1736330-a3bf-4314-8fac-d7cf175b8322", "value": 25395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694718672, "uuid": "10ee4f2d-281a-497a-a17d-089f3f08aee0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718672, "uuid": "62f375b7-16c6-4781-9432-adb510a9af22", "value": "WOOD GRILL BUFFET LLC TN .docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a993fc71-5311-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694704581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704581, "uuid": "77ba123a-d122-492d-93f5-d394e48bd5c3", "comment": "Malware payload", "value": "614173f98da8d648f13a147d8f7a6cac", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704581, "uuid": "16fe55b3-d548-4942-9f59-2b8c20cd3004", "comment": "Malware payload", "value": "9a8a0b0a4336d704137b7fdb6d57e1ba976fb13f096497c6f6f3a1d51105e965", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704581, "uuid": "fe762eb6-020d-4775-9128-89e1c53ee139", "comment": "Malware payload", "value": "7fa76790db733e9fd80371cec4dd585ab3ff5c86", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704581, "uuid": "abae1ef6-4e8e-4125-b5cd-e28ee544c1fd", "comment": "Malware payload", "value": "87210477281cbd0abf4b23d728ab0230167c93d8cd79d3df2d78a928051b346f5cad4b1b778dba54874433334aca73a3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704581, "uuid": "913166fb-e2d4-44b5-a865-fa559d91685c", "value": "T129F423659B3985B9EFDE4E63D1B16B80CB3633185586533FE4C943049FCE089BB90EA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704581, "uuid": "a8364234-d651-413e-a1e4-a98b3119923a", "value": "12288:ExnW8yStgb0oxT9+4r/yUhNHafWUUSRf+LDeO0j0c/OMGSOAGCrlkRSgdS/NZf4:qHgb0o1ValUYf+vXmODSOfC+RSgdS/Na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704581, "uuid": "05b63015-3599-434f-9955-eeaa905760d1", "value": 744399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704581, "uuid": "bbc4527e-9f34-4618-a380-eb774e54913a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704581, "uuid": "1499b264-deac-42fd-8f0e-26c66514fc57", "value": "ENQmvE231814.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc43da28-52f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1694690923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690923, "uuid": "54195921-3edf-466a-9a78-7f99269f1038", "comment": "Malware payload (IcedID)", "value": "4bc2420ce8f7d9a440b8e79e8fc6832a", "object_relation": "md5", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690923, "uuid": "950c4c53-e548-4d52-a0db-7e238d12d2fd", "comment": "Malware payload (IcedID)", "value": "9bb9e0d33d74a56fa1eeaea35fe0c0791303c2f81ea61d1c91a9a5c08f3f1bb7", "object_relation": "sha256", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690923, "uuid": "f267d5dd-390a-431f-bcc9-d8bb661a9bad", "comment": "Malware payload (IcedID)", "value": "bb9b38ed922757669d05476cfcb6ed45332caee4", "object_relation": "sha1", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690923, "uuid": "2f1d4e64-ef6e-4eef-9363-6545965cfc5a", "comment": "Malware payload (IcedID)", "value": "bcfa45150277f311dbbd4f55f7ea5f1efb55b813001ad9a3cc99226349c5d7d39fd2d7c314ef20770dbd28d4332ec469", "object_relation": "sha3-384", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690923, "uuid": "4bc36d76-50cb-4f35-b75c-2cf59b449d63", "value": "T158131F2A766D93110A2E16F3BE2E519CE700903C114707E9323DD76E7B2581B5FA9EF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690923, "uuid": "9b98d8ee-9a8a-418f-b48e-154e2b6c5709", "value": "384:eYpS664vE0Fpy4OtWbZCoO1ok7jzc56eFs4/EaNBkBNjHADr+L/fM9s+g3CtF2WD:HarbP1Z1EsS0E2RtD1rUCYAEq4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694690923, "uuid": "d58c3c3a-cfaf-43fa-9a6b-0053eb8b4477", "value": 45469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694690923, "uuid": "06a19f13-f50d-4949-a07b-8da249ef833c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690923, "uuid": "d01f63c2-6f44-4768-a42b-fa684b588b9f", "value": "Document_09_13_617.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79a0130-5318-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1694707692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707692, "uuid": "63f914eb-83a1-4119-ac54-53c70b4ec694", "comment": "Malware payload (Tofsee)", "value": "3a2a650e38e091c0f21e8fb091e60451", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707692, "uuid": "015a1625-0dfa-49bc-bcb4-c9c6ce3a381d", "comment": "Malware payload (Tofsee)", "value": "9ca53afc226509ab5c17f883b2ec241126fc95b131910c4202a2c5b084336fa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707692, "uuid": "759b7080-cf5f-4e47-8436-ce4196eb6a6e", "comment": "Malware payload (Tofsee)", "value": "284cf3e757a82b0feb43ad691a1efbfde7171193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707692, "uuid": "9a494bab-4300-47ef-84f9-c7ebae54b89a", "comment": "Malware payload (Tofsee)", "value": "6d156bd54f94a6009094c572a988d3b450fa3471cc0a3a4d171490517ea3ff67dd5db8e7ea8181c3138029fecc9975a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707692, "uuid": "e5b987c3-d528-4125-b4b4-f5d7c7e06dc6", "value": "T18C14BF1239B0D073C5A741385834C6E17A7BBC639BA5494B37183F6F3E313A2AB6535A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707692, "uuid": "7e7b52db-72ec-4a28-ac6a-50da23620d58", "value": "8c460782c9c445fd4dad4a424cb2fc57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707692, "uuid": "c03a082d-d65b-4493-a3e5-c3c031581d5f", "value": "3072:bvDSLXr5TXHwa5yak5qVmnBczE2QwWgxp9f45K6cLTfN49Q:XSL7Nga5yXdBSEbpgxzHHLTV4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694707692, "uuid": "daf9e8b2-67f0-4c6c-9dfd-2cc77311dc41", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694707692, "uuid": "4ada6f59-48ec-44d7-b521-7e13183eb2a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707692, "uuid": "818fbc6d-31f2-4c07-acc1-ec32a0455244", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15eaf142-52b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694663102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663102, "uuid": "e7b7a492-20fe-41e0-93ab-cccafc304c7c", "comment": "Malware payload (AgentTesla)", "value": "d0fa181e7c69e0b03b243c2190910ddd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663102, "uuid": "501a7f03-83ec-4be7-8109-22b097a3b2b9", "comment": "Malware payload (AgentTesla)", "value": "9e25dda533ac947bcd6cfc48b65f30ec7898754888ad81bdcc85830bd8a43ec0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663102, "uuid": "a00c4da3-f7d3-4189-aa26-e2f3c50b1e9e", "comment": "Malware payload (AgentTesla)", "value": "bae791f1a0b73d9cd601641022330f01e7393d5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663102, "uuid": "36c3a978-9417-4cd3-a0a5-0a24a31da927", "comment": "Malware payload (AgentTesla)", "value": "e0b44b50dac7f1f0f6051c8f0d9d83cbc43fe3d4de377e3cbe95f5f1611225574885b5b30ad7d0882957f8889e6ce2e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663102, "uuid": "84ddc898-3602-430c-841f-466ac3ea6fd4", "value": "T197049E2135C1C1B3C477117444E6CB799E3A70320B6A96D7BBDD1BBA6E203E1A3362C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663102, "uuid": "d96df7e3-1d24-4941-86d9-c440adcf417d", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663102, "uuid": "e93e3a2b-579d-436c-8d3c-cc6053197a1c", "value": "3072:YDKW1LgppLRHMY0TBfJvjcTp5X/WjMWGDjY:YDKW1Lgbdl0TBBvjc/+jMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694663102, "uuid": "3f859ac7-16e9-4e26-bef4-2ad965c35a3e", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694663102, "uuid": "35840cbf-e0b0-4adb-8932-f24ef820557a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663102, "uuid": "ad86c2b5-ded1-4642-8396-928d8d36f13c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a597f4b-5345-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694726756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694726756, "uuid": "33d7fe56-2086-41fb-ac1e-a0c57f665b93", "comment": "Malware payload", "value": "1d6a742534494f66081d5b70f44f6695", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694726756, "uuid": "ace9f86b-58b3-40a2-855f-936f491ae581", "comment": "Malware payload", "value": "9e89c31df9863bff75a294fdf1700a0a18607a0ddbf1bab54426a834c758e592", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694726756, "uuid": "9795e676-284e-428d-aa6a-3fc4ec644e1b", "comment": "Malware payload", "value": "1bf8a9547ab90cdf0b22b6dd92b3e2abfd6ff2c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694726756, "uuid": "73fbd7de-f606-4fa6-9baa-9f14202fb225", "comment": "Malware payload", "value": "b6c39e43363ceb97370b2b1c844553e3c05375786b9f07531aa79d5c35f3820a3b7b0bd2b263e4338c1d067a36bc0983", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694726756, "uuid": "760e9293-374f-4631-ba7c-2160782b9914", "value": "T1A154E0127595C872D26245758855C7F4D97FBC3268654A8B3B843FBF2E322E3AE26303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694726756, "uuid": "14763401-0d13-4208-b511-96b2b0f0e595", "value": "85f93ec750e6f7137bb7fe5a5261ac14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694726756, "uuid": "f5421a17-41fa-4b1e-be78-1ea575f31ba7", "value": "6144:mK8TiLuBECejBKMqlT/AsjX8eHHUtYvNG1a7B8Rrm3T1:58TisECejgCsjW8Mc7BImD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694726756, "uuid": "5066305c-db08-43a6-9c2b-7d87f62d329b", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694726756, "uuid": "e209463e-6aac-4095-b135-bf67407e96d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694726756, "uuid": "a02f6b44-fafa-4489-94f2-53ff0152e61c", "value": "1d6a742534494f66081d5b70f44f6695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42680b1f-52c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694670049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694670049, "uuid": "bea95b43-263a-44ac-bb06-c615552dc0ce", "comment": "Malware payload (Formbook)", "value": "2e6868ba26f8fa8bd7ee1e865165da8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694670049, "uuid": "93f09e67-0c55-4b54-ac2a-8ff129537e6f", "comment": "Malware payload (Formbook)", "value": "9fe145f64a6f2ed8283b9bfb1e97a3c93087d8495a53af984d619760c7d859a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694670049, "uuid": "1204cdd2-a427-41a0-ae10-d4333dde556b", "comment": "Malware payload (Formbook)", "value": "88fe0073097c81da05acf5bcecf46903c38dfc41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694670049, "uuid": "f4db387b-9612-4477-8540-c3ca18cbe6ed", "comment": "Malware payload (Formbook)", "value": "ac50672713b3028347aab8c1475be5b128d16d1b143428416d7706f054a29e9d1d0393cbedaad29d8339349fabfae15f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694670049, "uuid": "131ccdab-001d-4918-a9cd-ec748a339f79", "value": "T13ED4226CEA845712E07A37F601214F048371E72B5A19DBAF1FE876AA1E533960350BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694670049, "uuid": "1b4d2703-d7cc-4e48-b939-f3873e8703fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694670049, "uuid": "0d27a8a6-bb07-45f5-8c65-79440731798b", "value": "12288:TyRF2iNcQhcQll/68UXs+IGCRZDunEVrQoTa0swv5xFDdb:TgF1nhlCu+wZDunERrTUwv5x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694670049, "uuid": "5a7f3d67-f4cc-42f0-9494-6c72a25194a9", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694670049, "uuid": "03133cb6-d96e-46a0-9f5e-7fbfc6e30bc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694670049, "uuid": "aba84927-1b87-45ec-b431-fd09706db3af", "value": "2e6868ba26f8fa8bd7ee1e865165da8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afd24bc-52f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694693202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693202, "uuid": "e503824e-7b35-49b3-8a00-6a1030423af1", "comment": "Malware payload (RedLineStealer)", "value": "c2ce41232bcd0237adee4dc075136551", "object_relation": "md5", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693202, "uuid": "a3896157-9ba7-48ba-9cd5-75f070eef1a8", "comment": "Malware payload (RedLineStealer)", "value": "a0c33c79e0ccec5a8f5e71082180366893e3e0527fc1fcf9c1e6ca097e39b0fe", "object_relation": "sha256", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693202, "uuid": "b821b467-dad2-45cc-b7ab-535803f5b370", "comment": "Malware payload (RedLineStealer)", "value": "868b38083f67f4c9d756364aa1c0c5d5d69595d2", "object_relation": "sha1", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693202, "uuid": "026fe43d-49f6-44f2-aeab-ba99deea1e5f", "comment": "Malware payload (RedLineStealer)", "value": "173465696fd722043552ec15ccd93b0f5ecbddf590242631897bf60ffcc642a4882c04ce028f0e955e69bf4d7162838f", "object_relation": "sha3-384", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693202, "uuid": "4e7f9ecd-b3ab-4062-9db3-f3e3b52cdeef", "value": "T19904C568364BA97EC96F483D9C700CD0767CAC661246A7079C8EF4E87A3B7819F051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693202, "uuid": "f7926ba1-393d-4b0f-a9af-86be8bf6c0a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693202, "uuid": "78cf303d-e564-4083-9a7c-4fdd3c7560bf", "value": "3072:2rbL67KI0O2QuYwOvAuYW8YkE0GuRRIeJ18e8hR:2rOKI0O2QuYl8YkE0XIez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694693202, "uuid": "34e8ed6f-db64-45b3-8b8a-10ff76ee5c51", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694693202, "uuid": "417cb946-9db8-4806-9514-e33453034888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693202, "uuid": "97251afc-55fd-43b9-a9c9-7016e6b63402", "value": "c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71500a9a-5300-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694697186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697186, "uuid": "3d9ce869-39d3-4a53-bb9c-5bf2eb4b3dfb", "comment": "Malware payload (AgentTesla)", "value": "7d0fb67d2e089972a9bbeb1fd077a303", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697186, "uuid": "c0a1a12d-b2d5-4908-8a2d-1c5d0929ee83", "comment": "Malware payload (AgentTesla)", "value": "a188340c788824f0fc1f62fb7e93a40db429f015cd441b17d59c4e8b42794d33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697186, "uuid": "ce2d25f3-281a-4a55-8f29-b6699773fcfb", "comment": "Malware payload (AgentTesla)", "value": "b63ec930d1ea63d28a76fc415542724ae0716b56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697186, "uuid": "e09bc7df-3ee8-4370-9dee-9233c35bfa4c", "comment": "Malware payload (AgentTesla)", "value": "f637cd1dac6a4f38b3b9d5dffa266d9dba4a355f1e41b1ce266c5892b6b4c220669230902fddd71883777dba86118727", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697186, "uuid": "b0dfedbb-4895-4d06-99c0-7e47bb2d1dd1", "value": "T113D496037752B8E2F39FBBB3C56744004BB4F9663A1FCE1F2989235964AA3B95803553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697186, "uuid": "91fb043a-dd48-4232-8bae-e14b71caac53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697186, "uuid": "1802ed41-d5e3-49fa-b199-dbaba55f6b0b", "value": "12288:kxhl/e5Xx5dAFuyu+8c7UFd2Njy0qo4p2i:kx2h5dAwu8cUj0qki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694697186, "uuid": "c19ef74f-f02a-4a62-9a19-96f3d39e411e", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694697186, "uuid": "7f40e8ba-4df9-446e-8be5-531c0c9e2da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697186, "uuid": "5dd136ba-b5eb-4606-aa57-d8f1d981777a", "value": "ORDER 09-14-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d201c03-52b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694663087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663087, "uuid": "2945396d-81a5-49ce-ac45-8613979a4878", "comment": "Malware payload (AgentTesla)", "value": "638c636255e504c4770e02f7271daa6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663087, "uuid": "8854aa15-2c21-4f55-8693-8bd85847d2a9", "comment": "Malware payload (AgentTesla)", "value": "a19f1949995aa24c6afd60e3c19b54dd3823322385fe2e80734c09dabdec0131", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663087, "uuid": "3d8a6b02-bc6e-4b90-9361-edd68110a000", "comment": "Malware payload (AgentTesla)", "value": "16c708fe8846e65d3dca54b3d040d375d5cb54df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694663087, "uuid": "376c2065-aaa2-4025-94c5-651c06aeb839", "comment": "Malware payload (AgentTesla)", "value": "b9e1be616dfecf2fdc365e7eb1bac3aaaae3c87e5ab6a6d8262efd35d6a7ac76d94ecd000d3630f73da40e957c103412", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663087, "uuid": "79a0a470-a5a9-4d86-b791-d0229cfe5249", "value": "T15A049E2171C1C1B3C4B7113045EACA799A7A7032077A96D7B6DD1BBA6F213E1A3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663087, "uuid": "539aa100-b89b-406d-bc84-f35562696cea", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663087, "uuid": "31554237-37e5-4917-be2e-2698297514e7", "value": "3072:RDKW1LgppLRHMY0TBfJvjcTp5XPeiPRcR7uBdP:RDKW1Lgbdl0TBBvjc/2uRkUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694663087, "uuid": "e2f4dc5f-ba56-49e2-b799-8ad5fe208ba3", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694663087, "uuid": "6a9737ee-21d5-4504-abf4-8e43c7d850ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694663087, "uuid": "2de510bc-c7c2-4fee-9601-cab83596b9ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a183b8e8-52cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694674933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674933, "uuid": "3bb7e756-df44-44a0-8ad4-39e1624f9cde", "comment": "Malware payload (RedLineStealer)", "value": "90b8030fc8d0624d93d77b6a7743ab5c", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674933, "uuid": "8255952b-da7f-4cd0-b520-0bdd3bc32166", "comment": "Malware payload (RedLineStealer)", "value": "a25e499f020aff89d8256ad834a86d9764aac6361cca542d76fe2c3eadbedd4a", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674933, "uuid": "d370f952-e8f3-4171-b60e-6337b3dbd016", "comment": "Malware payload (RedLineStealer)", "value": "0d7ce774929977ec10c936560265df5588da4d0d", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674933, "uuid": "6ee32001-5118-4ff6-a380-ec5ae795f948", "comment": "Malware payload (RedLineStealer)", "value": "e7dead2ad0d65ff6fe5aa4e8ac0557cdf35e54f7b6113e422390bafd9886b971d023a922681b18e0403ba53a7883b7b3", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674933, "uuid": "67e60e37-0afb-4e13-86e2-6b8f1a317564", "value": "T165558CF13EC696E2E8E2107986ACF810835DE0B01B3655C762EC57EA8A341DBDE71753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674933, "uuid": "11ed4ba5-3e8c-42e7-81fb-f26121fec849", "value": "8d5160aba42ffb2e8789bc5aa4f2911e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674933, "uuid": "063d4876-cff9-432e-9584-f22c76cb5d07", "value": "24576:sz/bHTbbK8HgneSxMJHoqbQvFJIHXUXOAaljr5r0izmvZHV:snbK8HgnenB87VOAaljr+TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694674933, "uuid": "4bb2f274-6b45-4802-b163-82f2222db61f", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694674933, "uuid": "966016a9-eaba-4154-9211-d07656df3d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674933, "uuid": "5d6ad120-f765-4a4c-af98-734bd719f4fb", "value": "90b8030fc8d0624d93d77b6a7743ab5c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc25c9d9-52a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694658764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658764, "uuid": "376fbe5c-7ff4-4a9f-996b-da4132474ab2", "comment": "Malware payload (RedLineStealer)", "value": "747b1ae665647e8b5b57adc055f99627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658764, "uuid": "d391a28e-1e5b-423c-87b5-5bf028b2aecb", "comment": "Malware payload (RedLineStealer)", "value": "a418b06c48287ec145f1a19c27cd655eb455f1a506a0c43ba063d4e76685b5f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658764, "uuid": "a659d117-4424-4322-be14-09bea51fe91a", "comment": "Malware payload (RedLineStealer)", "value": "19b935c19e2b3ae9692baa6e1c4634f5d68a90e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658764, "uuid": "08aaeb28-9340-4eab-86ce-6e3a40788dea", "comment": "Malware payload (RedLineStealer)", "value": "c83ca338e35d3f797edb8ae677d060bb64e298f2441d00dd411979e6a5e2ec521c50f88875db4444d2199041d2a8841f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658764, "uuid": "56962803-ea8d-4bab-9e47-be35eaafec04", "value": "T13115122175C28472D5B32D3245E4EAB85E3EB86197A68DEF6BD20F1F0F206C1C732656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658764, "uuid": "f29e38aa-bac6-4ecd-abe9-7bfc09d0214b", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658764, "uuid": "ef770972-3b52-459a-940f-b856da1db32c", "value": "24576:biuBtZ460+XDYu6MUomvvsfc7d9U8+1S:uuBf4f+x6rvvsE7rU51S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694658764, "uuid": "b2d5f5da-6c92-476b-ab31-0654697e0d57", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694658764, "uuid": "b91fd37f-61d6-4aed-9f9b-ea8d70d16a20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658764, "uuid": "119f9a68-ef58-4735-aff6-cdec05b28a3e", "value": "SecuriteInfo.com.Trojan.Inject4.61027.2218.26211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f9e41b-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694703285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703285, "uuid": "54f56b42-d70a-45fa-bc5e-b8144e09f9d1", "comment": "Malware payload (Formbook)", "value": "08d3e4f13c4a19a29f521a469e8ec471", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703285, "uuid": "c3930f7f-cfcc-46a7-a956-1f7c5fad5735", "comment": "Malware payload (Formbook)", "value": "a424428f1e4286803e157ca2d62e2e74275f280ff992a035b805760abdd3c0d1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703285, "uuid": "e9e7a916-73a9-4a0f-8fca-bee6f0b8e629", "comment": "Malware payload (Formbook)", "value": "1aa4a1dee9aeb67b42782ad72eec22e3652e34c1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703285, "uuid": "0cd32866-697f-40fc-bbc2-e98a170b97b6", "comment": "Malware payload (Formbook)", "value": "a09a17d1580cdaf8fe233ac8ce4eb8d74e058a5e51e5edf5ba5487170ce2628476984582b0ac1f8259062f8e045ae198", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703285, "uuid": "0e05633b-bb48-4931-b0a5-bc8c9d66c73f", "value": "T1A494232DA26298E57F202AE203C35756261E78DE712D7EDCE1359B7F107DB9BC232025", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703285, "uuid": "d3fd8df7-f26f-4840-89e4-b6c6e887bff8", "value": "6144:JGiU0bIBnJ2c6KXndnwGo3u8n+C3YpvS4OeIfoW/4uluIed5Ki2vwTYQbwt8:J1U08BnJ2rKbuWIfYukI25F6SDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703285, "uuid": "d48e9a1a-4723-4849-9984-2cb7a481f2cb", "value": 414975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703285, "uuid": "48382e3c-6f8a-47b9-83de-36d8cb342d3e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703285, "uuid": "dfbc0e62-611c-4985-8ccb-d837c6d4b748", "value": "Kopija potvrde placanja_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723bee6e-5324-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694712649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712649, "uuid": "f5daa423-2386-47ef-bf04-92a41868e5c8", "comment": "Malware payload (Mirai)", "value": "7fa9d479ec6ed2e8e57c0aa25d285b16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712649, "uuid": "7ce1fe21-c416-4537-994f-1db6a5bb4d72", "comment": "Malware payload (Mirai)", "value": "a4cc99c881a8bc5058efbd696f89c39092ef89c55ca23784f489a33ac0dff063", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712649, "uuid": "a3569f75-7605-4a3a-a82e-024db68fe0f5", "comment": "Malware payload (Mirai)", "value": "0a28f86350a4c60b457d43a3dba6db2c90de864a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712649, "uuid": "814ca8cb-bfbd-4aff-ae79-e7df2ed89a2e", "comment": "Malware payload (Mirai)", "value": "a3adbea1e667b2a9c2b420ddff0563810e6dcf458b80dc8805087a5a19ee26e604fc5bdca9e4ae6b65939b5b66cd67e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712649, "uuid": "4df3b684-f2b8-4bca-8860-4bf40b3a2816", "value": "T1EF230271880E9EF124303C72DA99D783BAE129B1C5673113D6290A3C2FB97631E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712649, "uuid": "1922e20c-dfdb-4919-ade2-49cfecf644f0", "value": "768:5/TYCoIxdEk+AxoTZAZHFeq8b3n49q3UELbUXfi6nVMQHI4vcGpv/:5ECFd+A6YHAxnhLRQZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694712649, "uuid": "4af427a7-d9c5-4098-af6d-8b378726d247", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694712649, "uuid": "56f60eef-46d2-4ef7-aafd-c19741bbba17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712649, "uuid": "202277b5-e216-423d-8aa2-1bdb6a8badda", "value": "7fa9d479ec6ed2e8e57c0aa25d285b16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bfd7a7-52e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694683615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683615, "uuid": "bc61aa9a-5f95-47f6-9899-8f621064170b", "comment": "Malware payload", "value": "ae1d87f464d461d99b30cac5281b7996", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683615, "uuid": "e4b8b660-bdaf-4598-9e5a-501385e2241d", "comment": "Malware payload", "value": "a5da3806f527cf4d8bf0543abad4f1a1d4e5795cfb10336533938100d630c62e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683615, "uuid": "5809c4e2-e1b4-4715-b162-d9c409a0aafa", "comment": "Malware payload", "value": "f64fdb90007a6df2367647ca72c0f1f9750a4c8f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683615, "uuid": "73e7511f-c378-47fd-87f5-237055cb6c55", "comment": "Malware payload", "value": "01d11a8a8d5a49ae1263a7a432062e05b7fdae5fec6b694ed015dd7470bc54a6ef831bd6e1631804662e839cb20eeb8b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683615, "uuid": "bc651fcb-0fe8-4904-99ba-488aaeadb8db", "value": "T15B53376DD34F02A9CF6253379B1A1A8542FCB77EB38552B1306C433533AEC2D61262B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683615, "uuid": "7347577f-c4c3-4dfb-9e2d-143c0d5e7326", "value": "768:7wAbZSibMX9gRWj/MWGlsp42ld35ommRlPKafbeShLV3GFuDZT8GImw1t:7wAlRaXp46XNmRlbGEVTDIX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694683615, "uuid": "c66f3e9d-a6e9-467b-8d65-62cb8cd1593b", "value": 60921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694683615, "uuid": "6dd22ad8-f202-405a-b0e5-52f3bcf409ce", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683615, "uuid": "86cc636b-5747-4063-b173-a284c4b3fc61", "value": "Re-QuoteXRequest.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3091c0-52ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694688802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694688802, "uuid": "55132224-b2ea-4d9e-93f8-9f902422e581", "comment": "Malware payload", "value": "84354f90851c0a046349687adfeac560", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694688802, "uuid": "399282c7-81fa-4872-94bd-51912663da33", "comment": "Malware payload", "value": "a5f4ca77d74032a7adc9b7e3aea00f704f449fa7cfad3192ba2950c617266b09", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694688802, "uuid": "a27d418a-4876-4d69-8c15-e4f303cf27fb", "comment": "Malware payload", "value": "fb379f8b7942ce3af8d1c1b1fe0d4c06b5d4c6f7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694688802, "uuid": "347bb97c-22d7-487b-b186-2525be4674a9", "comment": "Malware payload", "value": "bbb9680cdafbf51ec7379a6236999b5965901bf7b8fc3786da40ff05290a99576763d72701d828ff919ba4ebd6f658cb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694688802, "uuid": "3c4f66b8-7f23-42ff-a234-27d4390f1206", "value": "T15ED5E159FDD4982DF713803264628866EA3945C9C0C7F06B15F91B4ACAA9C863B07FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694688802, "uuid": "8ab56d7f-0530-4e0c-a0a1-b9a2dae94858", "value": "49152:mZ1w6xiel9wXc5mHavv8Ug/maXjee+TlI1OVU/uMeHZhnQaVTQfE3emK0:mZ1w6Ym9wXLevkpXSPQOVxLteE3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694688802, "uuid": "1dbb5ae6-7325-43c5-919f-07a945985fa3", "value": 2773581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694688802, "uuid": "d59b2b5c-ccd3-4943-93cd-6ad586fefcea", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694688802, "uuid": "d50c3014-9bf7-4b70-987b-23b6e5a91bec", "value": "starter.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622171c5-5324-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1694712622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712622, "uuid": "435a87e1-f720-49c2-8bec-1d960c1c7d9b", "comment": "Malware payload (RiseProStealer)", "value": "3103e22bdd064ca5de7f23a49ceaef60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712622, "uuid": "ca2bf8cc-70e2-419a-b658-9c41bafed72a", "comment": "Malware payload (RiseProStealer)", "value": "a7238762ab2470f525fd71cab2f58710d9e6d850501a06c7be51025b47fee7c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712622, "uuid": "91c293f2-5a59-4a4c-bd2e-3d488e908e44", "comment": "Malware payload (RiseProStealer)", "value": "07048f025d40804d189ca85b6bb498815a02135d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712622, "uuid": "975e2cc5-8667-4a9e-824e-3a77853e0a21", "comment": "Malware payload (RiseProStealer)", "value": "0777c759e678b9a2e35bf15c51dc72a77959af17d60204612b44fa3f7dccf6843c3fa66f59befe5d405b09bcf4d407af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712622, "uuid": "521c3d78-ea48-43ca-8776-1968846d51f5", "value": "T161C4109C326476DFD86BCA72CEA81C64EA60747B471BC207942311EDAA4D9CBDF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712622, "uuid": "bf726807-cad0-435a-918c-dbb242e2290c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712622, "uuid": "f4d98aef-e768-410c-824d-761d8dca53d1", "value": "12288:z0/r22P7terOJW8bTNIDtsAbEkmVBp1sa4Ih9bAW6I9H3C52HukkJWofJXD59Z1Y:z0y2BZIif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694712622, "uuid": "a009ff45-9758-4f15-a58d-2f09ad9ac57e", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694712622, "uuid": "9ffe98a5-af51-47e9-9272-b730da35be68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712622, "uuid": "2d14dee5-4471-4f16-b1d2-7f0529402015", "value": "3103e22bdd064ca5de7f23a49ceaef60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb70d30b-533b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694722650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694722650, "uuid": "297402ee-a485-4fe6-a5c3-f532bd0b4c12", "comment": "Malware payload (Mirai)", "value": "83127d8031d03ed7197821b788b23153", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694722650, "uuid": "d8dee14d-2128-4ba8-af19-3cca00e3cefb", "comment": "Malware payload (Mirai)", "value": "a926eae393072b9cbbe0078e3027f92c5a5fbf83669eb603aa4ca86fcefea2aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694722650, "uuid": "bddbc125-ad6f-4187-b671-94d964413516", "comment": "Malware payload (Mirai)", "value": "bc69f5d0d6341ccb1c801605ddcc2103a86e907b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694722650, "uuid": "363f3948-6b5d-49cf-8a53-f09731051eef", "comment": "Malware payload (Mirai)", "value": "0a3afcb443579308d98913ec80a6fdbed28b370289280913cb0997dfb16823b4fb8abd9fe97b49a1eb45a048782a438d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694722650, "uuid": "eaff47e5-cc12-45f2-90eb-0ee07b7d8723", "value": "T1FDA2E025BF1DE88FCD37A23886E5E5C692D07D21D39CC9866781C11FAAA36846834E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694722650, "uuid": "69d48646-3154-450c-953e-f6e68080eb19", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtaSy8:M98o08kxofBE+ZkXaT47C2EpitO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694722650, "uuid": "99ef93c5-84c7-4fc0-8352-57c37c519e00", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694722650, "uuid": "7838adea-f4dc-4579-a512-e30353de28dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694722650, "uuid": "c1f687c1-95c9-4108-a541-67a3e08a4114", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e1bc95-52dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1694682101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694682101, "uuid": "a5168520-48b4-4d0b-b923-fb6b8989b985", "comment": "Malware payload (Smoke Loader)", "value": "b93b5346a85d66f35c239ff0ef7f6fe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694682101, "uuid": "9733b28e-f1c5-4faf-bdaa-b543556e8dff", "comment": "Malware payload (Smoke Loader)", "value": "a9890f87b21ea9eb9f36f6d569ce7051c4b44bdc8b6a709ec294d6dc324d82a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694682101, "uuid": "fcb9ad9f-d5ec-4b00-a964-f5127bf57b10", "comment": "Malware payload (Smoke Loader)", "value": "d9b5f97da07df88f4afb24db025c252bf9ccefd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694682101, "uuid": "293404a6-afe6-498d-8cf4-89d34aa75bd0", "comment": "Malware payload (Smoke Loader)", "value": "1d315a9da6e68774b100c3aa26a3b8f97a7beb3ad572eb84852cc5f8fb6f9f86274702291277c5db2e85462ddfd3a097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694682101, "uuid": "c7fc5650-76af-424a-a86b-7d44688c2040", "value": "T1CA14CF3239A0E471C4A751309838D6E15E7BBC23A6A5854B33683F7F3E327A25766343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694682101, "uuid": "b73a8f10-8067-4e3f-b41a-57c2e91ed69b", "value": "ef163fd1a1dfd01940ab083fe4660afa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694682101, "uuid": "86578709-2010-409e-b46d-3a70a7b93b27", "value": "3072:vph/DLe20JXR63O02Ox1JVjMuz7YkHtqWEUoxXZ7564p6ET3d4P:X/DLejpA3926HFUk+UeXylETt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694682101, "uuid": "0df62938-f1f8-41b2-a8a9-643b5c9500ad", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694682101, "uuid": "88e11c62-3bc9-4bc9-a1d1-3faad45da163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694682101, "uuid": "155d8e84-40bd-4aa1-b6ab-22dd7fec0ae0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7c2de6-5304-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694698951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698951, "uuid": "3a6625fa-74b9-48ca-b7db-bc44aba14ea4", "comment": "Malware payload (AgentTesla)", "value": "ed55b32151792a117b9c9bfe439734cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698951, "uuid": "d9547914-c677-4ca9-a0c0-9ce238264ad3", "comment": "Malware payload (AgentTesla)", "value": "a9c86947b445df66fe7859c36885e11455743c776a4e9911192e9a355eecde04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698951, "uuid": "b021cae3-6b6f-4fe7-91c4-bcfbf6fbb3f5", "comment": "Malware payload (AgentTesla)", "value": "c9ab9b9febae1b884122a1a9d823f2d300659b3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698951, "uuid": "ae580551-4964-44d7-af7a-81591dfc3f59", "comment": "Malware payload (AgentTesla)", "value": "75dfd3dc9ea0444422a11da2ab66d6cc85b5ae451cf6387e2f88b2db4c8ba33739dcbfd5355f889aad2673497c078d99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698951, "uuid": "9d210d3b-62e3-4523-ad2b-a9c7d7e6d8cb", "value": "T1FF340E037E48EB11D6583D3B82EF6C2853F2A0D71633964BAF48AFA525552536C6E33C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698951, "uuid": "dde0ca51-029f-4b8d-838d-25e28ad347f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698951, "uuid": "1e42e7ae-a3e9-41c1-91d9-9029df669fdf", "value": "3072:XclYULRgvDeka2be0UtIlNp3X/GNTAPTBQbYrwoNKMCh:smUlgvDekPbe0UtILQbYMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694698951, "uuid": "28f62940-c69c-4bd5-b1aa-bf73fe8ac9b9", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694698951, "uuid": "40b82d6f-cb94-4e24-ba92-20c495990b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698951, "uuid": "ffab4b48-7bf5-4c0f-8544-3f64a025ff12", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ee9353-5292-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694650034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650034, "uuid": "ff1e8edb-66fe-4870-acea-e79953903056", "comment": "Malware payload (Mirai)", "value": "73f5fd1ec856484cfac970fa8ecb8197", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650034, "uuid": "9c8ed023-e6a8-448b-bff4-dc8ebdc0b9f4", "comment": "Malware payload (Mirai)", "value": "a9dd8b0bd35594ec649a756af01bcc133e0ce4b7ff77af7bbfefac3766391df2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650034, "uuid": "8ecbba6c-29ee-4012-b0e6-ce8386593d8a", "comment": "Malware payload (Mirai)", "value": "48f7dac812c23e91706a03c12423efc780b6a4db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650034, "uuid": "e9a8874f-d7d0-48a3-a1f0-7064e994237e", "comment": "Malware payload (Mirai)", "value": "93dc3f1976ca0893601356ac89ffd6e3adf6731e24a3081a760a58dec17edbb98fa4388ed54b975544e18ca87f2241e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650034, "uuid": "21f1750f-a8e7-47d7-bbf7-55a741e32ccd", "value": "T191730751B8C19A23C6E4237BF96E418D372563E8D2DF3207AD212F6477C682F0D67A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650034, "uuid": "da919333-0c34-4a4a-ae80-2d0a68aa2859", "value": "1536:r0TYdvgcgQvt8ybKsyicfjfS3TLpKVIahWlJs7y055RZTq35Nyg:r0FfO3ZKVThKS583C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694650034, "uuid": "5124232a-8566-45a3-a06e-e2adfa436fa4", "value": 78844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694650034, "uuid": "530be383-263c-442c-a11e-1332efdc5036", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650034, "uuid": "4cbbe692-199d-4e2a-9dc9-e7c38fdf1857", "value": "73f5fd1ec856484cfac970fa8ecb8197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad86befb-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694703300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703300, "uuid": "b8ff253a-3ff0-41ea-aad8-9276a032e8af", "comment": "Malware payload", "value": "ce189a54952edefdb51b67987620c0e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703300, "uuid": "48e9335f-dcbe-4198-b8e0-b5b1ebef530b", "comment": "Malware payload", "value": "aa5dd4972e0211d912506d36b72be348566efb407712dd97aab3c8f69bba0294", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703300, "uuid": "269bcdfd-1d57-4b0a-b960-fa990a110e6e", "comment": "Malware payload", "value": "f055ae7bfb460df2941ac0fdf23c0ea9bbcf7191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703300, "uuid": "9507fce7-a2d1-403f-a039-5df39ee3da8b", "comment": "Malware payload", "value": "92a376c84a5ffed241ac8fcbffe296dc645bb01ba487c135d53e840f529793a67ae85df70f88c832815a637b72814bc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703300, "uuid": "22574b25-8a99-457b-85b5-2b25feeb7ea5", "value": "T1CAF41229B394C55AD4551AB9C9028BF06263EE16F805CF4BFCC43EDE79766E94B022C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703300, "uuid": "269156cd-b454-497e-b9f8-daa3b4b1662d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703300, "uuid": "9820d022-5c78-4713-92c3-0b28f85161fc", "value": "12288:6wLJRMAtqxx/MKTeXGq95qZeWL0z/xf5pFnzoekxkmWq6c:6wLj+1pq95qJoxfbN0Kq6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703300, "uuid": "83e7c9e8-1a89-4a52-82b0-d6fe16a41ffc", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703300, "uuid": "ac49fd89-1d4f-4171-8b0e-193ca58768c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703300, "uuid": "13bb7131-60d8-4227-aa56-adabffb06c1b", "value": "samlple order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d848daa-52b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694666255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666255, "uuid": "c309b302-d8c4-4b85-8b9c-ee137be9910b", "comment": "Malware payload (Formbook)", "value": "e3dafed67664bef311ab5d8282d6f219", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666255, "uuid": "6e152daa-6cc1-4630-a454-dd0319f84f80", "comment": "Malware payload (Formbook)", "value": "ab38780451a464e6a292bedd185cfebae8032e19437f01a1e877f87e33bf4ac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666255, "uuid": "9cdf8ba3-50aa-48de-aff9-adb126969450", "comment": "Malware payload (Formbook)", "value": "7372e82a47c0b6d4968822a71bd08adfa6d2f45b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666255, "uuid": "7aa04089-7372-4a48-9ced-7362eefe4358", "comment": "Malware payload (Formbook)", "value": "84f0988699e662998c5e69277fd516cb9eaa445e0577e9ac834940ab9c577a668c854796b4c8754682ec492e4026ecc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666255, "uuid": "b7904146-fdef-4853-b225-e4e766bf3fe7", "value": "T1C9C4234530ACDF3AE9CE0BF166E0910D13F09799F682CB1D4F8602B85D977512BA8B6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666255, "uuid": "bb0100e2-53fa-4575-ae90-11d7b690a9ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666255, "uuid": "d03916b5-3d04-4ccb-a3c2-d4dc2aa107d5", "value": "12288:oPj8FwLm/ICyfXEtsR+BF7d+e2WdyWEVASsu4yaBLNzG5C8zOegL:oPj8F6Tf0asBFh+B13kC0LT+ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694666255, "uuid": "946c7c36-1e22-472a-b084-b09e87a0b5e8", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694666255, "uuid": "b81a7ca0-a318-4d8c-adb5-b7fbd436d836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666255, "uuid": "1ac12215-cad5-4b26-8fab-67b56e0cf8f7", "value": "SecuriteInfo.com.Win32.PWSX-gen.23382.11031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e92883-533a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1694721920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721920, "uuid": "822177c5-0a30-467e-becf-6f6c969f9448", "comment": "Malware payload (RiseProStealer)", "value": "2b8652ca94dad29260004c12456e1bc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721920, "uuid": "bd8234de-8bc6-4999-9ef2-555ec397b067", "comment": "Malware payload (RiseProStealer)", "value": "ab46ea9e8a967b71edd17e24993c428336490f63b3765a917e738494d088f16a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721920, "uuid": "81592a28-dfd1-4cef-bc57-2ed4f28fd44c", "comment": "Malware payload (RiseProStealer)", "value": "132450c8926fb19230a0c627fa34d759bb3557e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721920, "uuid": "81e74749-e766-40cd-9ce4-f1555671a07a", "comment": "Malware payload (RiseProStealer)", "value": "52372751cffdb37051a47b9002be84f4e5779c52b559b35967f24380f26084abc9c238f123c2b86ad4acf182b509e2e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721920, "uuid": "1ac5f34b-1485-4c77-8d9d-2f62c03051e5", "value": "T1BDC41E9C326476DFC86BCA72DEA81C64EA60747B471B8207946311EDAA4D9CBCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721920, "uuid": "d8d45854-eb22-462c-9540-b12a790341ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721920, "uuid": "7d7156fc-5eae-4b42-96bf-7023e8a948d7", "value": "12288:HwubUmgAbNyKkB6rdrTWmNEX9q89Sesl81TwALJAteHcP0Xm6Ckk/47ZUeHcJy0b:HdbuKkmEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694721920, "uuid": "084d14c9-2a00-4491-9e00-a8e10dd59cb3", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694721920, "uuid": "0df70d1b-6ceb-4b2c-8178-2b90d4416399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721920, "uuid": "ef64e7db-5a40-43e3-9c60-54f95bf81e6d", "value": "2b8652ca94dad29260004c12456e1bc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a109cd-5302-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694697951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697951, "uuid": "b7ffc85e-a6e1-42e8-805b-1c449b7dcb5a", "comment": "Malware payload", "value": "f02f0fffcf01d8580c14a412cdd71ae2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697951, "uuid": "1d3d0baa-632d-4840-9cac-ec6210d2ed78", "comment": "Malware payload", "value": "ab4bc5a183ac500f322275ea49c49528bd8823d33be627a265451ccf9ce1b23a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697951, "uuid": "2f507b97-b1af-484d-afe3-80fae0adbd42", "comment": "Malware payload", "value": "3410b46f0a4dca2f9f5b42d3db4f4044fbd8fd19", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697951, "uuid": "fb1cff88-de4e-4486-976a-34590cd67503", "comment": "Malware payload", "value": "2d842abbd94866f07a1f5160cc36b9bcad673598ec7b40f46d8e2282a38aa2b7f8f50f62fbfb4cffa3f43ef031523656", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697951, "uuid": "dd22df17-d5a1-4fdb-a3ec-b6e839cd4f72", "value": "T131C633BC38A23AB8EDC68A7D43704C969F291E6B751945561103388D22FDBC532B373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697951, "uuid": "31039324-f542-4817-aff1-f1dd3e3a2606", "value": "196608:dtJtlLVlMQX/aP/7Ytc23wgnoiCQww75xnv5JZabwmUViFJc/LRsuhSeb9pS:XvlvMQPaPQjnodQjxnv5b8wNiFJc/dHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694697951, "uuid": "8219d80e-e14c-47f6-9a11-8388ce2fcb91", "value": 11506804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694697951, "uuid": "bdbd89b7-26a4-4af8-b7eb-0c8b04b4cbac", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697951, "uuid": "b4c16043-0be2-4502-bcb7-a1c20ad2fade", "value": "LiveChat.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7131ee5-52cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694675425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675425, "uuid": "3975e68b-f58d-44c5-8315-efd2c8f510f9", "comment": "Malware payload", "value": "1a9ef690c6f65c6495775e7ba9787386", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675425, "uuid": "d42d0eb5-6335-42d8-a4bc-f00dd22d10cc", "comment": "Malware payload", "value": "ad12f842b38f8d898b10713b3cb29cfaa390ba1f3658825d31512c257de691c0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675425, "uuid": "c2bdbd8f-c9f5-4ee3-a324-34e27f0b68b9", "comment": "Malware payload", "value": "17415c70c833f8431147fbdb72215fa4eb1711b0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675425, "uuid": "633cab1f-b8b6-49fd-a62f-bbce49477e0a", "comment": "Malware payload", "value": "8b78e15c0ba3cb4e03c246fb135a6d6da0cb56fd82a8d3eeb8a1078d088b0217dd8050fadb70ea7ec0ce5b204c67a15b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675425, "uuid": "608b34b9-705d-4378-9bca-32cd23f575de", "value": "T105D423EB856698065ED01D3B7424A9534CD6E8CACF912C291D2CF43C29C77D4ACCF66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675425, "uuid": "4f213413-61ba-4666-a929-40ad3d828742", "value": "12288:G/ZXU5kb/l6N2JsmPVqxup3lKK3gAwE8YFV+RDmCy45x:AZEezs26mdiunKKQAwEVF0Rzy47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675425, "uuid": "25ecc296-c044-4a5e-b24d-67b23c7aca5a", "value": 655230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675425, "uuid": "56e02c3b-0c77-4455-ad41-1db7e7f07345", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675425, "uuid": "4567aec5-6951-4b1b-9768-f342ed3c5909", "value": "NEW ORDER .xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe88039d-5315-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694706442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694706442, "uuid": "96674857-424a-4651-84d5-3a32f7a0a9ef", "comment": "Malware payload (Stealc)", "value": "d8ed3bcdca3c0dfe607e62c2f5e26d56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694706442, "uuid": "847d0233-a78c-426c-8d01-9aeee1dfd788", "comment": "Malware payload (Stealc)", "value": "ad3b6f6c891cf7a778982d47b7003ac7073b499c5947ea7d4a6c1684fbfe05a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694706442, "uuid": "dec6503d-346b-4a63-9465-44f4b2268936", "comment": "Malware payload (Stealc)", "value": "ac2e1ae8fda911fbca2de5b2b4d6b8e7ac59bfbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694706442, "uuid": "d62f2848-4bbd-4792-85ef-dd2d8aaf73de", "comment": "Malware payload (Stealc)", "value": "268f5f084c550c2559eb8ac55c0eaee8438096405c6e9b9496b1125cf224a85d245b8f452c7f5579471f2fa594636d7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694706442, "uuid": "c9c0e3f7-265b-42ee-ac3d-64afc86b0ea2", "value": "T10514CF1279E0D033C5A751349834C2E06A3BBC639BA5855B37583F7F3E322926BA6353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694706442, "uuid": "33e4ec0e-f111-472b-8894-af3ff04d017c", "value": "b240da42760a8c87cea3a4ff648819c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694706442, "uuid": "0c715d54-bf8b-4e4f-a5d9-da3ab7ea4eed", "value": "3072:oheeLiIJ/hHlAE5ogY69SY3Lrn0xgjf3Dnmcy56ZbD5TfN499:weeLLVhFA+o3YLzzmcVd5TV4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694706442, "uuid": "b316609c-c770-46bb-80ad-d6c5701d74dd", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694706442, "uuid": "9f33409b-3445-4e8a-99d4-47863691b82c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694706442, "uuid": "21c553f8-85b6-485e-b3c1-7df60726393c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c9a3d7-52cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694675420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675420, "uuid": "b22c5406-e146-4ef0-93ea-cccc586726f8", "comment": "Malware payload", "value": "a943d57f7255a0258874dfbd52d6031f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675420, "uuid": "4aa8e19e-8a8b-48c7-8535-b9596d0a4812", "comment": "Malware payload", "value": "adb13f4afd20ccf933da19aebc3b6b1a92c001982efccf535e7ea897841e100b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675420, "uuid": "0bb24782-74c6-4413-a6ae-ee12e46b1169", "comment": "Malware payload", "value": "2a706e81ad62dc98cc57f6d6b470b7eb0951200a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675420, "uuid": "24c4b281-9688-463f-9907-843ff45939b8", "comment": "Malware payload", "value": "56d682c712fcd4c858508e736942cc60f09437ee26cf945ba0bcd43f633538bc20cffd755857b9a7e98ed8a886a9a4b3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675420, "uuid": "d659c50e-4cce-41d8-9918-0b1edd2a6eca", "value": "T1E8D0A9015D8DCA0510B1C8B6023CC4FB7F8A3A60CB1C7BB53F84444412B087204AD00F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675420, "uuid": "363bd3cf-6dfb-4201-ae28-302b4cc9f02c", "value": "6:VtGTPxkYM/2jL4P5PaHRTAnTSu5cFaqgPSxf:VtTYeULkC2TXUsSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675420, "uuid": "66878ddd-db2c-443e-8a2c-588c7bfd03aa", "value": 235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675420, "uuid": "6e68dd15-486a-422d-93be-e6a6e30ed0b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675420, "uuid": "36b168f9-2d91-48eb-9c8a-0197984ed522", "value": "home.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabbcc81-5310-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694704234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704234, "uuid": "ccb4e465-fea2-41ca-abde-caec233132ac", "comment": "Malware payload (Mirai)", "value": "8a9fab7929f4b80261d27fcc5a9c28f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704234, "uuid": "f8164e64-b6a7-49ce-a6f7-2922349ba734", "comment": "Malware payload (Mirai)", "value": "ae52f871ad376634aff0c79df53bf06cf5c11a12e3f0eb6b8c0035833f704d55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704234, "uuid": "14f26935-0672-4c7b-b3ee-a533574693ed", "comment": "Malware payload (Mirai)", "value": "a470675fa29aee952fd152b15c60165d31d4c1d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704234, "uuid": "355bac90-70e1-43b3-be60-386cc82483ec", "comment": "Malware payload (Mirai)", "value": "c5a3d7184b996e033b6268d38ce3f00ebc97dd6fe18d55b2ad98e9fbb2cf2a9a158d211143aeadd3dd084bb0848e38bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704234, "uuid": "a4a09355-6415-47c2-9fa7-89f4aa07656a", "value": "T119330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704234, "uuid": "3c437c9e-c132-429e-a27c-2896f7209d78", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGW:r/hqaJMDg9eqK806MHdkfQX6HuCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704234, "uuid": "f2b73b74-e382-49f9-8ade-6a4c06af669b", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704234, "uuid": "f67783ac-a398-49f5-b97e-8a43fadc8c88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704234, "uuid": "d3dd351d-5018-4881-971d-3c9151a63354", "value": "8a9fab7929f4b80261d27fcc5a9c28f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd1efaa-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1694675598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675598, "uuid": "446e3b6f-369d-472f-b4f9-1f13454e98c8", "comment": "Malware payload (IcedID)", "value": "d333e5162c0beb9361f650ed35012938", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675598, "uuid": "522c6fca-6f6f-4a12-b068-27dd4355fd62", "comment": "Malware payload (IcedID)", "value": "ae712346e43b8461dc3481b3eaea434da058601c5323a7a6e7982a84bd3405db", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675598, "uuid": "a98c303f-1417-4d69-9a06-425403c766d8", "comment": "Malware payload (IcedID)", "value": "b04fc84de86ec6f25bdbff14d99388afbdbf025a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675598, "uuid": "626b14d1-ad62-49db-801d-cbb6863ee56e", "comment": "Malware payload (IcedID)", "value": "91f005956fddc59d475651109c3058a34c3cfc9ed81f766030968fa986d443d53c57204b641cd48bcbd200b273ea53d6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675598, "uuid": "73a67c20-e89c-4760-a0e9-cab5459d5172", "value": "T19F23EC2AB66C5301065E16FBFD1A114DF300817C11474BE8323EE79E7B2A81B9BA5EF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675598, "uuid": "8cffdae1-55c9-470e-aaf6-662d438668aa", "value": "384:5H2N9chhaV1zrIqQcVRSywlcSAWuiqJ2r6NSVPcFEsPmjcdSClfR5G0rO2dgsfo/:5Hr55uSuNicmssMxrPDe7s+cr0RyM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675598, "uuid": "e50eb7cd-bbd7-4609-a7f1-afcca464286e", "value": 47475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675598, "uuid": "1b5a0061-b04a-4db6-8454-948d48c087dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675598, "uuid": "bf9fa4e4-fde2-4a39-9831-a14afc868710", "value": "Document_09_13_622.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac654a06-5311-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694704586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704586, "uuid": "df54ed0a-6749-4b59-bd47-b0a2b77506ed", "comment": "Malware payload", "value": "570104a6f9f9f137f422927b10dd8d74", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704586, "uuid": "a00753b4-a6c0-4b02-bf83-2cb69af4df63", "comment": "Malware payload", "value": "b01a8a2ca3831ecb3566d8d4a59fb5bab02c274f27021ec8491086e9519b4e85", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704586, "uuid": "014db57c-673b-4a3d-930d-9a692d7aac13", "comment": "Malware payload", "value": "0f82d3747e32e1e6b2b9ddeded2449bf6afc5226", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704586, "uuid": "cf7350ba-a95f-4dd1-be5d-68a586f77900", "comment": "Malware payload", "value": "16b7712aae0bb0a7294a772032f031ba6a3361300a4b1ddb62845cbe095b5d72ddd7144999ccd84cfb7342f08e5e74c3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704586, "uuid": "4b57679b-20a1-44c3-9b91-147726df840a", "value": "T126D423C91C0F73F6FF468842477BEF948A4862E9A6147D28351DDA950CD2AEB7806FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704586, "uuid": "469161c8-aaee-4417-9c6f-9b40e900e6ce", "value": "12288:Qe1nWJcnuwPryOhSDOtEmhpHmx6edCM4KqXBDRIjRd21HicT:Vsw9S69hNlUCMVqRDRWKJicT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704586, "uuid": "265fef60-03a6-4510-88f6-96b67034e781", "value": 627695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704586, "uuid": "1ec35778-a21f-4c39-a1f3-129949499afd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704586, "uuid": "32c84364-fe3d-45c8-a705-83097789678a", "value": "POD7898319919350164813.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c3d601-52b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694662971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694662971, "uuid": "de868a38-43d6-4ebd-bc40-3011ac3e0af5", "comment": "Malware payload (AgentTesla)", "value": "6a3fe6a5155d99530031e9c5cd1f24d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694662971, "uuid": "aac5a065-e9ea-4d1e-8650-7ff4c32fb950", "comment": "Malware payload (AgentTesla)", "value": "b05b1fbd99a50623582c797f7822a94a42251bf066a22417828e3d2a401e9d33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694662971, "uuid": "30ee2503-a737-49cd-8728-a80e94fd5eab", "comment": "Malware payload (AgentTesla)", "value": "f38777561fda06d7d07e0630ad22644ec063012c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694662971, "uuid": "69e4d302-c77b-40e6-af79-5e1a88235938", "comment": "Malware payload (AgentTesla)", "value": "1abf7ab6d79b2a0992aadda7c1aeaa65854a57c338876b0e1da95f7080e99256817bbabd7241d065c8c22fecdcef7c26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694662971, "uuid": "935d95e6-0a4f-46b9-b66c-9554e8da0a98", "value": "T182340E037E48EB11D65C3D3B82EF6C2453F6A0C71673964BAF48AEA529552436C6E33C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694662971, "uuid": "c7c2c478-deac-43ef-8953-cd3827ec4bbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694662971, "uuid": "a058b418-e816-4a4a-bd94-bd5966ba8782", "value": "3072:0S0UbjbtgSiyHE5b7YLTCi2LsWJrvD2CL:0b2aSiyHE5bwmi2sKrvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694662971, "uuid": "b2abc1b5-8113-481b-af83-20a115a0a1a0", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694662971, "uuid": "6d329104-6fab-4d47-8538-93e3ee341bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694662971, "uuid": "9aae9416-e2f1-4680-82d8-de6530f346eb", "value": "decode_d13e01686e7db0655c6a8fbd620354a867bb4974e195568abcb86f02027a615a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d064c57-5314-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694705688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705688, "uuid": "de896798-62f7-4f22-9f52-bf1ffcd785ed", "comment": "Malware payload", "value": "7a6ace94bb9d92d33f2aafdc3799d2ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705688, "uuid": "d15e8d4c-3091-4f29-9223-387e74caa982", "comment": "Malware payload", "value": "b07054c987d03e105bf0c826cd0463a01b6565d8fcf4559e6a360bfca713e683", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705688, "uuid": "52aa0f06-5bfb-4e17-9182-22d06082d513", "comment": "Malware payload", "value": "45d5abb2c85f2e3994870b0b745b11ead13fd85f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705688, "uuid": "cee66bd6-8bc9-4fc8-9185-081f52b4c461", "comment": "Malware payload", "value": "5361b9bab89344a1f532403c2d954aba2a01ccd712039e62a0c6bbee940c0b3657edd376bc4afe27fc9c4b45b476096e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705688, "uuid": "b83e37a9-91eb-49e2-a3ca-f6a15019e7d7", "value": "T1F3742981B3DA4038E072C679CEB18363EA767C155B3096DF07609E6A6E73BE0D531B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705688, "uuid": "7353f012-195e-4f2e-8962-81af628eeb20", "value": "ce0c54abf9cb1706cf3f091f1f306b7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705688, "uuid": "922fec6a-7187-4592-8cdd-7ae4014a4e74", "value": "6144:zFH8RIT6Fam1StJ3rXDW49Vl7SkDHPiaODgKYleQ4SsP:zWdGXDzP7aMEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694705688, "uuid": "499ee22f-e4e6-477c-be84-5a5aba7da745", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694705688, "uuid": "7e25ef13-98e1-4a74-b7b9-cd5422a1f3db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705688, "uuid": "657c45eb-4f8b-4cb2-ae97-f117a7594656", "value": "SecuriteInfo.com.Trojan.DownLoader45.63656.19812.2244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128de8bd-52cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1694675122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675122, "uuid": "3a855e2b-d1af-4fb5-acc4-a0f519177645", "comment": "Malware payload (SnakeKeylogger)", "value": "c4343e7c139374fe53d49c6145e76432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675122, "uuid": "f9b2656f-ea14-4bf8-9d02-e7c31fb6128e", "comment": "Malware payload (SnakeKeylogger)", "value": "b21eec609d669ee05193d8d07beedf3436c8ee340e6fb83ea874340753957feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675122, "uuid": "b4b56bc6-622e-4688-a649-f25bfaa248f3", "comment": "Malware payload (SnakeKeylogger)", "value": "2c5342cdfa072f534532a1906541bd68054a1491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675122, "uuid": "c9b7f160-fa5c-436e-9d62-cd68dd7d263f", "comment": "Malware payload (SnakeKeylogger)", "value": "00584df0151e70d35bcb4341b052e932300662bbad8e12b37763ac7fe201bbc911fcb520396871fe0517fb6ba171cd5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675122, "uuid": "d4f0bdf5-e066-41fb-a703-ed8a439ef508", "value": "T1DAD44B0123F19B10E57EA7F5DA70822287B93956656EF31D9CC168CA1EA1F139BC3B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675122, "uuid": "4cbacd8d-859a-4b08-b642-4f23b3d4fd20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675122, "uuid": "f4c019f2-cd64-429f-8ec2-9b9eea699789", "value": "12288:LODphClGCx5AishS7pZU39TKC4t35dxC:LxU39/4l5dxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675122, "uuid": "70858bc9-9159-44fc-aab2-b77645e37a51", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675122, "uuid": "bd3bf0f3-9b42-474f-a474-4b33a94e6a38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675122, "uuid": "077327ae-d516-4423-8f6e-968f7146ea29", "value": "uhuru.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85ac8d5-5338-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1694721437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721437, "uuid": "a18141e8-3871-4836-8289-7e8f22063c72", "comment": "Malware payload (MarsStealer)", "value": "2324a1a7ee63a70c07e3f3f6dab9b1e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721437, "uuid": "b7bafe5e-fd53-4b16-a449-451e8c32995a", "comment": "Malware payload (MarsStealer)", "value": "b2d364aae7ed6eb3d5072188b308af2750dd8b5cbf45ff324679d3e0def7f33a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721437, "uuid": "a9b9b34f-0c5b-4e0b-8e46-a55ddf1cd96e", "comment": "Malware payload (MarsStealer)", "value": "b89c8ccb86811302b03e170ed26855e553aaebcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721437, "uuid": "f3419279-0040-4121-860f-4b1b4dd8099e", "comment": "Malware payload (MarsStealer)", "value": "0c0be7dc42df1c95ea5b93966f3abed3cec8c3c844b9fc3904ff2cf63bf15b9e31d1a5403339436e233e6e4bf27c608f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721437, "uuid": "8dfafb4f-9e8f-44fd-a3c7-98d32c6f875b", "value": "T197F3E1E73880CA2DC5B8CD3D4E1FBB7A007F7D591A509B5E348E79DA087680D639274A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721437, "uuid": "b784a7cf-6f38-4592-882a-ea769f360bec", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721437, "uuid": "7e9b8fe4-d048-42fb-aa4e-b75c0329ec5b", "value": "3072:3C3AKQzQjr+a9rhN3OLdx+2yxXaHLfBsMCOLC3JSp8Bb8EG:1KQzQ2aZeBX0aHlsMCOej8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694721437, "uuid": "9737d800-4d80-4c9d-9014-1d4c6d764efa", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694721437, "uuid": "da787baf-4b43-43df-a82b-2bf2377574e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721437, "uuid": "186dc329-4be6-4d91-8310-937a433ce372", "value": "hac\u202ez7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb06deca-5310-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694704262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704262, "uuid": "bf7944f9-a1fa-4029-88ae-3522ee94e832", "comment": "Malware payload (Mirai)", "value": "775138e2cd3dbfe9aab4fcc1ef289b72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704262, "uuid": "d10eb62c-df77-4f75-b21f-29c412d1d596", "comment": "Malware payload (Mirai)", "value": "b451b7d8595944a44f1f7f4366600f7adbbf06d049341ce324a16317934b004d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704262, "uuid": "2064971b-b85b-48eb-b80a-d0047b961ae8", "comment": "Malware payload (Mirai)", "value": "12c3756daacd2083f7289cac26ba86e3ee6c47f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704262, "uuid": "f5389c13-c41d-4e89-af66-e81af7997bf5", "comment": "Malware payload (Mirai)", "value": "e266f6d71ca5671d470c9cc9cc141780a695fc95b79e94f227b664fc539d272ef5e4117eee79e02edd96742b018fdbf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704262, "uuid": "e3e651fd-5d47-41c6-b28f-de485e00386e", "value": "T15CA2D025D345AFF4DFEF9D9492C2C2C277EA47C6678AC8E240EEAF013516042B788D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704262, "uuid": "88d22ca0-9644-4f3b-8b91-46b3eaa8f607", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5wM4uVcqgw05VxJg:9RxsSVsMD6xiJJE5zRWNd4uVcqgw09i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704262, "uuid": "6516ee64-c9a4-4f34-8271-712295cab6a1", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704262, "uuid": "a1f6ccda-3239-4c5d-8679-86303fc3fb64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704262, "uuid": "1f13e98f-197f-4338-9ebe-2a542ca8a080", "value": "775138e2cd3dbfe9aab4fcc1ef289b72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fa481e-5311-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Metamorfo)", "timestamp": 1694704434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704434, "uuid": "b20a4e6a-2b24-4b57-89ab-21245bafb1fb", "comment": "Malware payload (Metamorfo)", "value": "8e6e25cbbf57963acef156de546c9749", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704434, "uuid": "1e902d75-7827-4f59-86c5-2aa912f7ab66", "comment": "Malware payload (Metamorfo)", "value": "b71f1fea6b9f9ab46c92fcee5bded4f501130241a271c3b6cde1e6d93497c1b0", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704434, "uuid": "1b18c3a2-97a8-4180-87b5-53552656e4af", "comment": "Malware payload (Metamorfo)", "value": "ea58f3ccd168f34bee59dc27194041351bd1a273", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704434, "uuid": "5063b0a8-18b0-4571-85b9-1f05ab977a45", "comment": "Malware payload (Metamorfo)", "value": "a93f180998e2a7eeced4b14ee518cb33ca5615c8ee3beb9c1a711c04a63a98197d28415f3959febe0e74a66b4fa2a750", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704434, "uuid": "e3c5f167-c779-4dfc-82cd-203020eae42e", "value": "T1B7B4E007B2D5477BE4D70372179B93628F72EC748762812B128A750E2EF1694B7A33E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704434, "uuid": "61e1efb9-5c84-44ca-9e8e-5bc77628f7cc", "value": "12288:hGk8sY5AITqp4nbYrKPzfGXSjptsrYI21wlD:hGk8sY5Azp4bYpXSjp2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704434, "uuid": "4aaff418-c290-445d-9cd7-ddeb33d3e76c", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704434, "uuid": "52197bf4-2c57-42bd-be7b-447f2adeb070", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704434, "uuid": "5c0b0b22-5385-44dd-92b4-0a1af398fe7d", "value": "BOLET0 140923 (1).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fa4f14-5337-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694720979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694720979, "uuid": "7a637dd4-cdc6-4047-88e1-9930e16912e2", "comment": "Malware payload", "value": "6ced2df96e1ef6b35f25ea0f208e5440", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694720979, "uuid": "3135b185-8b25-42eb-ab44-7b094c8bce50", "comment": "Malware payload", "value": "b77f63f14d0b2bde3f4f62f4323aad87194da11d71c117a487e18ff3f2cd468d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694720979, "uuid": "9e2724db-9b1f-4810-90dc-1b8ae7d7c860", "comment": "Malware payload", "value": "17f21ab43d8bc717d31fed20ce551b5dcc70828c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694720979, "uuid": "221bb737-9785-454f-86cd-29f022c0dfac", "comment": "Malware payload", "value": "96d45927e5baeff1948e29bb0b14ba7c4b650c4f3610d37bee8fde350593006a97cce3c1ef0c29c213e8f6e1f60d96f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694720979, "uuid": "38a59d99-0e22-4560-9b8e-b77036b32cc2", "value": "T1CE5733D142F7DCF0B86437D6E8DB87439DC30378A672989A6D66FF425601A1AF42EC42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694720979, "uuid": "9f536e48-c885-486e-8068-a84d0f000f2d", "value": "786432:EMBXuLVd950pUOghHFPxEjIEzUeA8kapGiIPT6FGVzm:lBX6dBOwMkEVkaHILiGVzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694720979, "uuid": "7d1ead0e-1b82-4fe9-9510-d62df0e48946", "value": 27875256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694720979, "uuid": "76a72004-5671-46d2-b8f0-73f456fd3693", "value": "application/vnd.debian.binary-package", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694720979, "uuid": "e4e9a843-7e30-49fd-bef6-b00499023d39", "value": "freedownloadmanager.deb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bd8159-533c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694723151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723151, "uuid": "bc02d187-50f3-48ac-854d-2df985bd1dbc", "comment": "Malware payload", "value": "c1cc3921d57d0685bfb72458730b56b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723151, "uuid": "d9007606-8337-45fe-bbd1-5f1e1557e414", "comment": "Malware payload", "value": "b780b2fb9e38bcc285f93125e548c0e7b896fb20a26400f20293c3c6634ebe2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723151, "uuid": "4355adff-b484-4dd8-9b2b-e6d547ac9e3b", "comment": "Malware payload", "value": "02487f5213ed99d09a5a82dc7015c592b3ee7b4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723151, "uuid": "6b2a4473-9e30-4ddb-bcad-f475c93e0276", "comment": "Malware payload", "value": "15645da5a8b1c19a1ab692c1b8bc874e464ed7ccf45ab100b434a7bd1c9ac5d896f8832e40712fc3ca205512f9a0b11d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723151, "uuid": "18081ab3-2122-4e43-8681-12b44a6e2620", "value": "T16CC4BE9C369176EFC957C972CEA91C64EA60B477530BC207A41322ADAA0DAD7CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723151, "uuid": "c452423e-82b3-4f81-84ed-0d5459ba4c48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723151, "uuid": "bd08ed44-a4d5-431d-b45b-76a66d192737", "value": "12288:B0zBZUZ6j8mFxthf+32A/lP7AQw8Uolp0GDuA6X7iqdtloA+s8:B0FZUExthW32ElP7ARQlXDuA6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694723151, "uuid": "529d92cb-5e8e-4edf-a1b2-d937db513860", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694723151, "uuid": "e115cc80-059b-4e02-bee3-527701c34667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723151, "uuid": "7d9a2463-35d0-48dc-bf59-6858751a1347", "value": "Purchase order B086651.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b95845-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694675668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675668, "uuid": "3f0f1497-729e-47f6-b418-9426107b5049", "comment": "Malware payload (Formbook)", "value": "7581c03582cb6d3bb72e1e11af6bd9b0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675668, "uuid": "6c203bc9-5593-4113-9ae6-af60abc14c92", "comment": "Malware payload (Formbook)", "value": "b799c685d108001c9d05b2faf48f4a1c0832067c7925c5f90258d224425e2faf", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675668, "uuid": "87e4e084-354b-48b8-b142-fd8ff35062db", "comment": "Malware payload (Formbook)", "value": "c2682c9660609d8ba714ca96f3b87f282e7b0a6b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675668, "uuid": "dcf036bf-55c0-4090-8a71-607aa32877fa", "comment": "Malware payload (Formbook)", "value": "4b6397ee5bf258ff5579c2e1041feee7f709e9bce81bc67782ac0bc454d568d30dcc6dcdf543eaa8a5414ea16d3d1950", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675668, "uuid": "dd3868cc-bd95-4bde-a064-a3130758b4c3", "value": "T16CD4CDF924A4D3D6E37A63FF455380348A23BE555075C38E3BBD34980DA6B830A21DB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675668, "uuid": "3e416ecd-5347-43ef-a306-5b8104a1cd7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675668, "uuid": "5c7dfed1-4fb2-42ed-9532-512927e86358", "value": "12288:5q8RG2iNacQwE26NDsh/u42v9U6dyixTRlvMlTpMSHADuv2rxv+xspHzr1+z:5qqG1N6xsBmqUEZg6vm+xuH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675668, "uuid": "dca6080d-be24-4e23-a5c8-407feb448a49", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675668, "uuid": "42ac3587-5a79-4f57-b662-a134db850658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675668, "uuid": "46d02857-a7a4-48c5-8404-76d8d51c0a54", "value": "DHL Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452e2cec-531e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694709996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694709996, "uuid": "c1a5a2f9-cf08-4879-9152-ab7c76bb60c2", "comment": "Malware payload (RedLineStealer)", "value": "fbb26a6408f818a7163f801136064ac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694709996, "uuid": "2315e6ce-ce3f-4d66-866f-11c9097fd26e", "comment": "Malware payload (RedLineStealer)", "value": "b7c5d625ee15f20255a9989081cb9297f429df6f0eaaeaa1e4abbfd4a146e698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694709996, "uuid": "1b009132-ff93-4a20-8a35-3c235563051a", "comment": "Malware payload (RedLineStealer)", "value": "02b10b7ce098d663471883c19e5788205d4e7165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694709996, "uuid": "465db8f3-20fd-4e42-b458-5a0d6cfd04d3", "comment": "Malware payload (RedLineStealer)", "value": "7886dd074c732a519992cfb751a59c24a3a4c4e02b745af4eab65cb22d78e2bc14ab932795e93b240c01cc92350beadc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694709996, "uuid": "9cb94e6e-40a2-4a0f-b688-f76b6fa83fc4", "value": "T15A16381136F95B59F6F35BB85ABAA611487EFC69CF11C2DF3250908E0921BD08970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694709996, "uuid": "a843aef2-99a5-4f58-afda-8a4f3fb1e9df", "value": "62020f417898af4db9f3ac5ebd561fe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694709996, "uuid": "0b2fad96-0d3a-48bb-be1b-97ec869cd68d", "value": "49152:Nj9vsQP3xD2cr6a3vrk3RpxWAlebVAhovFmBV4LJ9/XTZ1Ll5d:Nj9vicusiiVAhsoYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694709996, "uuid": "65fd644e-c755-42a1-9606-181fe2e7ece8", "value": 4085760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694709996, "uuid": "9e3bd32a-51f0-4b0d-8994-368a5d8661b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694709996, "uuid": "5ae359ae-7350-4171-855e-d3932caff7d8", "value": "no230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1599e282-52cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694675127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675127, "uuid": "f44339a3-e57d-432b-a2aa-6ebd660c13e8", "comment": "Malware payload", "value": "d76c8672638bc36617dfa2a84ee47e1a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675127, "uuid": "b2aa2c8c-7d35-4606-9ab6-045cf0f0003f", "comment": "Malware payload", "value": "b837356985ee9e1513bc8f6e05a0678df466a725d5b10ee593ee2b5d90897438", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675127, "uuid": "58e30500-b6a8-40d9-bf9a-400a3cccb269", "comment": "Malware payload", "value": "b32b3c50b37d764fc0c74da31f7f7cb60b715ebd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675127, "uuid": "d5529137-9126-41a8-803f-f267abef030a", "comment": "Malware payload", "value": "88a244c3d6f870c191ca193c7ad7bad2c0c91da3201c1fce4ab64fc3dab94e59cee46201e2fefe1eb9564a21cb8a25b1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675127, "uuid": "8b59ee8b-efaf-4de5-bafe-af209d4bd2a8", "value": "T179732468D38F01A9CF62527B9B570A4841FCBB3EF24541A5306C437933EED2DA22667D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675127, "uuid": "53a248ff-94f7-4854-ae03-d31cd932ecc3", "value": "1536:ywAlREux2NLkCuRzXnBA6D0GetP4AyAMq:ywAlaLBuRLKI0GetP4AEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675127, "uuid": "33222542-471a-484f-b4be-a2a7f4212c67", "value": 75050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675127, "uuid": "f828171a-95eb-4574-8493-a9b0e1575438", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675127, "uuid": "7b737479-4595-4f87-bc3a-ac3526f757f5", "value": "UNDELIVERED MAILS.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4258f9-5302-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694697934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697934, "uuid": "f6252a36-cb32-4505-9dde-38b5034d0411", "comment": "Malware payload", "value": "17d3cc33a125d39097b58d5f653407d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697934, "uuid": "2cb7f54f-3ed6-417e-aec8-079ac79cb1df", "comment": "Malware payload", "value": "bb99d82c785b174928e89e5895121c562b14888d03ca61ff93c0050af87b07fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697934, "uuid": "480046a9-e778-4907-80b3-2dd027205310", "comment": "Malware payload", "value": "818948f6b9eb98be0e0776593737b58ad6b2754e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694697934, "uuid": "1002adb4-13dc-4748-832c-9d903dbcbfa1", "comment": "Malware payload", "value": "2d9db7df9730a206a6ef053135514d46e67e1b4ae8d1cb624dc7eba3949e4d651280a85afcd9df09c283331cc94a6ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697934, "uuid": "025c52f1-288e-4b2b-b2f0-48d1ec361f06", "value": "T1171633700FDBE890F68F05B50290A8BDA1E31DD1067483136D98B6BBD68BB5D42D3BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697934, "uuid": "c5fa1af9-db1a-4614-87f5-54607bc3c420", "value": "98304:5F4uPbhDU4Wdtqd6jDJAwwvx9CESoN0SwXOc3VpdilL:TT24ZgjFTwvnSRSWO2fiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694697934, "uuid": "d599b1d3-001b-4a09-b9c9-3e8b8350c23e", "value": 4040776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694697934, "uuid": "a3f5a336-2b20-4387-9315-40f49f0fd5e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694697934, "uuid": "d995cc49-dc25-4e67-8d04-e94324a02798", "value": "LiveChat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40380e3b-5330-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694717719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694717719, "uuid": "05b735c4-a3e6-45f7-bf35-eff643beeb5a", "comment": "Malware payload (RedLineStealer)", "value": "84e6bf53b4db6f7631cb061ad199eece", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694717719, "uuid": "e188b083-2bbd-4ab3-a878-934510c5f982", "comment": "Malware payload (RedLineStealer)", "value": "bbac59c3c6a41bfc78a1c6704908d45b0be839280cb7ad41047f870eb298d785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694717719, "uuid": "a92271a5-c314-4ca6-9c06-c9c02de26fed", "comment": "Malware payload (RedLineStealer)", "value": "3e2825b03e6c4ea42389b0bab5464bdc03f13418", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694717719, "uuid": "9e535a65-9816-4b88-bffa-582b935ca56a", "comment": "Malware payload (RedLineStealer)", "value": "15407c1252cc1aa9a369fe97e25c86f14412c660bd6a05d2ddb677a712792f329643865d10403474bd04de7196a86fa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694717719, "uuid": "a30557b8-1a8e-47aa-bb90-b41dd2b69fe9", "value": "T109952D117EF94B99F6F30FB85ABAA615087ABC698F11C2DF1251508E0D21BD09970F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694717719, "uuid": "61a9e47a-3748-46e6-bca5-6e3603218dd5", "value": "62020f417898af4db9f3ac5ebd561fe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694717719, "uuid": "87c8d1ef-9019-41e5-9c3f-1a134036358d", "value": "24576:BMDy1dDU7mUfrIcF50ZfkC3YULLVHY6a9DhvhHc7sL:Z1GfrIcF50+UO6a3vaQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694717719, "uuid": "ef4aa871-48e5-48e8-bcf7-8c680d52c148", "value": 1912640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694717719, "uuid": "67e7db7d-89e0-4fc9-91b1-751ead259855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694717719, "uuid": "aaaf876f-4106-4590-8044-ed1d72364366", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ae2f0c-533d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694723533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723533, "uuid": "25309b29-732a-4f17-897a-e1cdfc526d0a", "comment": "Malware payload", "value": "ec333982af0977d8af5a4984792a4385", "object_relation": "md5", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723533, "uuid": "961aa4c6-a348-408e-8f0c-1fccfab489bd", "comment": "Malware payload", "value": "bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74", "object_relation": "sha256", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723533, "uuid": "f4ded9c2-b207-490c-a8ae-d3f23cfe13ab", "comment": "Malware payload", "value": "d5b7e49c6476766d45a18cdd150d0679a9529a5a", "object_relation": "sha1", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694723533, "uuid": "5cdc5908-9967-43f6-ac30-bd0eef57181b", "comment": "Malware payload", "value": "35ea3f0f7b944cdd73b15118a928b5093a2a2b21d0d7d8b9f99a882baf69f67eaada798b7f3b84b0c1e34f94b885c932", "object_relation": "sha3-384", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723533, "uuid": "6f49fc43-1619-4d4a-923a-c2d408b903f1", "value": "T131A696242DFB101EB3B3AE5C5BD8B9AE9A6EF773270A64B9107103864713941DDC2739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723533, "uuid": "741e7384-f76d-4490-9d76-213353484757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723533, "uuid": "3bbe5b0f-4666-4c2b-9824-77be6aa82f1f", "value": "49152:LLLjKXCrX+hMesdq40bf95X9K5NRcSJDg/u/fiGhG6E7/6bp1pBt0zKkevwN/+jA:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694723533, "uuid": "b3aee1ff-3f6d-4837-8cd2-e31581216bf6", "value": 10041344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694723533, "uuid": "c015fdf2-80f0-4d76-a3b5-4ba3fd262401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694723533, "uuid": "b23b50d8-43ff-4760-b7e2-e72c9a32f7b7", "value": "AYReport_EN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8f82c0-5350-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694731729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694731729, "uuid": "6afc51eb-1e80-494b-8129-d5ac7a8471e3", "comment": "Malware payload", "value": "8b8d7db29e70be64c18a1cc8d02da680", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694731729, "uuid": "8051af73-052a-4b89-94d2-c44dfbd7f09b", "comment": "Malware payload", "value": "be6716415c8f117ac0d290833825ac7ddab7f18666cd6e68218db31f3da357c2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694731729, "uuid": "a9eb29b3-5768-4f15-9b83-4f5fad52cd4d", "comment": "Malware payload", "value": "7211bd56ac1466abc6a6202b800156c38e111c9d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694731729, "uuid": "f5444752-323d-4889-ac1b-f9c8335ad280", "comment": "Malware payload", "value": "761442b3761c8a7308578729110fad130cef781d63eda31f32e25ad1cab11ebe5eb4d7ee516c655f660277a8dbe50223", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694731729, "uuid": "26c0b92c-3458-44cc-98f1-35367f8f9ea4", "value": "T11ED52353F261752BD831C1332545233E52169D288A06F78A37597BFA78BBEE84BC1BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694731729, "uuid": "4e7eed4b-33df-4214-b833-070e2e2ea811", "value": "49152:Ddt/H72XiLaqL6UGM5QS6D/pK/nGx5gmoq1gPXK/5Yv7xqiS92PbvuMVI:D7vCiLaIduZ/p2q1gPXKBwO2aMVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694731729, "uuid": "707f42b0-3a1c-4cc5-8630-4274d2f882b7", "value": 2960798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694731729, "uuid": "ce4ce9ce-4f70-4461-81cb-6c67b72621c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694731729, "uuid": "8e54db71-c03a-47bf-b396-99264baf6910", "value": "game.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f82603a-52cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1694674876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674876, "uuid": "21811150-b8bb-4690-97ea-102f9000862e", "comment": "Malware payload (DarkGate)", "value": "40804163b8e3cb4cfb6dc6984a1e228f", "object_relation": "md5", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674876, "uuid": "8670637d-9765-4617-992b-119094a938a8", "comment": "Malware payload (DarkGate)", "value": "be69add1213202bc7a038a2cfb2cf8ece07eeaaf163c2e17873c54d303e3abfa", "object_relation": "sha256", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674876, "uuid": "8ddc6d3d-e100-4df9-8b17-83265df850f1", "comment": "Malware payload (DarkGate)", "value": "41f971c1cbb03545225fa7816708bfb322fbba95", "object_relation": "sha1", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674876, "uuid": "d9b9c7ac-f6b0-43bf-8a0d-27c8ef8ff077", "comment": "Malware payload (DarkGate)", "value": "7992c605171f8d30841b6a6bd0f66149f7ab79d3075e65d4a40d05fe712590ab105aced1a45adc820ee36a750f9bd543", "object_relation": "sha3-384", "Tag": [ { "name": "178.236.247.102", "colour": "#B0FD64", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674876, "uuid": "6962d8ce-53f5-441e-9079-a4c27283f1cd", "value": "T1B7B523513BD9C63ADADE0736847A87253236BD601F30E0CFAA95396D47337E26938352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674876, "uuid": "60a7c915-5d5e-4199-9615-b3ad4ea28d8e", "value": "49152:hpUPh/aSZVfoL5/esFPZPEN5YYCusbwy19m3zca16l+:hpg/NHAosF6N5YYubNjCM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694674876, "uuid": "f43cfdd6-c9eb-4d01-ad57-8549f40e1000", "value": 2342912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694674876, "uuid": "1433aeba-10b4-4e89-a85b-3e3b7bf5b170", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674876, "uuid": "6d3d075b-54bb-4cec-82e7-9feccdd77381", "value": "p_terminal_x86_install.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c5f78f-52d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694679604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694679604, "uuid": "5ac89f25-c47b-4adb-a2c3-91265deaf3f5", "comment": "Malware payload (RedLineStealer)", "value": "a1a1b7f76fbee4d3517306259118faee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694679604, "uuid": "cd60945c-9654-4e0f-b16c-6abbf6b73880", "comment": "Malware payload (RedLineStealer)", "value": "be758d2b22cbf30dc03aac1bd99508099107aec8c697a533ecbcb2c43b4a7aec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694679604, "uuid": "fb0a3272-299c-476b-833f-724646422b0a", "comment": "Malware payload (RedLineStealer)", "value": "192c8ab0005aa0ac838c5f626b9eb576fc7bf66d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694679604, "uuid": "a9d99140-dcd2-4286-94e2-93b79e6374b4", "comment": "Malware payload (RedLineStealer)", "value": "57cb038cc608dccc48488e10ba124b6c6284d9152f3be7a60d83f0f2c66cd811102d3b5036a8ba74ad84c116c6ca5d9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694679604, "uuid": "04e12703-9d6c-41cb-bdd2-f56dc2d9d877", "value": "T1CB14CF1139E0D072D5A741359838F6F42A7BBC2396A5864B37643F7F3E316D2A7A6302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694679604, "uuid": "316d4dac-a570-47f6-89d9-4ea210e729b3", "value": "ef163fd1a1dfd01940ab083fe4660afa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694679604, "uuid": "8baa00f3-c3f9-43db-a484-e171b1192ccb", "value": "3072:IThu5LNO7JCdM+yueDmqIPtSEbMm9UEJ/W46au4opmgo56andwT3d4P:8u5LNwgeUeDmVMmfu4/u5mWmdwTt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694679604, "uuid": "fea1a66b-3c23-473b-9d35-87aaa1b138d4", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694679604, "uuid": "054a76b4-533d-49e4-b232-5fa12c10f7fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694679604, "uuid": "164ff550-6bfc-4187-bd9e-e8e71cd87212", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311019e9-52f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1694693212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693212, "uuid": "edc0f480-0405-428d-ba93-d708ef338e9a", "comment": "Malware payload (DCRat)", "value": "7eec2626da27debbdef59bcb7427f8a4", "object_relation": "md5", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693212, "uuid": "728d4e7f-4e82-4180-a7b4-1c5f0f6e5ed8", "comment": "Malware payload (DCRat)", "value": "bf1a2173cdf3a47abd060cbd86fc8c3cda7d01443694d7253bbd547f7feb21f4", "object_relation": "sha256", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693212, "uuid": "c18a5ab8-0b83-46cb-8d86-0e60001b555c", "comment": "Malware payload (DCRat)", "value": "c8d29e22c4e501919a69581466e504dc5b8059ed", "object_relation": "sha1", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693212, "uuid": "e5f2eb73-bb23-4ff2-8868-cbcfbd8155c9", "comment": "Malware payload (DCRat)", "value": "ce37cc56d9d8e14c5584826e63666a9584157ef219c845abc24b57a5cc31774b750ea9e713bff377b6458d156a61562c", "object_relation": "sha3-384", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693212, "uuid": "82e40f9a-38f5-4e08-9cc2-624d82a6b2f8", "value": "T11F4512027AC190B2D4621C365A7AAB21B83DBD601FB5CEDFA3D03A5DDA215C0DB35763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693212, "uuid": "ac438575-211c-43f2-ad3e-0d20fb3e3163", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693212, "uuid": "d143257f-6da5-40d0-918b-332cf3f719fe", "value": "24576:2TbBv5rUyXV97n8uVaSXCSp0ZrNAIdiaiH7oAaY/ohijfeSlRLnuBwD:IBJ9j/VaSySuPZdiZHkPYJfnuBwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694693212, "uuid": "975e0809-4c65-46aa-a7be-dfcbe9ea2020", "value": 1237485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694693212, "uuid": "230ab623-c7d4-4752-b0ba-f2de5cf1f061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693212, "uuid": "1b964117-49c3-4c33-908a-e2bfee3eaa28", "value": "r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dd25eb-52cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694676228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676228, "uuid": "33be72ef-456c-4916-888e-1d9a0338f042", "comment": "Malware payload (GuLoader)", "value": "1e34fe205bc13fd09224cd0a5c63c79c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676228, "uuid": "76c66fdd-80fa-437e-bca4-f7b9c9a55e3d", "comment": "Malware payload (GuLoader)", "value": "bf7c2f5862b2257a18f9ca23100642b969a1bd923017ad56d13930efa764bd63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676228, "uuid": "2da6a3d4-ccfb-435a-b6da-140dd7c7c325", "comment": "Malware payload (GuLoader)", "value": "e606c08fa14daf87d4069253c812949096b910b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676228, "uuid": "6339ee98-5fad-4793-8eda-805d0a7b4182", "comment": "Malware payload (GuLoader)", "value": "944543ef8ebf12407f8235cc1cd32b00ea57e4061ce05090bc5d71c5d03964cf22d9189fed9a6790fb2b912a5a5b11ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676228, "uuid": "4b4e823b-ba6a-471d-8d20-233b783a3d3f", "value": "T149B4F112B518E057CED50DB55F33A8826AEC9C214895506F7AC2BBAE503363342FFE5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676228, "uuid": "045ddcc0-1a29-4746-ab60-4ede62abb8b6", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676228, "uuid": "c5936887-2491-4891-a6b8-2f60e1d0fdc5", "value": "12288:yKDaBV1+nmvHvJxcZskIKrmDW8sPrKEnmhJA5:yKaBaFqhKK61rKkmg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694676228, "uuid": "cc661279-d314-412f-bbfb-cd52e8b2fb63", "value": 535096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694676228, "uuid": "bcad32e3-ac6f-468b-80d7-b8b017cf1f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676228, "uuid": "c11f5530-5ca7-49cd-bb89-979d954b1b5b", "value": "DHL-ebilling-Inv-MIL0003135277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40dcc7fd-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694675630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675630, "uuid": "a5818a12-f081-4b4c-8b50-68004a1b8d91", "comment": "Malware payload", "value": "445e26de10c4fe1ba0942e92c59e322a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675630, "uuid": "92a3d774-3644-4c5f-af10-e399ce1021be", "comment": "Malware payload", "value": "c1a76a1c254ffe0df1386cd15ea965908d08375ba156835089d41abdeb15b444", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675630, "uuid": "57f0b4fb-3a40-432d-ac96-c0a149e8a497", "comment": "Malware payload", "value": "4e6fd1dfcd539561c78a86c1f2daa7e993b6a3e4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675630, "uuid": "8b36ce02-2405-48f9-93ed-2660fd7bf42e", "comment": "Malware payload", "value": "f4578c9d0cf0efc8a4a5faf2512bda72ae85b2310e5a5fa2f79ec901ef55376cb009d2ff9d338912994089e86602e812", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675630, "uuid": "05711860-db4c-48db-841b-a3e3403511f3", "value": "T12CA4E41038DEB14CB1B22FA757DD72EA8FAEB7761B26506E6100074B4B52E41CF60B76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675630, "uuid": "c7769968-29b1-4b6f-af30-7c04aa2e8236", "value": "12288:BijoooojijoooojijoooojijooooDijoooojijoooojijoooojijoooojijoooot:0jooooGjooooGjooooGjoooomjooooGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675630, "uuid": "37b4c8fb-d168-4997-ab74-68198fcf8852", "value": 481766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675630, "uuid": "25200e88-51e3-49c1-9e33-0568249af432", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675630, "uuid": "26a5c29d-822f-4088-a227-c5e23a97793b", "value": "order No. O230009.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170e895c-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694675559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675559, "uuid": "20281806-f886-41c4-8fd8-776cf301d422", "comment": "Malware payload", "value": "842df48f4ade3f812d56bd625f1be2f3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675559, "uuid": "d1dd7caf-dd8a-4e3a-9fbc-6445ccd43cad", "comment": "Malware payload", "value": "c275ec1fc9df8483af77b76148190e199aa96df42a837b4a06847389073ac438", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675559, "uuid": "6e795399-942b-46a6-8b33-1b5368333d2c", "comment": "Malware payload", "value": "afe1f5adba35164fdc392c2a379af87b13337690", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675559, "uuid": "5ba35e76-bae8-439f-8f57-0a6be6ae9dba", "comment": "Malware payload", "value": "1aa2d3bf2d446152185ee00875e6b25fb1e97d08bdde5a5d76af52e3fa2eb19dfdf1aafc16f63aaed4cfc4c64749551f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675559, "uuid": "17e8a9b8-dd62-4387-904d-cf960facdd54", "value": "T142A435103ADB7048B1B72F676BDD79E98F6FB6A15B2A919F2044070B4613D00CE92F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675559, "uuid": "981dea79-a56d-4927-afd9-13ba5ee77edf", "value": "3072:Ohhh43ATnhhhhhhhhw3IEJGTslVWpwWZR7m6IhhhhhhhhhhhhhhhhhhhhhhhhhhA:bIEJGTslVWpwWZR77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675559, "uuid": "189d1841-895c-4a75-8b85-5df51fd9ef52", "value": 481768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675559, "uuid": "089ed0aa-c9a7-4645-9ca8-feb3de70d195", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675559, "uuid": "088e3158-bd85-4741-807f-8c239f2c040e", "value": "PO No. 0914.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5a95ac-5324-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694712616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712616, "uuid": "92ec4ff4-5ce1-4424-9c12-9f401ab1c5ce", "comment": "Malware payload (Mirai)", "value": "92dba77ceeca2983731881c1b43b6c38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712616, "uuid": "7a4a0914-ff3d-4c25-9ce2-f6b219a342e8", "comment": "Malware payload (Mirai)", "value": "c2b63f8857adaad21ad6a50819b4f664475334303948817c2e70f869387cd5fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712616, "uuid": "28429450-bdce-46ed-ace4-388c7eabc52d", "comment": "Malware payload (Mirai)", "value": "9b7ccd2c107c02eaa0b1b49b8b2aa89f67904c9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712616, "uuid": "3449d962-484e-48bb-9867-cca42581d91f", "comment": "Malware payload (Mirai)", "value": "de3f81f5f3d80bc7d461a702cdc9cba548bbb5fa6fda7ed1aa732d19dca63e876d59064bafe8f4e347a9ce8cf310f03b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712616, "uuid": "54412df6-00e0-46f0-931d-998c99025375", "value": "T1E7336B36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712616, "uuid": "def7a68d-bec8-4b5f-9646-2606f5ac999a", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694712616, "uuid": "7c543380-c1f3-45ee-b447-7da8800f5f5a", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694712616, "uuid": "ddd9b042-5693-4e4e-95cf-e4bc2a4979f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712616, "uuid": "5593778e-ca87-4e15-9453-c24968dbe09d", "value": "92dba77ceeca2983731881c1b43b6c38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e75814-5332-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694718638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718638, "uuid": "c45ecaaf-8003-430f-bd44-bf257933ba74", "comment": "Malware payload", "value": "015498cb37bf07df1a1d3c88019fefd5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718638, "uuid": "824d9eb2-d3ff-42d9-a85f-02f73a1500a0", "comment": "Malware payload", "value": "c2d92fd838d1faa6d711feb7bb1a143df5b3450899b2736f4ce2d0471ae178c2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718638, "uuid": "170447de-d8d7-4049-a41b-8357ec784c8e", "comment": "Malware payload", "value": "f85764ca7b82b9421623989c33d5668888efd6d7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718638, "uuid": "276fd783-9ab2-44e2-af6d-9f477ebb2589", "comment": "Malware payload", "value": "92eb49b9af38679938e565bef793ab44410df62a3009b55509d43d53659a0967e2ce641ced1e9bcf3bc0be62766019d5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718638, "uuid": "8dffa642-9300-490d-b753-3f8a2e0cc2e8", "value": "T101138312B7D6AF26E12326B499F3C295B329BD099FB6871F2198371FBC720701D42725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718638, "uuid": "9a4addb7-19f6-4c3d-880f-75ae81687e4f", "value": "384:+aar6bM+jDT6OJ0Bxi7hCQXj9UlZW6NSwYfOPSmRqiOe6giSwvxjk+tC/oz:+aar0G4j9UY34SHBeOxw+tC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694718638, "uuid": "d64fb1ea-ed15-49e9-9e50-ca6b443148c2", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694718638, "uuid": "4757e450-cad4-4068-a8eb-eb4c7940d579", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718638, "uuid": "7d18da90-2867-46eb-bde1-22132f1c9ef1", "value": "VALLEY BLDG IND INC. CA. 2 .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc1b69a-52a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694658765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658765, "uuid": "22d0a06a-01e5-4913-83d5-fe9dd41dff82", "comment": "Malware payload (Stealc)", "value": "08f32f388b42aab675eea1bf2d60d770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658765, "uuid": "ef9a4f83-0774-424a-bfd3-f1861b1efe61", "comment": "Malware payload (Stealc)", "value": "c55c92457d03edbc7ec6f2c1ed55ca5e79d66d5ee568beab370229cd278649b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658765, "uuid": "61e18b0d-8bd1-475f-a126-1653856e8c0f", "comment": "Malware payload (Stealc)", "value": "e53e062934952fa51c68a9400afa631880ccebe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658765, "uuid": "1ce9c2a9-1847-4323-b451-d29871a41449", "comment": "Malware payload (Stealc)", "value": "aa82f47ad754d57449af0c0486042d9e166bb9d8f183749304ece13c430f421f5e45713beaa23d22905fb19b4499ccc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658765, "uuid": "d8cf585d-26be-4886-8c8a-d392ef86c972", "value": "T170644B03BF907D60E5264A768E1EC6F8F75DFA51CE59B7662218FA2F08F01B1C162B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658765, "uuid": "b2e8ac09-b1a8-4c5e-9f30-0f5503ae43ec", "value": "3c565fbe4eaafad8572e17176ac3eb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658765, "uuid": "8bed06cb-22f8-4243-bcd4-1d67bac7cba6", "value": "3072:W2CP+T3inIYGANRRZgJw8KmC1qr1NFCAoJGwMjLAAJgR3:GPKinIYXNRQ685RxIeJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694658765, "uuid": "3d08324c-ed51-42be-b8a4-bcf21656b6d7", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694658765, "uuid": "2ed51a6d-7fea-4e24-a1a4-22852e7ccf64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658765, "uuid": "990a9ee0-15bf-4f0f-994e-c23526912917", "value": "SecuriteInfo.com.W32.Kryptik.KMY.gen.Eldorado.15993.13303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ecdbc6-5324-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BitRAT)", "timestamp": 1694712754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712754, "uuid": "e998d22d-5132-4e76-9883-c8702dc19be9", "comment": "Malware payload (BitRAT)", "value": "6d4c3a4ff3637ec34f820172f897d476", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712754, "uuid": "9fbc1f36-8e4a-4d83-8d7a-118686e5b7e7", "comment": "Malware payload (BitRAT)", "value": "c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712754, "uuid": "fdb35100-ea68-4ce3-89f3-472fe76e4d62", "comment": "Malware payload (BitRAT)", "value": "d53fe8f0ecb0536088ec9be5247ab6627baf31cb", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712754, "uuid": "c15de7fe-c0f3-4801-a3a3-db892dcccc96", "comment": "Malware payload (BitRAT)", "value": "02a65ef6af1425736f2194deb64319314d19b3db03512fce3b9240346b8457cae48c2db12409dab71161f075fd9840ee", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712754, "uuid": "0904c560-1f70-4266-a8ba-6b357b3669b8", "value": "T18006330B27C9CE57C7BAA9B8D0E304F497399C22E50BE373A9593E2624393D9417C617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712754, "uuid": "aa8addf8-305f-49a5-a565-18e89b41df03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712754, "uuid": "fb75c4af-00ef-416b-aac5-ad4a300903d2", "value": "98304:HjHNSk7Z95fznvi8pzJzTGVDr0io7x9JgDQssR:DtSk7hvi8pzkVnYwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694712754, "uuid": "11f198fa-f18b-4e86-b166-ca2a2e6bd605", "value": 4008960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694712754, "uuid": "5983e99b-7b17-4513-91ae-7bde620c6a4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712754, "uuid": "12ce54c8-81a0-43f9-a6ac-f851356a73be", "value": "SecuriteInfo.com.Trojan.Inject4.61046.4045.23459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac12c75-52b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694666278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666278, "uuid": "f5424e0d-1c41-462e-81ad-92ef342811db", "comment": "Malware payload (Stealc)", "value": "1ce6a41fa5e32b2cc959e8a4cc7df1b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666278, "uuid": "5e9eb5ed-743b-499f-b9e4-b0554478002d", "comment": "Malware payload (Stealc)", "value": "c6353b3ca2cf558686e949882e30f91bf16c0b6bf845bdcb470d46293aeef0a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666278, "uuid": "21fc492a-5d4c-4b6c-8cc0-db6fe2ea6abf", "comment": "Malware payload (Stealc)", "value": "1090c1cb01f03a80ae11e62695ab231839e0c73c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666278, "uuid": "6f7c8909-6cdb-4f16-be38-034500fb6fba", "comment": "Malware payload (Stealc)", "value": "7954e60d13064a6cd149731a21d1efb415e4d9c9fd94a4ccfde23c8403bda1496652452ea7e941ffc3b91808997473cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666278, "uuid": "216cabf6-a6e1-4902-b575-5ac5c644947f", "value": "T155545C03AFD07DA1D5258A728E1EC6E83B9DFB61CE5C37562218EE2F08B11B1C566F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666278, "uuid": "dd007bb9-135c-4595-9453-13fcf7361f8d", "value": "3c565fbe4eaafad8572e17176ac3eb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666278, "uuid": "d4d5faf2-6ab6-4906-8137-8b59843eb6b3", "value": "3072:e23nd/viEZfO4kwQZgPV8jjnpX853Xljr470p0ctJTsrqINXsFoqJ3:rnxiEZfbkwlPmjnpXS31jrz0xu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694666278, "uuid": "6a358b30-f1a2-4563-b5c8-ed986b203f9d", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694666278, "uuid": "76a46396-b0f2-420b-97b6-8873a09d9f34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666278, "uuid": "ef93c708-5fc4-431f-9cb4-c1c0abc4f7c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409960bb-5314-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694705694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705694, "uuid": "a22c58bd-1169-4091-9a72-0435995e4324", "comment": "Malware payload (AgentTesla)", "value": "f346055b78768426e02af1a9f966c65a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705694, "uuid": "35bfc95f-e0cc-4ef0-b341-c3af77980016", "comment": "Malware payload (AgentTesla)", "value": "c66d4b72b5c5e730f5ad11169a86e3b51f4e7d7b4a83c5041a0bf41218870eca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705694, "uuid": "d194607d-87d0-40a8-a5b9-bc2a853e4a16", "comment": "Malware payload (AgentTesla)", "value": "900f6ea77cf3c006e88bf94813b55cca798ff384", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705694, "uuid": "f41a61db-e64c-44d8-8650-67b18f40f26b", "comment": "Malware payload (AgentTesla)", "value": "00825956aec5ccf916eb3bf775aee44176faef9046040a476eb5b9d6d8e3f6b09a21a734b6b25b0cadb03085f59e6cbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705694, "uuid": "9086eb08-19a6-430b-9b43-ceb7f08ed43c", "value": "T16BD4230276A4EB16E9FB07FAC532A104D330FD6AA894DB1C4EC170DE9772F6245A4B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705694, "uuid": "2287508d-75e4-4471-9bf1-9b54e0ce4e31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705694, "uuid": "72b542e9-c002-432f-9f2b-d93720d6d0eb", "value": "12288:7vfj8FwLm/be56519bMHCB35UgIBr5vyjUPKinI012NK7lckJnjyrHAL+cmA7trR:7Hj8F6LpCB3egqrpFPKin7Y4Bp1jyZSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694705694, "uuid": "741faa51-78a2-4d66-bf8b-80ee95fc78a2", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694705694, "uuid": "2ef8b5f6-8b05-499b-9042-7e969d2947a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705694, "uuid": "d7f8f323-0b10-44eb-a9a1-82b8a7ee1a7c", "value": "SecuriteInfo.com.Win32.CrypterX-gen.29270.21330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc62770-5292-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694650041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650041, "uuid": "8d5d2f43-9384-457c-9e49-be6ed4505110", "comment": "Malware payload (Mirai)", "value": "ffb8ae809348ede72fd875c4048b587c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650041, "uuid": "446c2ff0-e336-4194-b010-e4a2f043207c", "comment": "Malware payload (Mirai)", "value": "c671df846c2c036bd8cb82fb2c094359aa7f5078be744f6515fabe4331c0e7f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650041, "uuid": "5c9ab653-ad6a-42df-9ee6-c63c5212e682", "comment": "Malware payload (Mirai)", "value": "dc9a21d0d29f08c9d79401e232049596416aa53e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650041, "uuid": "cb1e437e-8ff5-43af-a67d-ef47b49249bc", "comment": "Malware payload (Mirai)", "value": "5387f518c2d3c375e6f8765f6029844db1b423f54a715f8f2dee423b068a44513adc5fcf0fb5756b1a4904896a3a9def", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650041, "uuid": "04938305-c0c6-40bc-8fdd-b2465d6b7690", "value": "T13F734B0271280B47E5930AB42D2F1BE05BFEEDD035E4B688695FDB664A35E375086ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650041, "uuid": "1d6fa2e4-92b4-4441-a82c-e395bd7d6174", "value": "768:n5DtKwQ/uUHRAlfu4cC1iJUqv2LHH9Jnc1aGQyiWX7INHoOTrIC5RmnZ5UI7Et5P:uHOPcC1iJUM+Hnc1b7QPmvUIK5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694650041, "uuid": "7278749f-a54f-4a11-bb4e-db09757e5152", "value": 74848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694650041, "uuid": "370b0f7a-b32d-409a-ae91-71468fb8bdc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650041, "uuid": "92453ac6-83d6-4e21-bd23-4d20be4d3368", "value": "ffb8ae809348ede72fd875c4048b587c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45ca9cc-5292-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694650053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650053, "uuid": "aaa5bfe6-da0e-4bf3-bd79-ea2352744808", "comment": "Malware payload (Mirai)", "value": "5c5feafef740016f63f69220250d4cb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650053, "uuid": "a5680fdf-11cb-4098-923f-6770ef254388", "comment": "Malware payload (Mirai)", "value": "c7e7d5464b33d552d77450b470ebdd86188586151cc1fc1870a626c7c945461f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650053, "uuid": "d273f951-77d6-47b6-9eac-88d8c48701c8", "comment": "Malware payload (Mirai)", "value": "bdff42ac698732614c03e59ef916043f9c4c1496", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650053, "uuid": "8e7d37bc-5f1f-4a49-b8d7-720517ec507d", "comment": "Malware payload (Mirai)", "value": "945085b7b5bcf588fc5efd499d8a3577da552287266612a827a60e8e9d063973df2cdbf7dac1a0674921913000000335", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650053, "uuid": "5e6e8db9-1677-4f6d-a850-818bc9a966f4", "value": "T182A3D60ABF350FF7D86BDD3709A92B06198C550A22E97B367930C858F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650053, "uuid": "265243dc-95c5-4878-acd2-b54baf777102", "value": "1536:5kkhyTy3yryaiNLVeMoWpIxqzj8DmoixIINZTBuBZD2wvxzxnx:5kQ0UMKJCWsojcIXuBNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694650053, "uuid": "83a5946b-ab7f-414d-b4be-ddd70b204607", "value": 101680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694650053, "uuid": "98e61384-cfc3-4eb4-bbf3-8ced6fe8b82e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650053, "uuid": "fddd5037-0ea6-4712-a0d2-b1f94c723550", "value": "5c5feafef740016f63f69220250d4cb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f5a4e9-52cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694676178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676178, "uuid": "231627e1-9a88-4498-ba06-e0d6cd7abf82", "comment": "Malware payload (Formbook)", "value": "0ffecdb4854fd54be9dda9417016e658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676178, "uuid": "f2e1e365-8e92-4780-a79b-2a22e5d24bc4", "comment": "Malware payload (Formbook)", "value": "c8122debaede9ed9ffba560e7a8367c38801bc6879c51abaaf628a3e176cf1e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676178, "uuid": "07e8aac7-8545-4a8f-ac7a-ce1adf6045eb", "comment": "Malware payload (Formbook)", "value": "8b1053443c197b3938314fb30cf230708397dabb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676178, "uuid": "bfb71420-3c0d-4fe9-afad-c2e202b95a39", "comment": "Malware payload (Formbook)", "value": "79afab4b41cef4ac025db6ff8a1aced61a815409e135f01955e7244e05235fe70266b8eaa1bfecee0d1444c7368a222e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676178, "uuid": "749debcd-1823-4a12-af3e-790a13b3b1ad", "value": "T1D774125437C0DDA2E1B244316D704766ACE3FF2145B9172A9328AB6EBF32652C75F312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676178, "uuid": "e15fc902-7858-40dc-8263-a5a656040502", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676178, "uuid": "039bf846-ca7b-48aa-a15b-93e495ddc6a9", "value": "6144:JYa6oArDe5J9j8o36Lx54OANvTb9wMQPwi/8p66XNekUiDO4Gv:JYmAYt3sx2inoi0rXNe/i64Gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694676178, "uuid": "a6428029-c79c-407f-8730-559dad263fcf", "value": 354411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694676178, "uuid": "949c1679-9f3f-4e64-b268-1dadc355576a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676178, "uuid": "aaf42407-7ee9-4c9a-b33b-34c22fd865d8", "value": "INQUIRY 020318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a380fcc-5324-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694712636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712636, "uuid": "65e595cb-53e4-45b4-ba84-6ed0e27c130f", "comment": "Malware payload (Mirai)", "value": "760c2d39d42f43559128031846dc9ae7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712636, "uuid": "c6b73dd1-b57d-4217-ac0e-42132c5eb512", "comment": "Malware payload (Mirai)", "value": "c9fd93e2e072c84c58a383580b3255ec2b853d0055f2d4c1f0233314840e0e32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712636, "uuid": "e7ad8a70-bbc2-43ff-a6e4-853a9c1a4b43", "comment": "Malware payload (Mirai)", "value": "ba27bc1fcaa69b834e46843b3a9b09e37be5510e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712636, "uuid": "c137de0d-cbe7-4c92-a5d1-a4e2d269d102", "comment": "Malware payload (Mirai)", "value": "d66d7d5b5763cf3c4b34d77fdb4d53598949db3ad2e36cb1bdb57e490c1e8e8776ae3438dbebe762e29c11b359b7cd72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712636, "uuid": "dfab181c-c55c-438c-877b-8877290c301a", "value": "T1AF33FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712636, "uuid": "ca2924e8-c1d0-4683-b198-b8862fcc4572", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGX:r/hqaJMeteqK806MHdkfQX6HuCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694712636, "uuid": "4b2d6cb1-276d-48ba-9d7b-80358993ecff", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694712636, "uuid": "2cd665bf-3f11-4e39-beb3-67f6a2e63f56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712636, "uuid": "f740dd90-9ac7-4ba7-96ec-13634482070d", "value": "760c2d39d42f43559128031846dc9ae7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809ca667-5314-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694705801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705801, "uuid": "cadc1a41-78d0-490a-ad4f-93e57b1d2b9f", "comment": "Malware payload (RedLineStealer)", "value": "1c27ba8f4527dc0ebd4ad9e96be69985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705801, "uuid": "4e667827-b043-4ab9-a029-6d755617a9b5", "comment": "Malware payload (RedLineStealer)", "value": "ca01887f1261ab5d83adc154e7875e2a34916f93771c13a056bda75ee17a07ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705801, "uuid": "3279a3b0-8e44-45ee-affc-8f6ff7896718", "comment": "Malware payload (RedLineStealer)", "value": "1ba13abb593d03c7654f8792539542fc7447e724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705801, "uuid": "72c92be0-d1f6-48c1-a547-5da78a4b2ac3", "comment": "Malware payload (RedLineStealer)", "value": "190785ae9726db6acf52a2c96dd3cb1e4307c4fd3f399f7024e1cccaa2b765a56185290f3fbde15a8865ee7c3b82b9b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705801, "uuid": "199b0465-896e-414c-97c7-aae313f038ab", "value": "T130952B1136F95B49F5F34FB86ABAA621083ABC698F15C6DF12D1905E1930BD08970F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705801, "uuid": "2d2c6f76-5479-4f93-b691-a269fcb2eaf2", "value": "06500afa79d4009a0fa967e7c375115a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705801, "uuid": "4ff770f2-83eb-4213-8b0d-84d8ee461137", "value": "24576:6tnk1fU7mjOJTtpR4K86l1AdTG1o6a9DhvhH5q5:WkFOJTtpRId6W6a3vR5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694705801, "uuid": "9a945bc0-7d82-4c0e-85ff-23af2fff5084", "value": 1903616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694705801, "uuid": "275f8e26-c525-4685-af1a-d410f482f704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705801, "uuid": "fb032cec-1561-4413-9073-7e7b81a62c37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1a51e4-52f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RisePro)", "timestamp": 1694690793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690793, "uuid": "0d3f7ceb-2f89-412d-bcf1-5c167fad858e", "comment": "Malware payload (RisePro)", "value": "020156cfb0ef4dd8a7f4b5eb36482d80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690793, "uuid": "b2bd8ad5-6571-44a0-b832-2d51666be874", "comment": "Malware payload (RisePro)", "value": "cb202512b3c31bd766f06ad9db4fea1283b736350a93f96d321198c1059b9ac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690793, "uuid": "760f6574-7c91-4f51-b8d7-a33c89b51718", "comment": "Malware payload (RisePro)", "value": "cc181d87e5d1ac492ff25ad788bc5ed61cb7df6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690793, "uuid": "bad1e60d-e5e6-4f1d-a143-0abc9f9a7146", "comment": "Malware payload (RisePro)", "value": "11539a8b158b9d2485eb01a1b56dd4871f92ae7bd60b71b289a8cd3a27932c857ca07d42e56916e3bc89cd0b66b9e3fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690793, "uuid": "0fbfbbfa-44ec-446c-8515-627dc0c1538a", "value": "T16EC42F9C366076DFC86BCA729EB82C64EA6074B7871BC217941311EDA94D98BCF150F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690793, "uuid": "ab3b5707-f5f3-4314-88a9-80cd503a3732", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690793, "uuid": "cd3854a5-e5b7-4567-bdb1-f721f4a0365a", "value": "12288:QOTMpuF8lLWTjHuJm6/p4mTu3DiUyT7LBgyg7emhYpkNJndkCNWjkhowyMwOZWYG:zPzD0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694690793, "uuid": "b02ebe4b-5a29-49eb-b956-ddcafe0f475b", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694690793, "uuid": "824d536b-3a2b-41c1-aafe-ab80501624c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690793, "uuid": "f5944e82-7eec-40d7-bfcf-4fd83f0041ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652dae14-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1694675690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675690, "uuid": "9d5e9b63-1543-42b9-9987-1f4fac7e7704", "comment": "Malware payload (Loki)", "value": "aa2079c97f01161455170da935ff6530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675690, "uuid": "c3e85a2c-8bac-4223-b861-840719a009c4", "comment": "Malware payload (Loki)", "value": "cc78351177d3f5c8044dc5fd912c94c0149ac90af40f62ca059ce78f96fc9ab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675690, "uuid": "e766768e-7c47-4160-93e0-2371b7288169", "comment": "Malware payload (Loki)", "value": "f6e7d042ba9d81548e5cc34a4e716429ae64ba16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675690, "uuid": "5e51340d-6675-44c8-bc15-8df8b941bd29", "comment": "Malware payload (Loki)", "value": "ec8ea02acb64f38f2bc3bb4b0b14f88fbb53c3e847626c9cc62fea5d00edfbacd0e7e0c87124de31a69cb0c041f4a2fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675690, "uuid": "42629a33-7384-45fa-a944-48f587ce2019", "value": "T1A8D4BE9E760076EFC827C976AD545C20DA11AC7B970BC203905732A99D3D997CF286F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675690, "uuid": "540ee7cf-8cd4-400d-b0bf-be5216475d5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675690, "uuid": "a72780f8-1be0-4afb-9b46-4b695a7b8fd8", "value": "12288:Qam9Y1PYyVFh/I1K5uodK+F9SWwsukeF7xUajIKkdd2ag3HIs7qmDr:Qam9Y1g+FoYuC9SJsukeF7x3ML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675690, "uuid": "2c36143c-5880-4ec8-95c8-89b36a519a3e", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675690, "uuid": "2af2aadf-9031-452e-ae9d-51ddff3bbd80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675690, "uuid": "1a619550-7a28-4cec-ab6e-998bf08693b0", "value": "Payment_Slip_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b71d78e-52cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1694674681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674681, "uuid": "1c02955c-dcd8-4357-b106-fe174d884266", "comment": "Malware payload (Stealc)", "value": "2b44eda084c2831ef6971027dc2cf41f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674681, "uuid": "4743372b-0c6e-44a0-bd67-8cd96113ade7", "comment": "Malware payload (Stealc)", "value": "d12c9f98baed5d53183af6e013e9a93468eb533f5e2709138f28006325adb573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674681, "uuid": "c9287747-c67f-42dd-bc97-31245a11d7cb", "comment": "Malware payload (Stealc)", "value": "6c658aaa15813c74c25d9a98edb7727506c04c36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674681, "uuid": "f015b622-cb97-4c84-8892-b9d6ad6d7570", "comment": "Malware payload (Stealc)", "value": "8b969b0848fbc133960e26c8284cab532f7a9f672d4cf5c5e04fe7eb45bcb1885ce95a697490e2dafa27e65e51e4244d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674681, "uuid": "3328fdce-f28b-42da-871d-b5401043e150", "value": "T14714CF1238A1D471C6A7C1384874D5F56A7BBC23ABA5494B33683F7F3E313A25B66342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674681, "uuid": "36ef4106-7c23-44af-88f2-5822b335676b", "value": "ef163fd1a1dfd01940ab083fe4660afa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674681, "uuid": "f26282fd-c65e-418e-b015-5010a5f8a503", "value": "3072:ehpwaLMWVJLtOzGVCRl0tZD4ZoOns/vSMq6ILO9PzT0KCN856vtYcTTR4P:ypwaLMy9tdVileROs/6MhVbC5CcTV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694674681, "uuid": "06c5dd6f-32b7-4c65-852d-2298ab6e2968", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694674681, "uuid": "4b47b851-7765-4a0a-b5b5-69a4e9e215cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674681, "uuid": "28d9203c-e0cc-4db5-b8ce-819648cb8535", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c735a09f-5318-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694707638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707638, "uuid": "3e33089e-63a3-423a-81fc-d70e97e48491", "comment": "Malware payload (AgentTesla)", "value": "31b18df63e4b5fd030a1ffa8750be98e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707638, "uuid": "8c1a5c0b-d492-4c3f-8712-4fbc33506d19", "comment": "Malware payload (AgentTesla)", "value": "d16fc0e0aa125950696064f1fb20bb379c314026ea8e640a2882c6dd4f351721", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707638, "uuid": "3c85dcb5-2ad9-4702-99f0-477b76fc0309", "comment": "Malware payload (AgentTesla)", "value": "c7c2061d9c2fa0c5159ca2a2eddde78f51f0277a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707638, "uuid": "406f5414-5157-4ea8-9053-de8ebe244bfb", "comment": "Malware payload (AgentTesla)", "value": "b5cce36b578e08718f8282efe4abc50bde68b556700449ccbe4d6296a13af7ba2f8b51ce5384c20050d8929f987c62cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707638, "uuid": "1f922e5d-7f8f-43b2-8908-8c74a59b105e", "value": "T147B433E43789D624525F25B754EFCEAC88CDBD31A0948369E47BD9AAC70C693983FD00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707638, "uuid": "8bcff5f3-8d64-4397-bd11-0196aba312f3", "value": "12288:mVswew0K+8hFn5Ed6/Ux2utqsbibSCTtOLdLBFndFQRczeG0jfc:cszwLb5o1RCTYLdLjnwc6GKfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694707638, "uuid": "3cf36937-eda5-42b5-ade4-5b97b70be8aa", "value": 519703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694707638, "uuid": "1ed72fe2-d0a5-4567-8198-e33dfc62608b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707638, "uuid": "0a1d8400-0047-40cc-946e-627d5aaa7bb4", "value": "invoice no 214275.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38341981-52d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694679910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694679910, "uuid": "111cb409-7b79-4961-9b09-0679ca7093b4", "comment": "Malware payload (MysticStealer)", "value": "c6525c5ef938105d1ac779484cc22cbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694679910, "uuid": "785ab0f4-8587-4b7c-b2c5-fb56da6479c0", "comment": "Malware payload (MysticStealer)", "value": "d230a93c74262d42f43afebc9b31e865a65c2aa10ca201b7aad30947cdd4c373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694679910, "uuid": "d41db731-1e79-4a14-a22c-7ca8183640e5", "comment": "Malware payload (MysticStealer)", "value": "f02c0855a29b5e30795f421eb9fc52642d4e5963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694679910, "uuid": "d79814b3-b9b3-42f0-85a1-505aa7c3a95a", "comment": "Malware payload (MysticStealer)", "value": "f3e264a6ccf9fe32eb4af6dcd3cc90f35603da7b86e7d1f0eee2a99932b2add6717c8e60d4320611a962bfb21a9c1268", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694679910, "uuid": "d7856d2e-00cc-4861-bddc-7ad5c062f9d0", "value": "T11B74AE1130924172F8B265348AD9EBB1993EF8600B525CEFD795AB2E0F633C1D67127B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694679910, "uuid": "d98bd58e-b8bf-477a-9bc8-ed5544470af9", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694679910, "uuid": "42e024a8-5992-4a90-9e77-1c094e959b63", "value": "6144:7HxiKL/yfYb5B+BO99c0s0ZVtAOfg9bKXka8/jqjD1Xo0QE9:Dx//yfYb5BIQZVtRCbykp/jqF59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694679910, "uuid": "78c220dc-49e7-4463-9741-a8df80c6ba70", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694679910, "uuid": "7de78b1e-708b-47a6-8823-6afa845ef101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694679910, "uuid": "da66d678-344e-4e71-8cf6-00d4ea137d99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d607f5-5339-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694721706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721706, "uuid": "2e6818e3-b63f-44af-a312-12546a618775", "comment": "Malware payload (Mirai)", "value": "77db5217c2b9db48ac29ff5fda780dcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721706, "uuid": "d9f6b018-c9be-4ee0-bb7c-48036f13ab66", "comment": "Malware payload (Mirai)", "value": "d2725517f9f837a418be0cb358b699aa3d9362d6eb27598f5345c727c6fc9bef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721706, "uuid": "335a477f-f497-4dfd-b942-195e24faf8eb", "comment": "Malware payload (Mirai)", "value": "52aa890d36f4620cfc42151048ae4270ed0311f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694721706, "uuid": "a338c4d8-e737-4440-b395-df4e89ee7450", "comment": "Malware payload (Mirai)", "value": "c2a1bda326bfb15fe4b675f2023e3e62fb6059cf720585e642d8a4d657f655a7566bf30d1a3f732657f21e456ac5b7e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721706, "uuid": "7fcb3da8-d241-4222-931d-8239f3c52018", "value": "T1D2A2E019BF2C828BC832293595E9E6D61356FC71F29DDC093940C16BF0A33A92874F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721706, "uuid": "6a454c75-08a1-40bb-a0e9-8b0dae1b4a2e", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTb:x98o08kxofBE+ZkXaITbp2F2TWul0c5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694721706, "uuid": "12f22716-cb15-474a-bb8d-7938ad3d8df8", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694721706, "uuid": "10a6fd0e-bf2e-4c08-aeb5-04c12bf42e52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694721706, "uuid": "2007c1e7-e559-4ea8-9659-e4822dfdb087", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8ed6a5-52cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694676136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676136, "uuid": "4188372c-1af7-48e0-b734-659b86428366", "comment": "Malware payload (AgentTesla)", "value": "9f2f38dcb2ad23ad292b107e8bd2f8c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676136, "uuid": "906d8f34-1589-489f-b414-13800f3b5d72", "comment": "Malware payload (AgentTesla)", "value": "d2e1eead980699faad8218e03f34a2a6309f4fa40c43126f752a8e759a1c1fbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676136, "uuid": "37959fa2-1f2f-4875-8a6b-a685b34bf15f", "comment": "Malware payload (AgentTesla)", "value": "6652a96013fcc0c82a1383918297b03a7c43c434", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676136, "uuid": "3e8146b7-8469-477d-a2b2-0175a28b05f6", "comment": "Malware payload (AgentTesla)", "value": "e020f9e4cbae34d29cd65401b54249e6c8694248948e203926355105c7a38c2e85c4df561a5664b2f3aff512c6f8acb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676136, "uuid": "d20b5548-b027-4b06-90d6-299088224c71", "value": "T197D4234D31CCCF35E4D64FF6A175540E23F890A4A6CBE32E9F8522A8BF52B43566035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676136, "uuid": "9154ad35-484a-4dc4-a15f-e7c6b0484c9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676136, "uuid": "a61bcecd-5e9d-424b-9b80-4374b907ebc3", "value": "12288:s7nj8FwLm/BJ5MOuoEIv90RspCFlU1ViKpdwdHrat4PgaVeQ:sDj8F6KsOEPuCc1Ecura8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694676136, "uuid": "7309a99f-9808-4838-8e7a-592002659bfe", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694676136, "uuid": "66d895b1-871c-4848-80f5-bdeb1160c60a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676136, "uuid": "4680852c-4017-4698-adc2-1d04c561a08f", "value": "Po no.229 23-24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca67a08-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694675918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675918, "uuid": "63ba9593-59cd-49ee-983d-64d0b4348867", "comment": "Malware payload (Mirai)", "value": "bb84c389f5fbd3cc7ce6f99d813dbf5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675918, "uuid": "8d58a107-99f7-4500-ae8b-44d993d94f0f", "comment": "Malware payload (Mirai)", "value": "d31b79e358b9c9ded2ef99622504d45f8c3c25e9778e20ebe5568c3b0d9f8e79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675918, "uuid": "367b4d06-721a-4d4c-b370-36bfaa6d8f29", "comment": "Malware payload (Mirai)", "value": "36147e8d59cef4e137e867a80479e09c3671300b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675918, "uuid": "b2ddda83-0bc4-4563-8e3f-ae8a5cb6d06b", "comment": "Malware payload (Mirai)", "value": "b8a846f22c4d188ad0d58135e6922380e4650f9352b06b1e80e2562ad215160a50444e5bd241334a86c5dc5a480fbda7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675918, "uuid": "a5dd550b-4df5-4bb0-8d88-c0491c254c8b", "value": "T19B63AE25E0058950C4864238B4E6CE751F63FCC483BB5EB6AAD581AB1447EF8F61CFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675918, "uuid": "afd5ac04-1ea8-4f46-8014-494c2a07edad", "value": "1536:maPx+NOqFLF+wtHRHT11fIL/N3zqwT+UtSCzP:mrNOqFLsW1txwSUtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675918, "uuid": "88f3ce67-ca85-4bab-a020-0d0a417cab55", "value": 70648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675918, "uuid": "949c6ea3-2276-468a-bbcc-149b3663d30f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675918, "uuid": "2d71a15d-b22f-41ad-8c57-20494be4d131", "value": "bb84c389f5fbd3cc7ce6f99d813dbf5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef36f0c-52e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694683948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683948, "uuid": "f458d1c7-3d86-4b37-a468-c43d3e88ed44", "comment": "Malware payload (AgentTesla)", "value": "efad5cf87d2c254002aa4d3631032d02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683948, "uuid": "2ff52a45-c248-4a97-9d64-90799b05e8e5", "comment": "Malware payload (AgentTesla)", "value": "d33724f1b25c4d62ceffc10086a6594c24a74549d6a0c6f22f712eb68371b5b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683948, "uuid": "23db3b89-6913-4d3b-a1ca-92bebffbbbac", "comment": "Malware payload (AgentTesla)", "value": "fb10d36ad02e2ac10c0697a473b8f09e5e71ec90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683948, "uuid": "39167b31-ba95-4284-902a-6f86cb1e4d8e", "comment": "Malware payload (AgentTesla)", "value": "abfbd2ca588897f7e7257188439cd1df25b4167fc7c9d65dae8fe64f48a0993a1aee2a0970e1436561c9bbfb000e8ed6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683948, "uuid": "9c6bdd1c-5196-4d22-b99d-e430c156665b", "value": "T1DA14B503FA4649E2C2898B3AC6FF5404C7B1E684E797DB0A798E23DD18477BADC46147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683948, "uuid": "096c25c6-6842-4409-b2d3-7387d5dfd1b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683948, "uuid": "8e19a745-be15-4dee-ac8a-a9c96dc395c9", "value": "3072:UWwDw3w6SIlK9TqWzvsyGn6/uSnIB8eT1Wj33oVJIW9rQz:bVA6OhqWz1X/uSI1knonF9rQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694683948, "uuid": "26255211-9b40-4b0e-9dcd-7200877864ff", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694683948, "uuid": "ce140eff-b5d0-4c82-b9e0-08fa856c1c28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683948, "uuid": "63f38cdc-426c-454c-9a75-780465c7ac70", "value": "SecuriteInfo.com.Win32.KeyloggerX-gen.471.21119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97cf3d8-5319-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694708017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694708017, "uuid": "37bfb784-7578-48b0-9a59-47dadc1616c2", "comment": "Malware payload (RedLineStealer)", "value": "26b01b0b79e03bb1ec66cab46b8e13c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694708017, "uuid": "cda16c10-34f1-45c0-a524-135517ed454a", "comment": "Malware payload (RedLineStealer)", "value": "d35c6891f5b055e2c930bf33a10fd2715b10d1a615dcee3bdbf772ad6744e673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694708017, "uuid": "891ecd84-3a41-459d-a9f1-a126e70f37d2", "comment": "Malware payload (RedLineStealer)", "value": "091f7be6ce1f88827fdef04150af357a4a7bf2fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694708017, "uuid": "5a611843-1ea0-450d-ba5f-694b79e73444", "comment": "Malware payload (RedLineStealer)", "value": "9626084175e4343ec28ab564550378af7b5b2b6fae0f9313b677a956cf4d27c52b813d750bf55bfe2757b16ba6b02b2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694708017, "uuid": "a831cc4e-1c69-4f03-8d04-20a3cba84260", "value": "T1CBA46CD4B9E2B751F873303247A0C9E1A625247EB66700DB0B7FBB00619855E7B35CBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694708017, "uuid": "3b91e535-e08c-4967-8718-3564c176df84", "value": "0c9c64525522b2a989036b9afc41aa0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694708017, "uuid": "c68cc4c4-ac5a-47d1-b253-1b672f858c39", "value": "12288:OjgSeTRJPuY0GXeZUsMl66vyrbzcCXy15hC3wnFvt/HjDcBtlklqcF:Oj3eTRJPuOe+sMl666rbzcCXy15hC3wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694708017, "uuid": "1ad0032a-8963-4ca3-8e20-52ad1bfc651c", "value": 451144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694708017, "uuid": "0d5d722a-4e12-4a9b-b302-8d2f77626bf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694708017, "uuid": "ec4bd934-1614-4e94-bdc3-034d2fc7875f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc5617b-52dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1694681580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681580, "uuid": "a2a82bf0-5a4c-4f53-8cab-ad574de5f011", "comment": "Malware payload (IcedID)", "value": "e535c7fdc8d19fc44948a7dc96f3e757", "object_relation": "md5", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681580, "uuid": "ea841a5e-1686-461d-85d4-fabf98ad86e1", "comment": "Malware payload (IcedID)", "value": "d3bf403dd0c551386ccb6ce508d5bc3e65542352b81e8c7b663c95b2455e6533", "object_relation": "sha256", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681580, "uuid": "600ab045-9337-4209-b46d-b46427f17ca7", "comment": "Malware payload (IcedID)", "value": "eb5010e2cf481e3631bbdfb19dc1b5e3c39657b1", "object_relation": "sha1", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681580, "uuid": "fbb98dc3-c10d-43f7-91f5-80dc557c2049", "comment": "Malware payload (IcedID)", "value": "dd97775948c20befcaaaf1ea8a739db07aacb46dcbb2be4bb3d377d09b87ea37cd3fecd0627b4fd41b5d2b2c127defad", "object_relation": "sha3-384", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681580, "uuid": "f3debfea-a33a-4800-9759-35e014dd6dd5", "value": "T11B630279387BE34ED599D4B627C8DEE18F55F91725C339706076C4E9D4A1A028AC33C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681580, "uuid": "a69e93b0-179c-4391-b5e1-a483bc55ad04", "value": "1536:m/Z0EPnIcQQrwCMu/0MaoPaqdZMMb1g8uog/NjJiC8hd9:mx0Cn5HlaCBdZMMb1BjgFtkd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694681580, "uuid": "3cc77a5d-4777-4b2f-ac42-6fc7943b496c", "value": 70615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694681580, "uuid": "a710775f-a089-4736-b7ee-618a21264445", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681580, "uuid": "c00630aa-296e-4a2a-8578-6a00087ea148", "value": "09-13-In-v_Document_104.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0a0efa-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694675645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675645, "uuid": "58c8d1f1-841e-42ee-a58b-d37b963a156b", "comment": "Malware payload (AveMariaRAT)", "value": "7b50273a41c8d725b7bfd3c485504366", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675645, "uuid": "f6530d42-9e59-47ed-9e7a-981bfbf183ae", "comment": "Malware payload (AveMariaRAT)", "value": "d3ced1332d5437bfd61e06610852c43d8b00c6bd100ff6e84f0daed25ccefdd9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675645, "uuid": "95f2c59d-ee7b-42aa-84b0-3ad1f03aab01", "comment": "Malware payload (AveMariaRAT)", "value": "b7d63395138c25ffe8c27ac397f5024da764c42f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675645, "uuid": "cc210564-e6fd-4913-b788-368012ffc78f", "comment": "Malware payload (AveMariaRAT)", "value": "9e2070b2cf45804b1cceccde1b384f58ad421ddc62f5bf8b0f6135baf07af5b569420333374ddc181f09b0e1b82f838d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675645, "uuid": "2541515d-773f-48cb-b057-39eca37cb180", "value": "T18034E803BB4789A1F284173EC5DB441053B5E9C9B2A7DB0A3BEA33D618537B6BC89147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675645, "uuid": "b02c0dd3-ae4c-41bd-9039-76373162e018", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675645, "uuid": "945c4f48-b3a0-4311-8328-fe84b2d442ac", "value": "3072:4s+LN8m2lixU68b63mIU0fYvtM5mGd9YKKdfD9bf9/3veWvEUQNcTxsND:mLN8jlgqfIU0fYVMcGUf1feWNQNcT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675645, "uuid": "8128dfad-02ce-4bde-98bd-ad5f77c7ba0f", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675645, "uuid": "39200d8d-0690-4f81-9e47-ae3c3d2e253a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675645, "uuid": "b9f82921-2fce-4231-9ce9-3cd2893f8867", "value": "Purchase_Order - SEPT-013-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf5a19c-52cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694675432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675432, "uuid": "30dc4d71-f621-46bc-a04b-33f4e3473aa0", "comment": "Malware payload (AgentTesla)", "value": "5c80759dec4c98ff03128d463bebe785", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675432, "uuid": "c90aa65d-68e4-46d7-8107-a0efabdb3cac", "comment": "Malware payload (AgentTesla)", "value": "d498e75e39de09b5d0a2451ace58825db00797f40d71ed82438cd2f369788765", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675432, "uuid": "498db046-1587-43f6-9420-dd61a91e63e6", "comment": "Malware payload (AgentTesla)", "value": "3399ea1af9000f5dc888f8781242cf10135ff23d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675432, "uuid": "64b0bf98-34c8-40ef-84d6-2d593b907731", "comment": "Malware payload (AgentTesla)", "value": "27b2e3cc3519383a0974cd9d9f9c165dbfb75bb0fa6b0f382f00191b2859d082eb733931d3658c1e8b247472c85d8adf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675432, "uuid": "2861a4c1-4e75-4dcc-8548-af325517cf4a", "value": "T181D423BC574AE679F04EC17B20FA11C8EA5E7A43090F37D5CD4A26A837DD1C06949A8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675432, "uuid": "3132ad29-5990-4630-b169-feaa67aea8dd", "value": "12288:51nWSFTKCWrZiV0IS6/KU95LJkQ1ADCSF/5FciuUNUD2V9pULiQhLt0r:LnTKCWrZMqUTLOGBQvcBUx7ap0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675432, "uuid": "cfc188f6-90f6-4042-8002-f8c7afe3611f", "value": 635678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675432, "uuid": "f46e1488-0568-4544-a9b5-003cde33423a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675432, "uuid": "574f3ccf-6d20-417b-afaa-f6f8e8968901", "value": "TTI20230914 18_09_124.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0509d461-530d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694702587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694702587, "uuid": "363a9a75-3738-4727-8dbc-8ef7aa690245", "comment": "Malware payload", "value": "020dc257df5afb0b52412b5236ef4f68", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694702587, "uuid": "e84d9ff7-1dcb-4e3d-a2dc-bfa54be9cca6", "comment": "Malware payload", "value": "d625eabac7fa4a7e794208a839589e41055e828923cb49ac8872fb261b9cc165", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694702587, "uuid": "bb51f4ee-2530-403d-94d5-9424d2a94419", "comment": "Malware payload", "value": "0ea4a1256f2b730dea04c6e36260530de572508e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694702587, "uuid": "054cead1-42a5-4292-bb74-2a10a43f8da5", "comment": "Malware payload", "value": "8d7a7040ddaeb84699b2f7a22c4ea089e0d6b43b230f43c5094fa91b757b19d1a70365d6b0bee1334bec126ac0d011c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694702587, "uuid": "079f6ec6-9a70-469e-aff1-bcebc55079e9", "value": "T1DFC633D2DCB0BC93996120C47B118ED645A28ED84941AFD593E07FFC94AAB5303D3AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694702587, "uuid": "95782aed-491c-49e3-b50e-af86bde2f551", "value": "196608:LcDrkp712p0zEbIqU4hD4BRnXx2nWKVwhsG8OI/1nGzwwn6479AElsQJVR2hczZC:wr+11EbInEsvnXx2nW36OsGtnoE4UGpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694702587, "uuid": "be9eadbf-10ae-44f3-a681-fb8d635a0402", "value": 12113304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694702587, "uuid": "6ab943a3-b758-44d6-abcc-ac7d8eb02a44", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694702587, "uuid": "0e5f576b-aa6c-4fa5-8e5e-8933fac8fb4f", "value": "pack182.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62695696-5324-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694712623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712623, "uuid": "0c6968e3-dd30-4356-84b0-948a1eafe749", "comment": "Malware payload (Mirai)", "value": "820f89dcd0662a45df90a14cc7a3cf74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712623, "uuid": "1bd799c9-56d7-4f94-8e91-47bb08cb9969", "comment": "Malware payload (Mirai)", "value": "d65d3cb3e2e0fc9beb73befaa6e7c2ac55bfcf4b2c1246e98295c314635dc770", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712623, "uuid": "c861aafa-14f5-486d-8529-f6160f68686b", "comment": "Malware payload (Mirai)", "value": "1737b6c53521b0d58f8224292ec4afd91dbc9097", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694712623, "uuid": "66f50ae7-5dba-4ae0-9537-ff2b74edf9b1", "comment": "Malware payload (Mirai)", "value": "0de9a3c345e5874e7101411d99802949d35338a8c9230c30f96e3c4df4dd65e2d4abc1b851dd11043067b190d32038f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712623, "uuid": "2a3091b8-7598-441b-a4f5-088549beeaec", "value": "T167C2D1E07726FD31C4206C3DE52B4D8A7A51067C91FE383664258C398EC169B67F84FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712623, "uuid": "46b7fb41-b665-45fd-9a2f-17cddef5fc72", "value": "768:DMKyhegCCMqfizjoNpd2vJdX6vwr/29q3UELus:oKy4qfqoeJdXWgTLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694712623, "uuid": "6188d45d-26f0-4f87-8466-4513d74dd606", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694712623, "uuid": "3a656fc3-c60d-49d5-b9fd-50edee9aefb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694712623, "uuid": "ed46b1bc-aa4d-4f37-aff3-fe579373f67f", "value": "820f89dcd0662a45df90a14cc7a3cf74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f95e9af-52e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694683949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683949, "uuid": "2cfe0a8d-b77c-49e2-ba38-f81f5b7c7178", "comment": "Malware payload (AgentTesla)", "value": "7bb8d60e65051cf9a921731f20c05f16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683949, "uuid": "c6abe658-b25e-4baa-bbfa-cf07d5190e6c", "comment": "Malware payload (AgentTesla)", "value": "d72e06066cce04251239d12e50e546c951aab9c1c0682d189714fddcf0a74cda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683949, "uuid": "bbe2dbac-9957-40c5-a394-962a16de3ebb", "comment": "Malware payload (AgentTesla)", "value": "71805ec0ede61d57d068b530efc82cf1df34d4d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683949, "uuid": "bc86fe19-96ad-4a1d-8da6-244625329906", "comment": "Malware payload (AgentTesla)", "value": "2421b1b897e8e2c685055861b67064e5c632c9e31a2fa8df1504ef2082490c10cf201c111a83f0c0ff5f9d3e038c1420", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683949, "uuid": "d9c487d6-84dd-41b8-a03d-e9490c888fc5", "value": "T192E46C0123F59B10E57EABF5DA70812287B93916656DF31D9CC1A8CA1EA1B139FC3B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683949, "uuid": "89ecd0c5-eb5a-416b-83e3-608f7b05e6c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683949, "uuid": "efbe51cf-f6de-483f-a639-1ab54c2ef205", "value": "12288:KODphClGCxfAisK/eC/FOd9vH4Fw0dcTo+jswhKCMt35dxC:Kfd/47vYFw0dcTRjsMMl5dxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694683949, "uuid": "6d93888a-a2cd-491d-8431-f4074ef37f46", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694683949, "uuid": "74c4715c-d21d-42de-8d58-4ee409c27a3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683949, "uuid": "9d192e8c-368f-4b44-84f0-fa7bd2022433", "value": "SecuriteInfo.com.Trojan.DownLoader46.2601.23399.27613", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce9b80f-52ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694675650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675650, "uuid": "779d2c66-08ec-4413-930a-4ba18ca9646a", "comment": "Malware payload (RedLineStealer)", "value": "21084a571deafdbc18cc28781149707d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675650, "uuid": "4f4100e4-70ea-46c1-a510-7ddb72e5d08f", "comment": "Malware payload (RedLineStealer)", "value": "d7967a64a0dcd864936c7cff847728dc55b6fe40978c60df5e416d8bd294900c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675650, "uuid": "95788879-2538-473d-94de-1c264e9afaa3", "comment": "Malware payload (RedLineStealer)", "value": "d340307ddc9b1d4ea1e13ca2c565ea0a54ef5319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675650, "uuid": "9ad799d5-67fe-408b-b0ac-941466b4fc79", "comment": "Malware payload (RedLineStealer)", "value": "a5c99ad917ff138281d8708a761a200d82307209c1f6bf8db9c34ea9e73579b2d1bc035fd1103cc1d31a93043cdd91fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675650, "uuid": "c7238bc1-eeb1-4b96-bd49-b296c181a530", "value": "T1B4F38C2071C1C1B3C4B7113084E6CB799A7A7071476A96D7B7DD1BBA6E213E1A3362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675650, "uuid": "2b46d32e-84ce-4452-a5d6-7e638803d342", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675650, "uuid": "fb88dcf3-b395-4368-a25f-4842565896f5", "value": "3072:SDKW1LgppLRHMY0TBfJvjcTp5Xm381wSS:SDKW1Lgbdl0TBBvjc/m3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675650, "uuid": "f06232de-f5bf-43db-a967-f11842b63f29", "value": 166912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675650, "uuid": "127f4800-ce1c-41b3-bf4f-4326a33872e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675650, "uuid": "8bc1093d-155d-4ebb-91cb-04baa7c1fba5", "value": "UPS 1Z660WA78626838628 BL Factura comercial.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a410a783-52ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1694667206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694667206, "uuid": "15911c36-c460-4fce-b565-61fa24feb7fa", "comment": "Malware payload (CoinMiner)", "value": "5182e126b6f798ddb20ac56c5ab4660d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694667206, "uuid": "2523809f-3601-4d2a-a440-0f255fe802ed", "comment": "Malware payload (CoinMiner)", "value": "d7b88f392653a4569f1f6a792d27ed75dcb22921915ff2cff23519d6eb8c673a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694667206, "uuid": "39c07231-b742-45cb-b38c-55b03e46c493", "comment": "Malware payload (CoinMiner)", "value": "467a4e7708679aac87c2a4e98b9c69eba12dc21b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694667206, "uuid": "de91c4e9-05aa-4774-82d7-5d7853eb78f4", "comment": "Malware payload (CoinMiner)", "value": "8e83ecb3b2964df2da7b90fcec1b15d2d0e94678f70dca08cd7b43d6857ec35ccfd5223771c73d52680e31a61b28f970", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694667206, "uuid": "47fafb87-4be0-4e01-8cff-3c22249d83b7", "value": "T1DB545C03AF90BD60D7268A729E2EC6E8779EF961CF1977561218EE1F0CB01B1C563721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694667206, "uuid": "0370c6a9-6de4-4b3f-8d2e-ff17183898f9", "value": "3c565fbe4eaafad8572e17176ac3eb42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694667206, "uuid": "b2548b3e-7da3-4faf-916c-b4cacd0bcbf6", "value": "3072:w+uHkj3i/Gur0Z6sZgrKBRTM+4FvH9vxrFUkcVTcgpWvKV/Fy2L3:4Hci/GuoZ6pmBSJrJpUpV4gEY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694667206, "uuid": "9cd8d6bc-2e80-4aca-bb12-cc78b36f007f", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694667206, "uuid": "55337a04-4b98-48fd-b3b2-2672569dc465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694667206, "uuid": "ae9853b5-e5da-47b1-89d2-bf6654adf560", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15787cc-52e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694683576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683576, "uuid": "91b4982d-e9af-4c00-95cd-f879f6250780", "comment": "Malware payload (AgentTesla)", "value": "1cded36bd83bf3d6798ef1867de0b193", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683576, "uuid": "01ec369d-7a3b-424c-b23b-1dbee4f82bb4", "comment": "Malware payload (AgentTesla)", "value": "d8ab425ae58e676d7575eab5fc65601ac4851045ccd781d592af8342857c6c6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683576, "uuid": "08973a31-0c89-4d54-94f6-2c65449a5844", "comment": "Malware payload (AgentTesla)", "value": "913d518ef5de74ba8b366e90e9feec8b8bda4b4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683576, "uuid": "14f7a927-786b-437a-9ee8-f23f906b0d4f", "comment": "Malware payload (AgentTesla)", "value": "7d5d0819baae498f811e4fe1888ea3f888389dc8cccd58971fdcd2b051b50419778850eb34d8ce73fbad4e8a1f092d06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683576, "uuid": "c2f23214-0923-4484-a1f3-6dbb8e4f5ec0", "value": "T1DBE4DEF81568D7D6E779A3FF006784348A237E965534C2CD3BBC34890EAAB931511DB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683576, "uuid": "b7e22f44-3dad-441f-849f-168432c4dd2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683576, "uuid": "a626e7b4-fbd0-48e4-93a8-d6fb646ae701", "value": "12288:tq8RG2iNCZBVOwnEmRWGq6HgpiCX5C5OwocNk/0lC4pONsUmjK6YfQtfGnh5azq/:tqqG1C7EuWGrH4iX5OX3/0I3iUmjKtfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694683576, "uuid": "b9edf394-32e3-417f-a265-f2ad2672478e", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694683576, "uuid": "9d0ddcd3-8c09-4eef-bd9f-df9fb7e0ca0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683576, "uuid": "dbb17f58-efc3-4c6a-9277-b05ee558e810", "value": "Request for Bid.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df4bc42-52a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkComet)", "timestamp": 1694658552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658552, "uuid": "39049307-4b4e-47a3-ab71-10e86129f736", "comment": "Malware payload (DarkComet)", "value": "853defebfd1baa98efa066bf34e41654", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658552, "uuid": "077d3b99-6c69-4cfc-94eb-021a63e54fa9", "comment": "Malware payload (DarkComet)", "value": "d96562f7d3a110ce92b736f59a64cbbedf642ed90a4dbb19c184bee24dc03247", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658552, "uuid": "cb7b2590-5437-4474-8dd0-d198ebe11941", "comment": "Malware payload (DarkComet)", "value": "6ad427cb53ee1f46ead7a8943a53e304ef3c21f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694658552, "uuid": "dfabcaaa-fe62-4221-a620-42a3908e9da3", "comment": "Malware payload (DarkComet)", "value": "7980be1ff436ef1e5ed80366307fb0fe2bb62c3d88754dae7367d681c23edfbc970498604657bcf5f750dcfb2a8d4bd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658552, "uuid": "d5da5018-726c-43a1-b501-c04c65ecd043", "value": "T189763350BA972FF4ED5A5F360B74040790DEB9997D420BC39EB10CEE3C6AA78422D857", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658552, "uuid": "b680bef1-d69b-4a5a-895d-639a83c46da6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658552, "uuid": "7773954e-a650-48bd-b9f6-261d0fe5fdba", "value": "196608:VUUIZYB12sG5/oKZu12ebfpnj1DD2IrAN8dnXIskK:OUzE/hDenRD1ANAnXIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694658552, "uuid": "34bcd812-bc0c-4f46-9ff5-dff2d58386ef", "value": 7615043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694658552, "uuid": "4c5af2a1-d46b-4ece-bcc6-9736e76d9c45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694658552, "uuid": "af4c3f08-05e0-4233-880c-720465f4d5e0", "value": "853defebfd1baa98efa066bf34e41654", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab520309-52ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694674090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674090, "uuid": "c0aea028-86e9-4bc7-a8ae-ec13ef291f66", "comment": "Malware payload", "value": "f1ebe97d8b410c99b4d9c0d275aaf5db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674090, "uuid": "da92e8ff-b0da-4d13-a26e-c52a6f09f15b", "comment": "Malware payload", "value": "d97557dbc72b7874a4930df04981879addd937e7cee05ad0e91c5036e5cc67b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674090, "uuid": "15cde10b-52c9-4739-baa1-6fe81e377875", "comment": "Malware payload", "value": "c95302eefd5e0826c6222fcf528131c4918a57d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694674090, "uuid": "7af87779-f011-4938-8832-5bf799c16bf2", "comment": "Malware payload", "value": "fa5848d854f2501cb1d25a0476e0087c5bec890f7cde6c16adf764f7140ce07c6ace724de51c21030089ec973413abab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674090, "uuid": "e543ae4e-ef4e-4522-8c77-f38e4578dc72", "value": "T17DF37B1135C0C072D4A302761AF8EB31967DBD724FA25ADB77885E5E2B742C16B363A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674090, "uuid": "8b0fc809-2a71-4fd5-87ff-256550969658", "value": "de8bfe27b5af039c3e5ba3c8e35ce910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674090, "uuid": "4bed29df-e6cc-4a0c-847b-42bf395cdcb5", "value": "3072:5Fwje1HlJBkyuWlEpbFNrq+gV/mhXmsI4a:n+SHTBvpluXrqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694674090, "uuid": "4c1549ef-9f04-4768-80a8-ddfbe9e84261", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694674090, "uuid": "13c227aa-6886-4542-bc81-7c0d99713d67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694674090, "uuid": "5ce0c1f2-492a-4674-9691-554c241e2662", "value": "iceqzw.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a32d3dd-5296-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694651701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694651701, "uuid": "907d6984-a61c-43a9-8a5e-10d091704dac", "comment": "Malware payload (RedLineStealer)", "value": "74e6b02d595c744dd690fcc448fb17de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694651701, "uuid": "0f2e34e3-971c-46b7-98e0-25196b4fb795", "comment": "Malware payload (RedLineStealer)", "value": "d9d1149ed09d27cc4c31e172e9d0813fe3efe78dfd10ac4a56c0847aac7fd514", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694651701, "uuid": "5e6a63a0-bbbb-4d47-8e14-4265a3042385", "comment": "Malware payload (RedLineStealer)", "value": "362a9e4f86cce8da9a64cf8a71d34f2d453f959b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694651701, "uuid": "28a80411-36b5-4c46-b157-a76c425cfce3", "comment": "Malware payload (RedLineStealer)", "value": "3899adc8287a882ec30c338a9ef7389ecfdc643cecc8ed6519d55c6bcc566d33734f37e51715f84a9569cc3362f93370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694651701, "uuid": "8d8bd936-6f82-402e-9449-339950d00666", "value": "T1C515013170C1C033E6735536A8E8E7B9AABEB4A007515DEF23D40B7E0B195C1EA73696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694651701, "uuid": "3b994edd-88c6-4f00-be07-c27804885ecf", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694651701, "uuid": "100c46aa-0848-4833-8ed5-a3b6aa71a917", "value": "24576:GiuBtZsMZzO/eO8dP9rr3tM4IkKeVxkD98QCmbQxuwi43+OgZ:VuBfVZzOGOs3MXeHkh8QXQxuwiugZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694651701, "uuid": "4a0bb697-a2fb-4102-bc3c-5a16c7954cfc", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694651701, "uuid": "73c300b3-d722-4305-887e-74eb1d47097d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694651701, "uuid": "6d2527d4-de55-4e71-a9a1-a3870d12e6da", "value": "SecuriteInfo.com.Trojan.Inject4.61027.17086.4917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c4325f-5309-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694701089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694701089, "uuid": "0d7c3158-4a1f-4df3-b2de-f46f839583ed", "comment": "Malware payload (AgentTesla)", "value": "9fbb6deb53cda9fa2872257c7a9103bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694701089, "uuid": "2a2cf755-4c71-4484-97c2-359415f59322", "comment": "Malware payload (AgentTesla)", "value": "d9e76dc327aa471101e7f121a68f33eedd1dc4c984f7c354b46b7237c375231e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694701089, "uuid": "91225403-2563-42fc-8a1a-a34a30b14c7a", "comment": "Malware payload (AgentTesla)", "value": "0444d57b8d12a941f6fa41f2da1bebcdd711ef3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694701089, "uuid": "1c68ee26-c707-40f0-9791-217e3f4e5134", "comment": "Malware payload (AgentTesla)", "value": "604cc6f60c0490147c3402b640ec0653c1fe36bbd6b26283a814a847c98ef1d2a16d19f6ea5301a0a3bc81da48a451f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694701089, "uuid": "640b2365-77b6-415a-a750-fcc2bad41d92", "value": "T1BAB4AE9D369171EFC957C972CAA81C64EB60B4BB530BD203A41322AD9A0DAD7DF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694701089, "uuid": "94c4d8a6-aaa5-4427-9d75-373913d256f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694701089, "uuid": "62425009-f55f-4a69-af3f-bb7275d829cb", "value": "12288:lZYOLYQs8Ti+p7FLdmZuc/a5hXCQDYMHaPfpDTl:fLw8G+pxZeuu2CQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694701089, "uuid": "a5684dfc-feb4-472c-a55c-9dddacc596c6", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694701089, "uuid": "4f11d71c-1017-48f1-b8c0-396132d6f8f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694701089, "uuid": "f586cb65-cdac-4c6e-a129-8afcf04b7038", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec3c58f-52f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1694690900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690900, "uuid": "553602f7-e87c-4178-b2eb-2871b8b022d8", "comment": "Malware payload (IcedID)", "value": "84347a026ff8c8e0168f28cf62bd5691", "object_relation": "md5", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690900, "uuid": "8abd224f-2049-47c8-8630-3080e527c90c", "comment": "Malware payload (IcedID)", "value": "da10da7db6553074fe3de65c53de86972b6441df91109ccc2dd8f5172fc38899", "object_relation": "sha256", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690900, "uuid": "d7e1704a-2a22-4bc2-be92-f8f2eb7a1529", "comment": "Malware payload (IcedID)", "value": "836e6b889d3133dd828e9b3701ec2846b65e5651", "object_relation": "sha1", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694690900, "uuid": "9913f449-09a4-453b-b1fc-f724f62dbfb5", "comment": "Malware payload (IcedID)", "value": "91408cec77c3b396a46dffad608948faa7080209352a66a1d3497857355cbe6b6e569344008497b87464be4245a8e4a1", "object_relation": "sha3-384", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "laurellkhamilton-shubhmishra-com", "colour": "#E5362A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690900, "uuid": "75892afc-1ae8-4e6a-8d11-e38bca043cd5", "value": "T14A32BFD5148B242C9FBFE8F39DA49DFE7E0025C72C4144A9C544A58A6FC186977CAA82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690900, "uuid": "cf887438-4c9a-4cf3-8751-def4784057eb", "value": "192:x1YpBtEeaFKAbrWnRl9A1sHeIbrQikdazB/N634T/G3mrhmWzOTk42raB0PRQkNu:xgBCeaFKAbqRM15YNkdazEW/sm/t4OaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694690900, "uuid": "5dd32d3b-2771-4d27-8f26-d515d659e702", "value": 11367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694690900, "uuid": "e26bb359-b166-40a6-9e21-554370c8372d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694690900, "uuid": "404c5fab-442b-437e-b2cc-1c3cb3f6a0c6", "value": "Document_09_13_617.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671cf4c0-5320-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694710912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710912, "uuid": "a0d6b550-94a6-4fd7-85e2-0f3897838b1b", "comment": "Malware payload", "value": "dfd1ec1f4ec6b3034d19301e3af4d5e8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710912, "uuid": "a23e1a36-aaae-4cff-9b08-8fd295231e6f", "comment": "Malware payload", "value": "daa3e395535513b3ffd0b2d4279a8cc05471997d2c59157ffedc10fc0d93f9c1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710912, "uuid": "8b01bf4f-4043-4347-9cd0-286f4be5fca6", "comment": "Malware payload", "value": "718e720d27ff8d7d0ce886ee7973df6ae6c8b966", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710912, "uuid": "542b5dbc-a220-426a-8477-b56828fbddc0", "comment": "Malware payload", "value": "ac03771ada9c60d31da92cab53f5508ef3366c3ac381ba90df98b24323f59f07276a7a270facb4264188488bcbd4bb57", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710912, "uuid": "357a4db8-cb62-4ef3-9bad-119eb8c74c2e", "value": "T1CEA423A424775CB328B23CFF70E254056E1C23ABFA76522B8EE7449D2903A55C31279E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710912, "uuid": "c1613c28-cd24-4ecd-abff-42fb3e752093", "value": "6144:E++kbuLGI3qLdoBNTQMRdcT0+AlJ2Nwvtr9F3w6x7h5c9GWQBHpx616RN3:EfV6IaANQU8NwvV3wM7gINhpx61i3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694710912, "uuid": "cae47a60-93ed-4554-baab-70ea784707eb", "value": 471440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694710912, "uuid": "0cbe458c-02d9-4ed0-a791-044f1c5d3732", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710912, "uuid": "866bf041-681a-4470-afd1-c48fcdc931bc", "value": "Invoice_09142023_5038211086.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a889c9-52fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1694695641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695641, "uuid": "4ca8aad0-72c2-4d55-bf57-e0cde1e8a441", "comment": "Malware payload (GuLoader)", "value": "eb7f7daabfe9d8e686031e18e154e3ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695641, "uuid": "073e00f9-beaa-47fd-a0ff-5d261ea2ea44", "comment": "Malware payload (GuLoader)", "value": "db638fb5a94578e99cb5e74f5107076835b97c1956e48fff0c92e15377a6fd0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695641, "uuid": "f530d714-72eb-4885-85ff-7902ef1b9f5e", "comment": "Malware payload (GuLoader)", "value": "edd180f9db89fba9b5390413a2c66923ece146d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695641, "uuid": "252fd3a6-c5e3-4cd9-8733-116dd186f1f0", "comment": "Malware payload (GuLoader)", "value": "3cb6d550bea9140765c40f5f10a7b618d6b29ef4dd502deafe480131c48907c69bbf773226287e5be2ee40dc063d8742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695641, "uuid": "bcee52ec-00c2-4345-bb25-6b6cc6b00795", "value": "T1D3B4CF2EA54DC8CDDDC7267AC860358CF2B3468ACF4700BD13146E865FA9E39D564BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695641, "uuid": "ce5dc184-a6c9-4ec9-a836-945df44228f3", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695641, "uuid": "bf238ff0-77aa-4d09-b948-ac1eb47b8fee", "value": "12288:6htN9eLmJwHo/GhlZmGrjZ6DrdX3f758VSM8FcP8ugn3:GpeLmJMNmAjWHz58QM8mP8P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694695641, "uuid": "3b9c7ec1-5f08-497f-8268-5164e604df36", "value": 531008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694695641, "uuid": "016bb7f8-e31b-4a67-9315-dfc053ef0726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695641, "uuid": "86f6ee8c-15a4-4117-bd1c-48f61d37d7c0", "value": "Gallaforestillingen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bd8c68-5346-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1694727318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694727318, "uuid": "7af30bbb-5854-4b2a-9e35-2a6b7fd14377", "comment": "Malware payload (RiseProStealer)", "value": "686c33f353aaa476f68a8e124cf1d6af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694727318, "uuid": "9641e6b8-c3ec-4e47-89ae-e971f51b627a", "comment": "Malware payload (RiseProStealer)", "value": "dc48bc839225b4993d25e2aa787feb4a84c5701b605cc5556be20c4e2026b598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694727318, "uuid": "b2dd569a-d751-4c27-960b-16db8f419016", "comment": "Malware payload (RiseProStealer)", "value": "7d78fe59708ae8953faead95eacae4cdf4212676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694727318, "uuid": "7ac29fdc-bb75-431b-9640-c719dbcb5722", "comment": "Malware payload (RiseProStealer)", "value": "9c7066920f48587f3ddf88c8afc1dc2ac2912b50afd117b55c02d3d1dba1a98e5e262443277efb4602e7071bd5b153e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694727318, "uuid": "44166bc7-db42-4d58-a218-161152022182", "value": "T14FC41E9C326076DFC86BCA729EA82C64EA60747B871B8217941311EDAD4D9CBCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694727318, "uuid": "7219f814-c0bc-4e7e-a14a-2b3776f298e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694727318, "uuid": "92a1afba-f8c7-41b4-89b3-62159c76d76f", "value": "12288:mDjwnRpIL85mX7kiaGnlUEmrlJC/4ZDPA4a272dpUQIxEdjeOJWruqs/g0BOPIMG:mn5rnafJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694727318, "uuid": "2a46a13d-a3aa-4924-9edf-507fd073e317", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694727318, "uuid": "c114dceb-2333-4eea-924b-a32947dba7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694727318, "uuid": "0a9b64c7-2c97-41cc-ae83-32e4fd548a2d", "value": "686c33f353aaa476f68a8e124cf1d6af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1784ad7c-52cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694675131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675131, "uuid": "544d1bc6-7273-4c42-9d91-10f7dcd528c7", "comment": "Malware payload", "value": "609beb41faca4628f4513fb3f74e59a8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675131, "uuid": "be865996-455d-4132-82d7-6630ac571803", "comment": "Malware payload", "value": "dced053899d4ca0be0126761255d6fc06eb2ddbf72dcbb40b013faa1b2116d87", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675131, "uuid": "32bbcece-aff3-492d-8aa4-82ee7ea2970f", "comment": "Malware payload", "value": "b6ad901b6f63e08cb5c12f8c60162ed28d312471", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675131, "uuid": "cef807e5-2b03-478a-a2b6-d70ae257dcf9", "comment": "Malware payload", "value": "93ba5218fc2682d711c4aa29dff16d2740aadfba9ed982973740fd482190e3563da37d5baff83e1b991f12b302bc23fe", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675131, "uuid": "c6b3d63a-64c0-4928-bf84-d04725a6a669", "value": "T1FE33476D934F02A9CB565337AB161E4442FDBB7EB34152B2306C533533EE82DA1262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675131, "uuid": "1d3e7a0d-70dc-4dcf-be29-d1a02bb03d6f", "value": "768:UwAbZSibMX9gRWjxnZH16ZwShl07itMli+1J07dkiN:UwAlRAl12T07itMliQW7dka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675131, "uuid": "50eb4587-d416-43e6-a074-fc44587a3f60", "value": 51177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675131, "uuid": "0a03c539-857c-497f-9241-4b3f094f9e58", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675131, "uuid": "7782472b-764f-4c09-9a67-e33a52288179", "value": "UNDELIVERED MAILS 2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e01be48-52f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694693207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693207, "uuid": "3b2fa0a8-687f-4a4a-8478-495b8fe9e2ed", "comment": "Malware payload", "value": "97290ff755649e9b1c2f3b5d03d76e87", "object_relation": "md5", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693207, "uuid": "b0a1347f-72f7-4f26-8b63-f8e99dc97f8c", "comment": "Malware payload", "value": "dd3bd66ab94b92b2ed1e4b7bb0229098c2fe0f61bc085a8a288d95bb758e40c4", "object_relation": "sha256", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693207, "uuid": "39c489e9-ca23-4673-8836-2d5866399e57", "comment": "Malware payload", "value": "5801590111460f6ff6939ed7389719b0b1b40b8f", "object_relation": "sha1", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693207, "uuid": "12064842-2131-4662-8105-b5021a001821", "comment": "Malware payload", "value": "7414518835375d5dfe58a129dbb529d221d0a91e7d8232d4cb3255b50e02db05231ea531977b7a76c8855f3919bfc798", "object_relation": "sha3-384", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693207, "uuid": "996a0633-d2ea-4904-863e-020e110c223a", "value": "T188E02B87601D42E19166BC80D1B12FE4631B0E7D403885879399C00351DC88CB9BFFDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693207, "uuid": "de215a01-527f-444b-9952-68438eb9ee67", "value": "12:f3Nu08iin0taAZWK1Dt6WKNMfqd8VjM9f6:PNu08i+0kfK9bKNMe8VQ9f6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694693207, "uuid": "a02fa9bb-76d3-4e2c-a656-c3693f409d4c", "value": 418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694693207, "uuid": "be4bd41e-5e79-4670-bb24-1254b380b6e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693207, "uuid": "e88bfa3a-9b56-44f8-94b4-377f63347f67", "value": "commands.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6903e5b3-5335-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694719935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694719935, "uuid": "d1c51a38-909b-45cb-9bf4-8916affcb1d3", "comment": "Malware payload (Formbook)", "value": "de2f3feb626f6ac37b02d5cb103d1bfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694719935, "uuid": "4df9142c-135b-456c-9e1c-65231cdbb3dc", "comment": "Malware payload (Formbook)", "value": "dddb18b289be6a1b30073f701322dff91f799115407af51d733c0768ae407ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694719935, "uuid": "10346a2a-18da-4b76-b214-c91a81f2e2c4", "comment": "Malware payload (Formbook)", "value": "ec94b27cca577790e67401703b2b0caa43407ef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694719935, "uuid": "75fb9f51-bb70-4d52-b4f0-1a7d4b4533d6", "comment": "Malware payload (Formbook)", "value": "3350a27d42c40369de5aa8175046585c67eac568b39321e8bc1f178a32487941a4bd67b559eb2604b235da7495420f38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694719935, "uuid": "f4a4b276-43c5-4d4c-ac69-e2aeb846382c", "value": "T13B74A13D0F485F37DBAF7634FC87003959F0A12EAD46F6C6AE0899A1E59A34E7C01691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694719935, "uuid": "2e681254-a8dd-4a6b-8277-6072f095680c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694719935, "uuid": "0d8a46ff-6ca0-47f9-bf0a-224a771e07a8", "value": "6144:+18QW2YcScjMac45ENT68sG/GgDNVMmfrU:CWzcSco45EhzPGgZJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694719935, "uuid": "4d1a5aa0-5d92-4289-a864-e973a4206e8c", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694719935, "uuid": "a47dc2be-b69f-4b59-b886-3f90f763a7fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694719935, "uuid": "a311a5d3-3f18-45e2-a4a0-534e1da3a331", "value": "SecuriteInfo.com.Win32.DropperX-gen.3821.25987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3bcc78-52b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1694666894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666894, "uuid": "70799383-921b-4ba6-b721-93277bd1db34", "comment": "Malware payload (MysticStealer)", "value": "a3a5a611f6ff6881c85d40eb0c19de1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666894, "uuid": "70eeb15a-71fd-45d9-b969-d3e5079ffed0", "comment": "Malware payload (MysticStealer)", "value": "de6bf2ff993dcb41078e738fc9c0e4c99878eed83f76efbfe82e8c38d144445b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666894, "uuid": "e806b668-979f-4300-b150-c822f57c4054", "comment": "Malware payload (MysticStealer)", "value": "f623d1cb4d0adacd96347d39aa9d5313852d61e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694666894, "uuid": "aaa36253-ae30-462b-aba0-20632a54372f", "comment": "Malware payload (MysticStealer)", "value": "332cb590246e2395f982b22144fd8301d32c760c7d53670b8126963755995eec9232dad47274e4ed0bdf99bbd0db2ef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666894, "uuid": "7362e4c2-7f70-4963-9ae2-ba9bebc2a212", "value": "T1F674BF1036C1C071D9B1953B4AF0DAF9952DF8911B7FADEB27A40F6E0F206D0EA32596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666894, "uuid": "a9dadc24-64bb-48cc-bd6a-08a0f8020b82", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666894, "uuid": "e5d35013-0f59-40ad-a6bb-0c61954cf626", "value": "6144:eXHiKL/yfYb5B+BO99c0s0ZVtAO+gfX7rByuvQzPtxXZcDd4CQHPSxE9:KH//yfYb5BIQZVtw47rB9IjtxXODdVQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694666894, "uuid": "ffe76584-80fb-41ac-bd0c-1b3d864a0878", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694666894, "uuid": "47c2a3f7-08bc-4b4b-9049-d59b6d08a166", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694666894, "uuid": "52dba423-1aa6-4ea0-ae69-8e033f1f2302", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c407f9-5320-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694710940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710940, "uuid": "11349a7f-b00a-4104-946b-4d3ad3003514", "comment": "Malware payload", "value": "24c5f4868dc5af255edbb993d98de51a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710940, "uuid": "d11ca3a6-3119-4069-a65f-226c4259b1ee", "comment": "Malware payload", "value": "deac11f26b14676e7fa98bff505360b8fef4f69183c336f5263bdefcf0bf797c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710940, "uuid": "f1748406-0d1c-4bcc-bd65-3cb7b46ef675", "comment": "Malware payload", "value": "9c806fe0d7d947e2f0a3389b949d46468f90cbb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694710940, "uuid": "ae67290d-438d-4493-ba80-4fbfe84d45a6", "comment": "Malware payload", "value": "ab3fa25af4818d8c3a4dc48e12b9379fdb9b8f9f4bdf3e5176c8db3969523f61780aae43065ff80f4891589aa8c99d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710940, "uuid": "f7737927-08df-4fdd-8650-5b88fb85b321", "value": "T13A364C27B7A89451D577C238C7ABDA0BD5B2B465033583CB22D69A2D0F33BD91A3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710940, "uuid": "94a70c7f-904c-456d-8bb1-2e197fae85ab", "value": "6ac0494255f289fa08f5348c7771941f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710940, "uuid": "4be383f6-951e-4002-91c5-54ee588783c1", "value": "98304:mgme27SXUqRon5gyJHNuj+LhryFl1qqAIw1IpqTrdsR+:mgmeSSXUQon5gyHuj+LhryFl1qqAJqpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694710940, "uuid": "4ac1c682-be1f-4a10-96f7-9440680fd040", "value": 4901888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694710940, "uuid": "36dfc2b0-ffa6-4eee-a48a-96a6df187d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694710940, "uuid": "78fc7339-934c-4105-9e87-c66a7cd5cd3b", "value": "d17b28d9d2m9od92.avi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25f68bc-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1694703281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703281, "uuid": "20a4d213-6c66-4b26-9a01-5b474eb02596", "comment": "Malware payload (AveMariaRAT)", "value": "935ac5849eba3feadbe8ea485f5ba164", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703281, "uuid": "6d1f5ff4-c065-4684-ae43-6b36df383c11", "comment": "Malware payload (AveMariaRAT)", "value": "df8bcd2f1744f7e1bc88aa03d3b002fafbf757d1a7d96b1366ce2750c45cee77", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703281, "uuid": "60b9f4bf-e3e2-43d2-b05e-725d2c0d8a60", "comment": "Malware payload (AveMariaRAT)", "value": "139beeb49b3479b5f3c722415ea12379cbc6fdba", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703281, "uuid": "02313250-2344-4b14-86a0-03fb3e274f0a", "comment": "Malware payload (AveMariaRAT)", "value": "9bfa1eeee14a516e6040ee72a0ffb1191fdb4eee14b1a65a6eff524c3d0456e3ffcc241440664e4a6002b92942d65fe5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703281, "uuid": "837a1e6c-81dd-4ff5-98d6-0f4c0403fad1", "value": "T13D6533C35E921854E27E77360736CB60BC917DAB794E63BA018D9F0D0E37132BBA5250", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703281, "uuid": "7a1a753e-49fe-46d6-aeec-a94c5cbd89b0", "value": "768cce1a3135ef56ac91aeb097edfe55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703281, "uuid": "b39ab431-f35e-47a9-afbd-83fe06dfacd3", "value": "24576:4a0I7HsKzJPjTMEhj1DCgaJGOwfRpmAcrdD90G9wBG2+u+l81HkmCaUpR:4a0I7HbNTMqj1DA0fvmN7mrC8Vkmen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703281, "uuid": "1a6ee0c5-aa45-4ed9-97b3-1b94c49325f1", "value": 1417440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703281, "uuid": "b9d09423-eb3e-40ee-92b2-251fbb628ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703281, "uuid": "428a91c3-c383-4eed-8e77-ed2529e0fb7e", "value": "charlesschwab_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef0edd0-5341-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694725233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694725233, "uuid": "475a5f08-2bbb-4ce0-acc3-f94bd7566ec1", "comment": "Malware payload", "value": "ca6a86cf44cba77d9d8e70b7ad9e93ae", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694725233, "uuid": "8d80c791-376e-444b-b032-19f75f21f7b3", "comment": "Malware payload", "value": "dfaade073408475f37283ad272efbcad4b552fa6ca252065bce0d68a23730c77", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694725233, "uuid": "a650aeb0-f083-47ac-a142-2be0d9466282", "comment": "Malware payload", "value": "c7dbf8aeb60aab729f5def070a1fdc69522ab6e0", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694725233, "uuid": "ca1a44dc-13fb-43e5-9fa4-4d6263843948", "comment": "Malware payload", "value": "9a237b1aaac29b32ae0f6ef845354d344afeb52a44efa7676dd43b377204b6064b7053d840c3cb12f6d8608129d2b71f", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694725233, "uuid": "e776ba47-6a8b-46c5-aa96-b0bee51c4607", "value": "T1F1F20119B2D54D241DC69927D18FBC186C3043F81098EEE4F4AA93EEE10F66BF9914DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694725233, "uuid": "0d179b64-554f-446e-ae45-e1a9e8d3473d", "value": "768:m+jBMPKo6RU4YF4NGxmZJCOsSJ6cWNeAgv59xZNblO:/FMKs4NeO9L4cWtgVlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694725233, "uuid": "90f281fc-7f11-444b-bd04-e4ed0dc97ff6", "value": 35684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694725233, "uuid": "90a2aefd-c5a1-4ac1-a39d-80ab33aecb26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694725233, "uuid": "f7e09f74-7abb-4b7b-b7c3-82480bd49310", "value": "dfaade073408475f37283ad272efbcad4b552fa6ca252065bce0d68a23730c77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc4c887-52ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1694696990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694696990, "uuid": "889d843a-71cd-4ffd-bc61-03edc504295d", "comment": "Malware payload (LummaStealer)", "value": "3a198a130c1d6eef33fc52d39d83347b", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694696990, "uuid": "e75a2348-3e15-4ac7-80be-7f67a6029cfd", "comment": "Malware payload (LummaStealer)", "value": "e041b3eaaed1c0ad37e7f91717ee5b0e12e922b67bbe1e69a4c68c80baf22b4f", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694696990, "uuid": "2631413e-cc9c-4449-8d2e-2e41d1044545", "comment": "Malware payload (LummaStealer)", "value": "6c92b9730ed0d7b43e0fb6f9bf5bf47aa0fd7cff", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694696990, "uuid": "2196a918-91af-4712-8603-0e4a157505b0", "comment": "Malware payload (LummaStealer)", "value": "66efb0afa1c370e820c01b68e3d4a7619ed17580de3318651f36b84a61e9bcd1975ad6aae28cfe70094fe93f1f45a250", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694696990, "uuid": "1f562433-d046-4193-87b2-d821395c4300", "value": "T1C6571231724AC52FD96211B0192C9A9F512CBF760BB254CBB3DC2E6E1BB55C21336E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694696990, "uuid": "197f07dc-0fb9-4fb6-a289-f4d8f475847e", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694696990, "uuid": "c51736d4-8483-4cd0-8454-3b9f86363f07", "value": "393216:tZBosOBrX0KMw4DHrIkpMmOVB0txBAVxxCfpO85HtIT8yA8FS7QPPuvNGYFlPx:3OOKzyr3ynjNxx0pdNTyJSwPMNGYHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694696990, "uuid": "7a267d65-1b60-479c-87a8-189be60b8fdf", "value": 27759992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694696990, "uuid": "5243039c-7cd0-4e44-8c0d-665fa9d61ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694696990, "uuid": "d99d2b39-afb8-425f-ab3e-bef2635e9df8", "value": "\u0421hr\u043em\u0435S\u0435tup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b4d4db-52ef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1694689912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694689912, "uuid": "86437bdb-ba96-4c60-93d4-657cb76feb07", "comment": "Malware payload (Vidar)", "value": "2edc8c65202a68d10cb4d775ba91ed1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694689912, "uuid": "89f4cd35-5288-4a12-9cec-7d06ff2b2693", "comment": "Malware payload (Vidar)", "value": "e0f76fec46d5a367fdec67bfef123cb3ab7c6d7edf2efd14ba4c9b635dc6e34b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694689912, "uuid": "5507c8a7-6cb6-4dd5-afae-8169cb1515fa", "comment": "Malware payload (Vidar)", "value": "5cee7ed20e4d49778c8a7ec88f9b24c395fd7f97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694689912, "uuid": "88feb190-c5ce-4ce2-858d-048991ceab52", "comment": "Malware payload (Vidar)", "value": "dabfecd9938443cb9a995f6c5149f1ff738368a6936f831f16df3b0c313a9b6c2d078280bbf59fc8bb7304d3911f43d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694689912, "uuid": "e389eaf6-d12a-4813-a28c-7a97a91d6de8", "value": "T185647E16B380E432D2535939DE6AE3734BBF2C7228255257FFC415AE3DB06D29A2434B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694689912, "uuid": "ede6fbc8-0f3c-4bbd-9e6c-c4aa11491306", "value": "f2222f0f215a06acc111aee4e181dfd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694689912, "uuid": "8e5e9311-24e2-4e2e-8f29-1af60f781fda", "value": "6144:aLhLW8KrV1R/2XJtCTHI41wuBdqv2UxgueIseSq7Lmh+br:4horV1p2XQZMv2UxgueIsG7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694689912, "uuid": "ad7866d3-ed01-4e51-ae8e-f661df610769", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694689912, "uuid": "cd0922fe-0898-442a-8f45-2769892443c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694689912, "uuid": "1a88a2b1-8e67-4a35-a974-fed611576037", "value": "2edc8c65202a68d10cb4d775ba91ed1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dff9a5a-52de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694682443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694682443, "uuid": "e76a553d-8c17-47ff-9f22-528a6d828dd5", "comment": "Malware payload (RemcosRAT)", "value": "a9043d3076b686752d995bd7426c05f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694682443, "uuid": "27e9b2f0-06bc-441b-ba08-ea7333103982", "comment": "Malware payload (RemcosRAT)", "value": "e15677ab90ab5cb707c87420cb49c733d5948513cfbfd152470a03942effc9b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694682443, "uuid": "852b8113-019f-47d0-98a7-ca1c037dfce0", "comment": "Malware payload (RemcosRAT)", "value": "9667c8bd5cb1ad776814287f4019f5ee7f0823e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694682443, "uuid": "d5fa6d14-8de2-4ef5-a2c8-4983dfcddbc7", "comment": "Malware payload (RemcosRAT)", "value": "538e8d95ae1e84e82d8103871f5eeb99ac422c74baf333febd5f4cebd92ba8e4283b42c77e88f96c8ecdceb5d97627de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694682443, "uuid": "f89426e0-8211-447c-ac80-c82412562462", "value": "T1AC3412641721E956F0E0D0BCCA84E8F25AA97C602D8B6E1E47ECFF17F917042A7CE156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694682443, "uuid": "45d7f9cf-55d0-41e5-9b7f-94d3b1f903d0", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694682443, "uuid": "df422b78-36bd-4751-afdd-cfb39116f800", "value": "3072:MOSI2I7txG68nYrugMZJMfsciIpuKNtrUQlAK3qSjYPS+IAXb3Ixi5eFrgurIlNf:dvG68YrvM80ypnjAedo3qiGUY2ChzIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694682443, "uuid": "7ef714df-166e-411a-bf99-e5ff81e8eb26", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694682443, "uuid": "075d3b3c-34bd-448e-b6f7-c4e0b76531ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694682443, "uuid": "8c3b8fb3-4cfb-4f4f-9dc2-fdaa75d10a7a", "value": "bPIo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b18358-52db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694681458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681458, "uuid": "04f388e3-4efb-4b4e-90be-19bce38f71bc", "comment": "Malware payload (BumbleBee)", "value": "a6ac1a8bb63362ed7515f2ca02fb52be", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681458, "uuid": "44a0ad9c-cfdd-483e-bb0c-daeb1669e2ac", "comment": "Malware payload (BumbleBee)", "value": "e1dbce8a89b5fea0f3cf6da9560fd573dfe9c93c5d6d8d2fef8902a3589cdf15", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681458, "uuid": "1ff9a59e-e656-4936-9a32-f78e0217d18d", "comment": "Malware payload (BumbleBee)", "value": "8781347d2e723f823d5b996bc22389b14a4a72c8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681458, "uuid": "340d701c-fd98-4558-948a-09eda79b1af7", "comment": "Malware payload (BumbleBee)", "value": "6497a5d6bfa2ba89b2d0dd6fff88bc3cbbbc5218fac6103c94ba9f79e059a7e7ad149cdca0cabddce2f3e7aa74df863c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681458, "uuid": "ee576c27-bf29-4a84-841d-73477de022b8", "value": "T14235BE61A276A777F737F53B08BEF839560036E66273BB57101936831072682EEC750A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681458, "uuid": "2707535f-b4a2-4aac-9902-9194a1cb477f", "value": "660e4ba65070c42e55f04efddf5f7d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681458, "uuid": "4fafd9ee-cda7-456b-8443-7eb850c7d5dc", "value": "24576:K40kaG+iDe5cMQW7v7+KIUC/ofj1fpLgN:K40kd+35cMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694681458, "uuid": "49ab2176-6baa-42b4-a31a-3e3d2263937a", "value": 1119744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694681458, "uuid": "4e8c2390-2cd6-41d8-8c25-6735d5c716ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681458, "uuid": "c36d686f-3fe0-41fd-a5f0-d052614029a0", "value": "a6ac1a8bb63362ed7515f2ca02fb52be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a20ab2-52f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694693218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693218, "uuid": "fd38cf4f-bb71-42f1-b249-7640db98a963", "comment": "Malware payload", "value": "f21f915bdbdc1694ce11a2d1b0983e7c", "object_relation": "md5", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693218, "uuid": "df1caae0-2b17-4abb-bf66-df863dfcdfb4", "comment": "Malware payload", "value": "e21d8d6a1917b00b0a6f2c284d705975e5ad73bbb8966363c4742aebad847a0f", "object_relation": "sha256", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693218, "uuid": "5472782b-5533-4cfc-8b38-f8b4ba481cd0", "comment": "Malware payload", "value": "ee41193018c4a1ccfd2c6bb352e27495f56c4146", "object_relation": "sha1", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694693218, "uuid": "5c35e62c-9485-4be8-9f3e-9edaed166876", "comment": "Malware payload", "value": "fe867b799a5583377682c4e2de929a141b863c758451269dfe3a63bee366eccda02e75e90dcc1c2145ac1ab5923b7c41", "object_relation": "sha3-384", "Tag": [ { "name": "89-23-98-75", "colour": "#90231A", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693218, "uuid": "15d780f2-14d7-4502-86e6-a934344f0eb4", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693218, "uuid": "46acb1ee-ca39-4c67-9985-815b15ec1ac4", "value": "3:XdKIkA6gYAE:XIIJrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694693218, "uuid": "1373ff3d-6207-4d6e-ad8c-640c4957e865", "value": 34, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694693218, "uuid": "5375ed38-bee6-406c-9656-32e02cd212c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694693218, "uuid": "c490472f-92dd-42fe-990e-ffe796bdd276", "value": "g5t8FWZoM5EcOpl7kneLC9aiuabwfShZpsnMriuLFetlN3PXlGgtB1XQ2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03a8b1a-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694703304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703304, "uuid": "5dc1dd61-6fa8-4de8-8d10-459c45253d67", "comment": "Malware payload (Formbook)", "value": "e86903f6b008cfcc26205c6010a19840", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703304, "uuid": "5740bfd6-4b81-4103-a18e-9359a2477bab", "comment": "Malware payload (Formbook)", "value": "e25e4004eeb0f9cc80c554cf0c75c4fd4df2f0b64d808a70b40aa861ece1e626", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703304, "uuid": "116b2add-c342-42c0-8a6d-c0e8297e45a1", "comment": "Malware payload (Formbook)", "value": "dab50ced5f56b4a26e1b5b9b891f2ad2290623f1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703304, "uuid": "b4ed5af7-23fd-4f7c-9f69-a58c03deb5c4", "comment": "Malware payload (Formbook)", "value": "5561530ce52446839d8348745ef75e130b4dc15a37ab8d775ebddc58055f6d93ea3ae07b27d45e67d129cc907186ea62", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703304, "uuid": "b933834f-bee4-487c-8957-2815559209c1", "value": "T109742316782F480C7AA4FA0B390D43ADB14A54A7F6BB0FA0E05A93DA489035C4BD15FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703304, "uuid": "fc3a339b-4d2f-459b-8046-a96cb8a1073e", "value": "6144:+Iec/vLEik2yLP6hdZS9d8NBvIOa+8aqOWQo2ldBOKyc44tm3YUn9J:+IdwikRYSH6R13dBD4omx9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703304, "uuid": "c1df03fd-f3ae-496f-a932-83faee970871", "value": 352644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703304, "uuid": "b2ce6dc5-9d10-4d6c-ae21-ef3c03cc4f4e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703304, "uuid": "df21c293-f7df-4972-ad3e-fa364dfca977", "value": "WIKA Instrumentation (M) Sdn Bhd - Request For Inquiry.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b496f3-5292-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694650047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650047, "uuid": "9ad779c9-3217-4bb4-ac26-b19709aeb9cd", "comment": "Malware payload (Mirai)", "value": "373ea96cf3c0a5d4a73b207fd6ae7b21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650047, "uuid": "772980c1-673c-4788-960c-fa095e7580db", "comment": "Malware payload (Mirai)", "value": "e465928a76d184640db3364b3df85a240c2b9053525affdf25bd2596fd65ee4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650047, "uuid": "52e5a8c5-1ded-449a-836e-badf4283fa13", "comment": "Malware payload (Mirai)", "value": "73c612bf4cee9120f69dff42fe69879de2acf178", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694650047, "uuid": "dae79cb3-35dc-4c17-a109-3f7024b33b1a", "comment": "Malware payload (Mirai)", "value": "c5ecb5d9e8e4347862205696cc3d73edc967b34ada829ef0cb1033f4242c6df1ce333acfa2b480edb659ef9421ea329e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650047, "uuid": "4b459a56-0786-4032-a740-7ddc7e65aa46", "value": "T16F734CD9F4028E3CF98BD5BD94160E09BD2023D567970F27E6AAFDE36C731546A02E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650047, "uuid": "dd4a69ae-ad77-42a2-80cd-491dd9242157", "value": "768:0ecNzmQtwZGB23gdj2a3tmRikohDvtAhOXuK8ohUJE3k7YrTer4VfOkspJH:0Wi23gdiCp+K8ohnk7Yrar4V/8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694650047, "uuid": "2a8d598b-76b4-4d76-b557-80bb939fad19", "value": 75920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694650047, "uuid": "8d8c7473-49b2-435f-9faf-911701ed7cf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694650047, "uuid": "a49bfa10-c6a4-49e7-8ad4-6ecac8d18343", "value": "373ea96cf3c0a5d4a73b207fd6ae7b21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddf1db2-52fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694695516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695516, "uuid": "125e2e81-bafd-46c8-b8a3-635cfc05c58d", "comment": "Malware payload", "value": "74669d465a9e1e490d00e3a438dc9470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695516, "uuid": "fdd1bd35-3752-436b-9776-2dc194862001", "comment": "Malware payload", "value": "e51117021d1f8500f261924fcf99ded8ab54439ebad707f53ad3b576d9a3aa58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695516, "uuid": "0fded77f-5456-4368-9e14-bcccdd25a88e", "comment": "Malware payload", "value": "2cfcb195a01817d73a66909120ccd0474198eb56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694695516, "uuid": "8b4926dd-cfc3-402c-81f5-6231d2d4a6c4", "comment": "Malware payload", "value": "d61375574c183b17121890b438f2b60abeb74b788d7d434c47d972840d0424d161c5bdd1be7ca3f69e69d0d5068e1fc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695516, "uuid": "5d2e8479-c727-4206-986d-5177f80eb6e7", "value": "T169A623F97BEE9D89C06426300E3D4F2A41ACFD3195598225141A3E4DDAF276D68E0E3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695516, "uuid": "d397b1be-9787-444a-bb6d-210cb3dfd052", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695516, "uuid": "83f9761b-508f-4825-85f8-ba161db90d17", "value": "196608:GXI0gAar0df0iv4spFZ9W2yU3LKpt3Oj1PXi5K:GXI9jrgmAJW29C3OBy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694695516, "uuid": "5d31c5d7-3f42-4aed-9f65-90a51ef69687", "value": 10090496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694695516, "uuid": "e9d25428-114c-481f-97ce-a5f7b9da898d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694695516, "uuid": "974e2817-1ea6-4783-8171-de3b1411005b", "value": "\u7535\u8111\u7248-9\u670813\u53f7\u6d59\u6c5f\u7701\u544a\u793a\u987b\u770b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e81803-5310-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694704282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704282, "uuid": "12580616-6e5f-423b-81e6-b9a0a89adbd8", "comment": "Malware payload (Mirai)", "value": "5ff1ad1ebd8536546bc5f58ed14d2ded", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704282, "uuid": "1e8a4c1c-02aa-4f76-b125-c50a20cb7df1", "comment": "Malware payload (Mirai)", "value": "e652dc3da5a4f36cb2ae90b948392a369581f82012f4e111c4ca4dd84c3b6dff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704282, "uuid": "26b686fd-8c9d-4fc3-ab27-316f22bc414e", "comment": "Malware payload (Mirai)", "value": "c88877765028ffb0bb23a600b005a36d7b429ebf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704282, "uuid": "a8a1d566-5f34-4212-8898-e04239273702", "comment": "Malware payload (Mirai)", "value": "766206336132522417a95389e28c6b41e97570ee7fef8ceb347f2222c7456dc501920eb8d87ae0619973535cbafd967a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704282, "uuid": "a8cb9bee-4b8a-4437-b25a-025291169b07", "value": "T193B2C0CD61943084CA8D7C7C1B8D4A664F6CA190BAEDDB26E354CDD4B3BEA4B3459078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704282, "uuid": "37257569-313f-4dc3-9183-1bee0f304309", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBph8OZqEWvL:/QlS07FUXqIYSXQKquh8Cqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704282, "uuid": "bda51c12-d95c-416b-bc51-a057b9d09097", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704282, "uuid": "770e89bd-4d22-4f3b-820d-ec37b868fdbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704282, "uuid": "97a8133b-afff-496d-bd96-8ae1302dd8fa", "value": "5ff1ad1ebd8536546bc5f58ed14d2ded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690c57a6-5332-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694718647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718647, "uuid": "e51ce50c-877d-42c2-b887-d52a34cc67e5", "comment": "Malware payload", "value": "b0193a0c17766be6ff5eeadb3d95f41e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718647, "uuid": "4e6b64a4-2f99-4728-8a19-7684dcd2e8fb", "comment": "Malware payload", "value": "e6ae10268ebc4709a77cf10876a0fe47325b2bab2b2d26e6a831983ad3510e92", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718647, "uuid": "e8ce0d84-6774-4522-b263-411df2b7fccc", "comment": "Malware payload", "value": "94bbaa5315e0de5f6de12964a02e9573c3d51e3a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694718647, "uuid": "bb8c6702-dfe3-4bd5-8107-926363b18ab7", "comment": "Malware payload", "value": "5c8d2bce17e754cdd7a55588be744e51dcb80335b8d590414320c1c6477afdda02026baf5a0f00ab754254c89fc5f20f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718647, "uuid": "835d7182-d6f7-4e83-9439-3790a2706a51", "value": "T12BB2BF2CD502B514E9678EBD846C01F2FE5D404AB7D0B3FED8E97AE948804DB136B54A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718647, "uuid": "d0ce1280-533c-4e4f-93bd-35e99d6993ed", "value": "768:s5ft3ZqdOXpRSQyLsxlxllN6Xlx3at1lHDiu+I0oE:s51pqd2R/yLElBOx3fll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694718647, "uuid": "33bc55f5-c660-4686-b310-9df82633b711", "value": 25512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694718647, "uuid": "fef8099b-b2c0-4112-921d-ed7b8889310d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694718647, "uuid": "0f59cebc-21d2-469a-8cad-c48001679e7e", "value": "COMMUNITY SOLUTIONS INC CT 4 2023 .docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a129e247-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694703279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703279, "uuid": "289b1722-1975-43ec-a96e-11fd0f260af2", "comment": "Malware payload (Formbook)", "value": "69214fdce601764268282951f3aa52bc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703279, "uuid": "94ae04c3-8adc-40ad-9e86-18a2dea3aff8", "comment": "Malware payload (Formbook)", "value": "e727ce3146b5ff846da325eb16cecec5aa231784af196aa70daac4213ca6d038", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703279, "uuid": "1212bf42-b505-4159-b290-c0f694053b87", "comment": "Malware payload (Formbook)", "value": "82e26eb599194f4245303c3c5369c59085168d5c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703279, "uuid": "318d55d4-47ec-47b1-adfb-843261af2bdc", "comment": "Malware payload (Formbook)", "value": "ff32aaeb9cf46b8c3bf2125e96fb6b2092fa8b15872ca06831684bc43cdba238b79e9f2406f0a7553f7c3f7f031d67a9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703279, "uuid": "3a247082-5219-4c36-9896-378a9308f35a", "value": "T14E94232DA26299E57F102AE303C3575A261E78DE612D7EDCE1359B3F107DB9BC232025", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703279, "uuid": "539e87ee-af44-4c1a-85aa-82f80f075ddc", "value": "6144:tGiU0bIBnJ2c6KXndnwGo3u8n+C3YpvS4OeIfoW/4uluIed5Ki2vwTYQbwtQ:t1U08BnJ2rKbuWIfYukI25F6SDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703279, "uuid": "d0bdb024-7f8f-40c1-bb56-a98c9d9c3a5f", "value": 414955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703279, "uuid": "d99169ed-e64f-40d5-85f2-1c741e920a32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703279, "uuid": "e8aeb219-eb6c-45d3-8659-f8e45a20eefc", "value": "0037827362762.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66f2d96-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694703288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703288, "uuid": "624e0b4a-bb29-4e2d-9637-0d95cd8e4a3d", "comment": "Malware payload", "value": "3cccdac28500a7bbd2e5d47d231a5c44", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703288, "uuid": "2f509337-26df-474c-a730-32438711d82c", "comment": "Malware payload", "value": "e78dfdd56b50781ddb0114479a2efe0e2f9e4e663ab48ddcc26d6cee39dca08c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703288, "uuid": "ab3c46ec-3868-4622-b886-b3482c992806", "comment": "Malware payload", "value": "d49018730b2213ef4ff40b76843943f48263cbc5", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703288, "uuid": "37d4209a-ad57-4a79-ac0b-2d15ec93e913", "comment": "Malware payload", "value": "647965e90b380af3e00dd4e3704e1370cbe153ed0f9d99b516d44af8e2f28952c4d43a70b4954f1a15a72455c1ddd943", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703288, "uuid": "c318ac4b-dc56-4918-a609-ed2fc7c5c00d", "value": "T11FC42325E47E9FC98427DB6C396CCCBF5CD054A09F11D69CAB4FBBF44AA0C49B989120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703288, "uuid": "6b97927e-c7ae-401d-b7d7-a7c5461aadd0", "value": "12288:ya4rD5H9zed6J1QXqIKwYTk2xk+b4K5AIu2nnPI1I:ya455ed6JgKvDxFr5AIu2nQ1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703288, "uuid": "46842807-8124-4b71-a0b9-6e70f07f0bc3", "value": 557457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703288, "uuid": "500250e2-d234-426d-876b-0d4781190440", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703288, "uuid": "6fd909f7-0ab2-4519-9e9c-55c1f043014b", "value": "Order listr_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f22c90-5318-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694707656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707656, "uuid": "3c3c0557-3045-4e53-bc3a-0c244fa99843", "comment": "Malware payload (AgentTesla)", "value": "476ecc9effd8ad177c15f642fa058682", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707656, "uuid": "230bd502-20d8-4ce5-b699-4009e1c3a6a0", "comment": "Malware payload (AgentTesla)", "value": "e840cb2a1c0451789b6c1b1565a75976bdafed728d435252b324d6800df5ff59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707656, "uuid": "fc115e18-2858-48b5-acb2-f47d242430b3", "comment": "Malware payload (AgentTesla)", "value": "18d07cabe2d0de7e090c180a282b6422921e070b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694707656, "uuid": "e869e47b-4c54-457c-8403-ba10fbbb8d6c", "comment": "Malware payload (AgentTesla)", "value": "d150e28b9c6c1171ba6f976d8cd790d2b88b9375b387ab1807ec72ad78195f0528a1e930f73a26b9f8e3c1b779215c97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707656, "uuid": "766bef38-36dd-43e5-8fe3-b407822eb75b", "value": "T11FC42341215EA531C9ED873E42D50D9917B8C7E17A2BD72E8FCA531A2E83B120FD934B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707656, "uuid": "70034d39-9740-4f9a-a8cd-e16b03adef81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707656, "uuid": "c831934b-9026-42ef-bd9a-2a5aaadc7638", "value": "12288:dHj8FwLm/c2mVOO2QUFmBP4EqRvzXxOTWZRXb15R0rS2cCPDGjRBIVB:dHj8F6+uOODKv/ZB4k5bt2lSl2VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694707656, "uuid": "e1adcf3b-9e8a-4ab5-9fe8-015f3ef52a6a", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694707656, "uuid": "2f359963-82aa-49dc-b621-89d1b9f27c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694707656, "uuid": "7a7088c1-f6e3-4788-9165-10f9e1491d78", "value": "invoice no 214275.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85e255c-52c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694669924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694669924, "uuid": "f120784b-a3b2-453f-a2bc-0ad072af424b", "comment": "Malware payload (RedLineStealer)", "value": "08fe9cc7b2f968e8f9be45ac01223ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694669924, "uuid": "ec4b9eea-5908-4b33-b783-5f0d274a3c72", "comment": "Malware payload (RedLineStealer)", "value": "ea417591b95ed8ffd4681b706e995119dd1b38b00b65d778b74c592eedc7b172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694669924, "uuid": "8f3ae9a5-facc-42bf-96fd-94704dbdffef", "comment": "Malware payload (RedLineStealer)", "value": "6467b26767273c07e05c2de379dac3bafe9efb14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694669924, "uuid": "b113627d-feca-4ce9-aabc-4c0e9ac5e0e1", "comment": "Malware payload (RedLineStealer)", "value": "b7f58341fe2d3627853d76dfa37412ef9efcfe063e362ea10298c7c6e801be0d340ef9fea09a41232ac2831ce2d1367d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694669924, "uuid": "d9237b28-6a5a-46c1-9dfe-1ce4517fda27", "value": "T18915014275F18033DA72963145F8DBB19E7BF4604B669CFF23940A6F0F292D2C6B2952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694669924, "uuid": "8967e917-43f4-4730-ba2b-25c4a62c0bdb", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694669924, "uuid": "b35eddde-c50a-498a-8a7a-bd1b58309c78", "value": "24576:iiuBtZCA3zwgr9LYbX9qmHCXwpvQkPG/UDxuBf:5uBfl38uY3HJlLte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694669924, "uuid": "4b282ad9-d98f-4d46-8d89-1897b8767610", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694669924, "uuid": "32196f7b-d13a-4b27-8232-c13fa16259dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694669924, "uuid": "66257fe3-206e-42e1-9370-da80939c0ffd", "value": "SecuriteInfo.com.Trojan.Inject4.61027.16442.13705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea18aac0-52e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1694683644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683644, "uuid": "394a109d-7d6d-4733-82c3-3cda614630b4", "comment": "Malware payload (RemcosRAT)", "value": "4f25f6ac4bd59dacf97d31ab541ba796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683644, "uuid": "fbea906d-f715-443c-9614-f0b50f00ebbc", "comment": "Malware payload (RemcosRAT)", "value": "ea7eed758fff9abb8044bffa0bf0a0fe8865a10ea1124d245a9f1b39725429ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683644, "uuid": "dd375505-fabe-4bfd-9cc6-4df8700cef83", "comment": "Malware payload (RemcosRAT)", "value": "990b82e6e11a1cc83fa77ecdf4a5bf1602b4a077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683644, "uuid": "e4a20ba5-0073-4698-a139-e05e4e938ca4", "comment": "Malware payload (RemcosRAT)", "value": "284c1d69c834db2ffb22f7912700809969c25cec8764ce144e6f830c9be8eb98ec54e1f31877e57fc040f64e68888f88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683644, "uuid": "665b8563-18f0-4ad5-842b-381e1e8a6879", "value": "T18E15234137A1C3B7DE586B7250391CEB0E60DF6551448E02A7A5FE8EBF3A7D218452CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683644, "uuid": "0370ebc2-fa30-4aca-b9cc-63cd844ad1e7", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683644, "uuid": "3407db3b-fe17-44ab-82c9-88dcb5ef85f4", "value": "24576:+yh0sqZm70sRgPWZ5QPYpSyI3kUGhb36V:VvnRcHqthHtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694683644, "uuid": "4819b217-ff0a-40cb-89ce-efd60ea5c866", "value": 894632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694683644, "uuid": "e3dc9f5d-56f0-4ae9-9b53-30ff3c7fb437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683644, "uuid": "bab6bcbc-4f4d-45fb-826c-3c3ae7bcb20d", "value": "UPDATED CUSTOMS AND TRADE POLICY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271f2187-533b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694722401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694722401, "uuid": "b52ba908-8a7f-45af-b30f-915b33d13fba", "comment": "Malware payload (Mirai)", "value": "70d1244a8f13a6211e56a9f625b5593d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694722401, "uuid": "80a02a8f-59e3-4c43-bfbf-8354f144d1be", "comment": "Malware payload (Mirai)", "value": "ec6e5dc94fcf25ff6329acfb4e4110d4c418c2b244fc2553e3a7913b645aacc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694722401, "uuid": "a2c8d952-3a6c-488c-b03b-4b4b8bfe2fdc", "comment": "Malware payload (Mirai)", "value": "0d45abe23d06b03a830f3439c2a73c9a392a670b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694722401, "uuid": "90b818f9-b69c-4576-8b3a-ff5642db0a26", "comment": "Malware payload (Mirai)", "value": "d8614777855c8823eaf420c13af7586d47e55efc18d62dec8f3e7e4a3d5345d00d22f22c3d8e7d4c7df4671862533252", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694722401, "uuid": "d4b9f892-f7ca-4d0c-a65e-d44abbebd01c", "value": "T1F1A2D0217F1DE98FCC37B23887E5E5C692D17D64C3DC86866781C12BBAB36C46824E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694722401, "uuid": "a062998a-9820-4ae4-9a47-8d666ca6b6ac", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtSvSy6:798o08kxofBE+ZkXaT47C2Epit46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694722401, "uuid": "900e59fa-8e10-4a9e-96d5-e7fb41039126", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694722401, "uuid": "bbebc37e-088d-4103-9b5b-5f9f9ac9705f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694722401, "uuid": "94e07e4f-ba3b-4521-ac06-78bbe502431f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fae96f-52bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Kutaki)", "timestamp": 1694667508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694667508, "uuid": "6a93c37f-7852-42cf-bf2d-483a21ebc00a", "comment": "Malware payload (Kutaki)", "value": "a777e2155c120326263fad7434389a6b", "object_relation": "md5", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694667508, "uuid": "f1caf94c-1a8f-48d6-b726-3e42a06b8b14", "comment": "Malware payload (Kutaki)", "value": "ed04df376e127f7c735e8f81a73a8c74294daad91bc3231d61034f19f1d4e9a4", "object_relation": "sha256", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694667508, "uuid": "6559b542-e5a7-4d89-9c27-b9cbea794be7", "comment": "Malware payload (Kutaki)", "value": "94a22a524a1dfd01d398ff8568e7dbcefb59cb33", "object_relation": "sha1", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694667508, "uuid": "f043da57-aacd-4602-b088-ad074b31bfea", "comment": "Malware payload (Kutaki)", "value": "43fc36393a555eb92ed69fb0c9b3f017f5e975583e976c23bf744549f613d5cbbf61ab4867af93d8c676993d710b33db", "object_relation": "sha3-384", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694667508, "uuid": "8d7450e2-b4b4-48cf-ac9c-df3dd1125184", "value": "T183B533C84985176BE9AA402C2402F9FF03EA4F9665959DDB5DD7A21CE82E3D3C84F343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694667508, "uuid": "1bef4ad9-fec4-4654-89f9-d540f18d0a6a", "value": "49152:EHAPSctUWtpLyymwzLb3UWd91K6AVlSKHgCxIq3jpBq3JEl/ym8V/:EHAXtUW3wMjn1KpVgKbxkJEl/ym8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694667508, "uuid": "87ca8900-96bb-4f74-a03a-9d0176fa706d", "value": 2298672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694667508, "uuid": "bc4b4a21-1577-4dcb-a489-3510ea7e2d89", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694667508, "uuid": "35a3c4e8-fbef-45fe-960d-87b63f1cd353", "value": "a777e2155c120326263fad7434389a6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dd2065-52d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1694676985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676985, "uuid": "58ae0104-f6e5-4d4b-9dca-42c24a3db552", "comment": "Malware payload (RedLineStealer)", "value": "fe93ee063b574af8a829e30841f03f7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676985, "uuid": "c73c683b-cf0e-4836-a5e5-d6ce38d26e62", "comment": "Malware payload (RedLineStealer)", "value": "ed48f2ac7e1e259ff3bec19e28a35f25b28870704a4a2a3b82c0b5389b0c3bc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676985, "uuid": "1b0f1b78-53ef-4aab-ab69-5e33b5e5d59a", "comment": "Malware payload (RedLineStealer)", "value": "4d24eb2923d2a0b470ab49464f7aa0b304a17b4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676985, "uuid": "b7c15e8a-921b-4130-a874-6203afd3ddc9", "comment": "Malware payload (RedLineStealer)", "value": "92225c09d5bde0347a9fd29d3d050135eac3a1706054be9a68f0a0ac9d4d7e3a92560040aa7b882d130684d50f62e157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676985, "uuid": "360e5aff-5219-4459-ac7f-f89f3ba1fec4", "value": "T1DE150120B0C18472E7FB21724DD0E679197D783487A6AAEB63941EBC0B631F1D631BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676985, "uuid": "2cc92776-82b1-45f7-9f77-6da2f36b79fe", "value": "35646f486d46399590ccfc4635584429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676985, "uuid": "e2f01917-ba82-4ca1-9bf3-88c87f89ab75", "value": "12288:QX//yfYb5BIQZVtK4JhepH7QCEgD3S58dqxnge6JTZoE+l6fkoL7McIUFTfwTIMa:2iuBtZ7QbQbgrxfe6JNoZekUuUlfnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694676985, "uuid": "b96161a5-aa46-4463-9770-14609e97c427", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694676985, "uuid": "b49e0d05-a8d4-4c0b-9403-eeef6ef84d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676985, "uuid": "6d83b27c-fdc9-4c85-91ea-2dca9fc4a34b", "value": "SecuriteInfo.com.Trojan.Inject4.61027.31168.1601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b5357b-5311-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BitRAT)", "timestamp": 1694704380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704380, "uuid": "e44f11d6-8a0a-4a11-87a2-daead320ff51", "comment": "Malware payload (BitRAT)", "value": "3b92906782599469acffd05ba041942e", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704380, "uuid": "0d9573ca-d3dc-4914-923d-76c1d6ea40f6", "comment": "Malware payload (BitRAT)", "value": "edce16eadba8d19990b2ff2e97420f07c1f4defe813ffe961f9cd777f8368b7b", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704380, "uuid": "15d50114-62e4-474b-84e1-7c93498addf4", "comment": "Malware payload (BitRAT)", "value": "522183445616d131f3edf13e6ea93c9f19c9f52f", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694704380, "uuid": "28156a8c-4697-4279-9e66-5a4baa488325", "comment": "Malware payload (BitRAT)", "value": "951c8425f675654cc7ccd08bda019eefb3c6eee1af4403f189ee971e10777f75335906c6aabcffeecf426ae3f60c7547", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704380, "uuid": "f42b814f-8622-48c7-b0fa-a99cbe35825b", "value": "T18F14F107F3C1C247E56A533106C3D68E7B69BD6AAE26831F7201371EB8B6371CD14256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704380, "uuid": "b9d7fdd8-dadb-40c9-bc41-eaeba7a2087c", "value": "3072:NAN+svPwMrFoXiURMf8yS/TSTIs6sCbMD3itIm0QqgxJi+m:W33JodRU8yS/dLsZDyp0QZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694704380, "uuid": "c7d7463a-d6a2-4c48-8116-409e5f1decca", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694704380, "uuid": "09287b03-9291-473b-ae33-f3875aa95c7c", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694704380, "uuid": "5af87f65-800a-4913-a2e4-49619a4eba1b", "value": "Zapitvane_MACH_BULGARIA_EOOD_09_2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0418abbc-52cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694675957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675957, "uuid": "8388ea94-a772-40b9-9a79-daa851dd3cdc", "comment": "Malware payload (Mirai)", "value": "ff4975ebfd8e258b2e0f106d3568acbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675957, "uuid": "a7c0d6ae-a58b-461d-ba74-0c6a7bb1abf2", "comment": "Malware payload (Mirai)", "value": "ee7fb3db18bc86699b79cef2fb2803aac863722a1e829bdce8c2af1acddc12f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675957, "uuid": "40b6edcc-5e13-4c4a-b04c-762e43e3571b", "comment": "Malware payload (Mirai)", "value": "349eb0ceae8ad88ce1855e95f9d165a575ad46c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675957, "uuid": "1985d287-330d-40bc-afe0-f5268599daf1", "comment": "Malware payload (Mirai)", "value": "58835dd36fb439d8bc8cede45a47d5b401303022865dcb41efad75e7c133b64d988d1367ea38ea2f06bd3e4ad5a34bff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675957, "uuid": "02f04e14-e2fd-405c-baca-e4a1f75e383d", "value": "T144A3D60ABF350FF7D86BDD3709A92B06198C550A22E97B367930C858F64B21F19E3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675957, "uuid": "10eaf023-cc87-4133-a048-f18c59b23592", "value": "1536:5kkhyTy3yryaiNLVeMoWpIxqzj8DmoixIINZTBuBZD2wvxz5nx:5kQ0UMKJCWsojcIXuB1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675957, "uuid": "94d445df-f198-4e3d-9d45-d6a5b1347d6f", "value": 101680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675957, "uuid": "d3b01b0c-a4f6-46d3-b9e3-9c82bb6028e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675957, "uuid": "a90771f0-040b-430b-ba1e-11b417260024", "value": "ff4975ebfd8e258b2e0f106d3568acbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af76b9ed-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694703303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703303, "uuid": "4934cf5c-fba3-4143-bd88-c1b768a3a43a", "comment": "Malware payload (Formbook)", "value": "95ce07a1b02483f47410688e5ea2934d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703303, "uuid": "deed871b-0277-4fb5-91f6-c1a63417ffaf", "comment": "Malware payload (Formbook)", "value": "efaaf9e72db8504655c4ae81958252dff7454667d9fd559d1f3a1a4b53a3c8ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703303, "uuid": "b571dfc1-ba9d-412e-bfe4-a481ecc71159", "comment": "Malware payload (Formbook)", "value": "93f620ce6e25d9c1cc127afb5e34e2bdc8e3d2ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703303, "uuid": "9f736fe9-2162-4d5d-b6a9-32e6f31a6172", "comment": "Malware payload (Formbook)", "value": "98b1c0af5127b7fb81e61a1e3a27243e32e30f7204b7c310a75b875e12b5ebe58742bd9836717089592cf3c5e6cc6d86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703303, "uuid": "4375293e-78cb-444b-a381-ec6912290034", "value": "T10D74231039A5C44AF9A29B353D3E037FBAD59923A6FD47575350439E3850288CB8D3BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703303, "uuid": "f88121c2-d3fa-43f3-b0ba-0422e952bd78", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703303, "uuid": "5604977d-2fb2-4692-85ab-c77343610ceb", "value": "6144:/Ya6bjwXuheT5LCik2yLf6hdZSXd81BvIOa+gaqEWQoIldBGKyc44tm3YUW9n:/YJjwEjiktYStoRV/dBb4omM9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703303, "uuid": "9f193779-62a4-40b5-b0c1-b28866642ed1", "value": 366561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703303, "uuid": "ac321ded-8614-4586-b2c7-475c4f993d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703303, "uuid": "e2653404-fade-4df4-bfa8-7a418791a1d3", "value": "WIKA Instrumentation (M) Sdn Bhd - Request For Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df2c8c7-5314-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694705689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705689, "uuid": "be942aa0-cc1b-4f13-98a1-83bf4d48c793", "comment": "Malware payload", "value": "76b1295f1ccade7b25d1f0b68b241719", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705689, "uuid": "d20e5cb9-bd6c-45db-8e89-8e95e0520fa6", "comment": "Malware payload", "value": "eff8eec2de2f4fbe30c4583889530b6f2ce5c8f22ba0a607a7915f3e82c2547f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705689, "uuid": "861c8e39-d53c-4775-9cb4-191ac8c2589f", "comment": "Malware payload", "value": "999c34a033a53a5cf1fba7e1403dd095579efec2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694705689, "uuid": "ae9f64e6-e35a-45f6-bc0e-881fb073f44e", "comment": "Malware payload", "value": "ddea9c16685ae84ef32ab69db7c73ef4e544dc43220cc7999297fa15f18761c60285d32e36eca4474a8b15a93d622758", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705689, "uuid": "619228ed-c07d-42e0-ae7d-f05395ef9a16", "value": "T1AA51F9F0DA9C6D77D46D46853A85BCBF10D6F5B3DED2584172ECF8C6006A602A62A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705689, "uuid": "342974e9-398c-44b6-b3b9-731579fd841e", "value": "96:cWNu25WUdL9LP2WrLSzfrAXmIgzrlUYvj:c0uORL1XqfrAWDzBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694705689, "uuid": "839ae48d-d000-45ae-a3e3-f7d57bcd2d21", "value": 3134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694705689, "uuid": "869220e1-f383-4a4f-8a3a-8d14dce6b4b4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694705689, "uuid": "1123f1b3-7cc1-4d9b-93c5-35f6dfb01b28", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.32410.12056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b883d1d-52cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1694675970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675970, "uuid": "f0a4050b-3bf2-49d6-a9c5-29714ccf986a", "comment": "Malware payload (Mirai)", "value": "9f94f9ff9b6b4b3557603be3dd3899d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675970, "uuid": "42f279d1-e244-47ff-94f6-d3c80ba05ceb", "comment": "Malware payload (Mirai)", "value": "f49f2a60cc012749a142b5169798228b0ad02a09013616bee16da32e0624fa60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675970, "uuid": "067a1625-e4de-4bb2-9b1e-789e78280e99", "comment": "Malware payload (Mirai)", "value": "7f241588e1063514774158ea92b247818c925801", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694675970, "uuid": "4ea9222f-9e1e-4191-a360-fbd916bb6c66", "comment": "Malware payload (Mirai)", "value": "4009cfe234033a924743ed2f5e1d435667e5dc4b5308141810f77237cfc60bf2db2d7bc23ec8342be9e582ac6e3427e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675970, "uuid": "2a3c2c56-8248-430f-8105-ae027b31f6c6", "value": "T15E734CD9F4028E3CF98BD5BD94160E09BD2023D567970F27E6A6FDE36C731546A02E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675970, "uuid": "24b9b0a0-d6ab-4597-98c0-9f039201dfe0", "value": "768:0ecNzmQtwZGB23gdj2a3tmRikohDvtAhOXuK8ohUJE3k7YrTer4VfO2spTl:0Wi23gdiCp+K8ohnk7Yrar4VN8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694675970, "uuid": "be8654ea-7fc1-46a4-9967-407072f10565", "value": 75920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694675970, "uuid": "1bd05b11-a7c3-4ea8-84dd-37be8c0ab040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694675970, "uuid": "d7f8f1ec-b7a9-490f-b2f7-e0b25a6328f1", "value": "9f94f9ff9b6b4b3557603be3dd3899d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3c69ce-5303-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694698711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698711, "uuid": "cd104815-8bb3-4051-904b-ba3bc8406cd4", "comment": "Malware payload", "value": "2167197aefb42cc36d97c560fa3bb758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698711, "uuid": "bc775a64-b05c-49f3-b939-40d6f50183c6", "comment": "Malware payload", "value": "f4a4cd69e5b6d0a5adbef242730464b0c66ce965fda0b627d31934cbf221f639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698711, "uuid": "5d276ea8-99e8-4687-81b9-c53da7912f69", "comment": "Malware payload", "value": "362c1196ce373c24e8c929d8a4fb24bc2158b60b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694698711, "uuid": "27f31894-05a9-41eb-bc21-f210cfa590f1", "comment": "Malware payload", "value": "17f2fa09b3fcd55e2c1027c3a220903c14cb325093af4bf5605a3dc9526d02f97d8aea2d7dacf91bd40694766f5b33d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698711, "uuid": "607ca9bb-3350-4700-9124-8e57a905b11a", "value": "T18405011A3788D919E45210B4D902C7F80943BE0AFD25DE9BFAC4BECD3976AD91B016D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698711, "uuid": "ea8f1570-e079-46de-a17b-62ee9f2bf33b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698711, "uuid": "cd9e189e-ffa0-477a-b814-1c17749ac54f", "value": "12288:R4wLJRn8Q3nEHKF99JQUqn2/r1/YfwHgrQ8tXRM:R4wLj8yEqNJiI0BM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694698711, "uuid": "342b196d-fd38-46e4-a181-2b705fb1cd22", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694698711, "uuid": "32811a8d-35c3-40b6-afa1-f8cf7c3d7b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694698711, "uuid": "3c305c6a-13e2-45e4-a8fd-894e42b1f195", "value": "SecuriteInfo.com.Trojan.PackedNET.2340.30863.20287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4b03c1-5345-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694726762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694726762, "uuid": "dee6b2e4-6f3a-4766-ba3a-bf74aac4dde9", "comment": "Malware payload", "value": "1ae5e18c3f032578c3e8e1f2dad127ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694726762, "uuid": "354aa7d7-9591-4671-a954-45ce594a450f", "comment": "Malware payload", "value": "f561a2851020a8f0473104f4c4123c9730710c0fb6faf6cfcdd926694960374d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694726762, "uuid": "d2431871-231c-4126-8cc2-926e7dbb9d06", "comment": "Malware payload", "value": "b8caf307edba082e98ce0186f123496771705315", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694726762, "uuid": "fbc9ae96-a3d1-438f-bdde-c00893b05263", "comment": "Malware payload", "value": "9711642d407683de3229f2f7de1949af4a9d6e021956cd20f7e967917ed7e7ae89496bf97f35c87d63c26a1cd33ec69f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694726762, "uuid": "2340148b-7fd8-4ef8-a3d9-b61d8a66a526", "value": "T141C4D05BBCC82092E4F6883CDA59DA39E116543B3E1DE76E07492F8AB51FD85EF50C08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694726762, "uuid": "78e311c2-fb92-46f7-8c8f-102786c4349d", "value": "0c9c64525522b2a989036b9afc41aa0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694726762, "uuid": "6942c7b0-b638-49ba-bcf0-b812aa6be75d", "value": "12288:1KzgvtVn3BsnL5BG4Obz7Ie3zxv6FxQ1Hr35X5m7fT3GOIavtSYF:1KzinWnE8sxy+C7LWwV5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694726762, "uuid": "6eb42911-502e-42cf-b188-cad9435e0641", "value": 572488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694726762, "uuid": "b8e8c45a-5e68-4ed8-b41a-e4204d270934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694726762, "uuid": "2e40a1be-a8e9-4ddc-a6a7-13f775dd5fd3", "value": "1ae5e18c3f032578c3e8e1f2dad127ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4fc862-52db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BumbleBee)", "timestamp": 1694681445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681445, "uuid": "818f31f8-7bd8-4bfc-8d43-8ff1d588c52c", "comment": "Malware payload (BumbleBee)", "value": "e4919447b9ea5c4f02a0746ab64f8e7e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681445, "uuid": "4f2562dc-76e7-4606-b8af-a48a907c3388", "comment": "Malware payload (BumbleBee)", "value": "f583b43851502322a69c67f0f8f3e50f296f397e4bbb50bc646bccca6ee79215", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681445, "uuid": "e54966b6-69de-4572-a3c7-d243b96b3a56", "comment": "Malware payload (BumbleBee)", "value": "bf40844bd9286804351cf1c51ad1f68a26b81d92", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694681445, "uuid": "f122d74f-d2a9-48be-8e65-db6f7e223229", "comment": "Malware payload (BumbleBee)", "value": "cbc1e5d6a75a6452667c5ca0614a1157a0a20d223d260e6e24e5b2595753dd0495df1ac32ba6c9ac9580d3c9bb0569f7", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681445, "uuid": "5529e05e-54d4-4488-bce9-aebe91fe2722", "value": "T16635BFA1A276B673F737F53B08BAF939560136E66173BB57101936830072683EEC750A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681445, "uuid": "07a19766-a115-4543-b662-f0de4be765b1", "value": "9881fe8bdd76fbd975354d75e7c256d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681445, "uuid": "6f2420a6-2120-475a-86f6-ba178ea70827", "value": "24576:gG95Qu5j6V4TYuVUKXs7U48XoKdtEiQnNst2Ua:gG9TfPUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694681445, "uuid": "86fa6ed2-351f-4fe2-a184-650c08ded829", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694681445, "uuid": "1587e7b3-e436-405c-8a43-1ee996036868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694681445, "uuid": "bf7125c0-f153-49d0-94df-ce7e12f9912f", "value": "e4919447b9ea5c4f02a0746ab64f8e7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e721f78-52e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694683705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683705, "uuid": "3b769a45-7885-438e-ae80-97bff74e5fc7", "comment": "Malware payload (AgentTesla)", "value": "34ce14122335811e799859d3c37e154a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683705, "uuid": "a67dfbbe-4614-4853-bddc-503c31a36a7d", "comment": "Malware payload (AgentTesla)", "value": "f7215daeffd38ebc1006f163dde6f4215bc3d99a3c750b27a5de382430d4eeeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683705, "uuid": "49218b30-b5eb-45b0-896c-0840b27c2d5f", "comment": "Malware payload (AgentTesla)", "value": "26738eb200e0f68e0e9c31036ff3e4252e2605c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683705, "uuid": "e78f0bc7-179f-45d4-b95d-6c9c84b97480", "comment": "Malware payload (AgentTesla)", "value": "223453094aab9e5ccd43cd8c6b244473768e33bcc221aa608ff81ad5b4aaa4e3346736bd7438b379dd9da7702c568441", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683705, "uuid": "fc610cf8-75d1-4c92-95d4-918f53f00477", "value": "T17EB4ADAC365175EFC857C972CE991C64EA60B477530BD303A41722ADAA0DAABCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683705, "uuid": "57c99757-3630-472d-8a8f-66e6a76b499d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683705, "uuid": "b7edab5f-6c62-4897-9790-361719710f41", "value": "12288:a8wI6xIJDJbYu07kUGfUtDHdRbCAmfFMpdi2l7mTEehRDL3mzTH:uhQJbdUGfSfnQFMpdi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694683705, "uuid": "04859628-1b42-490d-b371-281a2dc44d33", "value": 541696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694683705, "uuid": "b29baccf-be9f-434b-a604-435de538d408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683705, "uuid": "b58859f9-91c7-4776-8469-2ba23d2ef232", "value": "swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68367380-52d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1694676984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676984, "uuid": "ab3ab738-b6a1-4097-aaa3-c56a9592840a", "comment": "Malware payload (ModiLoader)", "value": "bc42c518d60ceab920b05d74a180e4cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676984, "uuid": "20c974ea-695f-4397-906f-8ded3da7d696", "comment": "Malware payload (ModiLoader)", "value": "f78db900fda53959f9be60c05310fe73bbe076e86b6baa1dac07c3b91aa9daa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676984, "uuid": "072f3326-62bb-4f5d-92e6-73a82e0940c2", "comment": "Malware payload (ModiLoader)", "value": "b53be15b6a8ec8e85300f4d0e71394100cd1b378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694676984, "uuid": "e3c348ec-dd97-48ad-a8d7-d448d733ebec", "comment": "Malware payload (ModiLoader)", "value": "87dc2bb817ff50e84ac06946938a341032b18ff9f7d5d9e3fe682dd95ee224217640b101a650f27cfc8edded8661ce58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676984, "uuid": "4563bf8c-6e28-4f5a-ad78-46227802727e", "value": "T1BE253AF0B3B418B5E0AAF678C906B3D00DFB6AD5A824698582B57D4B19B7F507F2401F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676984, "uuid": "9800c7da-e89b-48ad-b1ea-6d5bae57fae0", "value": "3f898278cbf17fb40d20714dfc2fa658", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676984, "uuid": "112cb94f-554a-44bf-a0e5-41d2c3f880a5", "value": "12288:SIOKbGC9aNYfbw+MmiR60Aigv4ixgKbR5hjy3H31RDHW4Qek5Dke/+:SIRfa+f5bWZKAod5h23H3fGey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694676984, "uuid": "768848e9-0786-4108-a8a9-3cc3a4b34bc9", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694676984, "uuid": "7f619614-ae5b-4947-bc90-aca1c1cba0cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694676984, "uuid": "154d6323-7323-4fab-9295-a1330385fd50", "value": "SecuriteInfo.com.Variant.Zusy.489065.16055.26062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8b8d47-530f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1694703540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703540, "uuid": "171c8e76-cfc2-40c0-b9cd-5f39878792b4", "comment": "Malware payload (NanoCore)", "value": "411e2a93398bddd6c13c105da83ca801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703540, "uuid": "db2094a1-7f9c-4976-b64d-1f96db85e654", "comment": "Malware payload (NanoCore)", "value": "fa4d53ec2a935d8559e96b4ae81e8472f0ec7451e2bad29477fa6002ab7b90e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703540, "uuid": "568c47d9-78d9-4956-bd1e-4ef0a8e57b76", "comment": "Malware payload (NanoCore)", "value": "aaba19b734231f8f4bf54fddda09353b513fd71e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703540, "uuid": "a10a5847-13a5-4d16-905b-0a33dcc341c1", "comment": "Malware payload (NanoCore)", "value": "0049a8e6f3d9d9c58a5821d0c4d4a86b81fe98da07a122f9bdeaad99f5e1fe504a7b2bafe5a91b2c02bf87077172b579", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703540, "uuid": "249c5deb-a4a3-4782-af3f-db685ae52ac0", "value": "T159756A2766B68EE1C3C62B3AC497E5440BE8E15A7717DB0F344E2399264376FDD0E902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703540, "uuid": "7e190375-162b-459b-95a3-0f4165399fd1", "value": "24576:llHrS9i1r4urNrrO6rVyQrhmMyBx883FVKlC/2ITRzT7EUw4EeAJ:llHOia2K6rVy6vq88DNFAV4E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703540, "uuid": "685f0c58-98aa-482f-862e-365eea46da7e", "value": 1550336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703540, "uuid": "bec2891b-ebe7-4628-8563-17ba9fcc6718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703540, "uuid": "fb1af729-a7f6-4649-90e8-59ed747db191", "value": "411e2a93398bddd6c13c105da83ca801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2864d0-52e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1694687002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687002, "uuid": "34a399a9-5a6f-4986-a624-72e087f63be9", "comment": "Malware payload", "value": "3911fe3f0bf526a9d4be8d38bbf10ae5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687002, "uuid": "15efb59a-5ee4-4681-a220-b01ae717b76c", "comment": "Malware payload", "value": "fa805d21722324e9ee86195ee16f68ba69828f1c5f08c6aff6eab3e80db2f129", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687002, "uuid": "615bc763-7d90-4f43-b201-c8a2a95182a3", "comment": "Malware payload", "value": "84da29098994c38ca9c5d215b7dc8a8639dae911", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694687002, "uuid": "93b935d7-2b90-4c1d-a26e-dd4701078a0e", "comment": "Malware payload", "value": "ac043c0d395e34d1fea3c7ca9da376ec3f80d0197e946b200da2abca55744a753b6b437f5318c3cfda65dfd7f32ad04d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687002, "uuid": "3192b85d-23ac-4b5a-9a90-90fc7e7fd8aa", "value": "T10D335BC2A341D0BAE51310B22477CB675A32E33A2050D95ADBD52D36FA76041E736BFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687002, "uuid": "9609ff7b-76ae-498a-bed2-4ef0ec4cb46e", "value": "768:lmtLSokKyc/+l+KvvcaTd1+A5fSsf26QPAzkIcOZHeqG8DV6wSDHDIv:lmtuBKz/0kah1lhvQPAdcsHeq6wSzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694687002, "uuid": "3eeca85f-cdfc-4931-8b3c-cbc6b375dc92", "value": 54796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694687002, "uuid": "47063451-ad7d-4548-8811-dd9932673e03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694687002, "uuid": "e9092b1b-a724-4fae-ab65-36aa98369847", "value": "0xst2.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4162d0ef-52dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1694682073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694682073, "uuid": "24c52d6b-3716-4ddf-9e3b-244d44d6c1da", "comment": "Malware payload (IcedID)", "value": "396f81c0274b21d8474a3f39f5188650", "object_relation": "md5", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "key-abebas531", "colour": "#C97A98", "exportable": true, "hide_tag": false }, { "name": "shankarmallapur-com", "colour": "#63AB57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694682073, "uuid": "dbe0ac85-1f6d-4f41-94a9-097fb8b0ec89", "comment": "Malware payload (IcedID)", "value": "fcacd2b44ede98c12164abc1fbe8b58a949d26e2c8378ea43f2342abbf3a7cad", "object_relation": "sha256", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "key-abebas531", "colour": "#C97A98", "exportable": true, "hide_tag": false }, { "name": "shankarmallapur-com", "colour": "#63AB57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694682073, "uuid": "ef3a8cd1-0c44-4a72-9f9c-2a70026590bf", "comment": "Malware payload (IcedID)", "value": "426da78e8db7c72f83a02696140b79190f2ee920", "object_relation": "sha1", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "key-abebas531", "colour": "#C97A98", "exportable": true, "hide_tag": false }, { "name": "shankarmallapur-com", "colour": "#63AB57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694682073, "uuid": "0b5ff7d9-e054-449c-afd0-c09a1ee5d6f2", "comment": "Malware payload (IcedID)", "value": "1fc6951d9718b7e672daf9460ffc0dbf816bfce70b0b1341c828596ba6552eeb7fc914fa836f15173e9c33419ccd2fb1", "object_relation": "sha3-384", "Tag": [ { "name": "1638996626", "colour": "#8BC030", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "key-abebas531", "colour": "#C97A98", "exportable": true, "hide_tag": false }, { "name": "shankarmallapur-com", "colour": "#63AB57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694682073, "uuid": "71dabecf-9283-4aa9-b6b3-238bbfcc4e96", "value": "T1B6147D5A73614088C85B813CCA9B8612F7B07899132067E757A057BA9F3BFE4F23B754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694682073, "uuid": "5d9d6f3a-3fa8-4128-834a-46b68a4d5e3d", "value": "548afa58ee732da7eda297675edb4de5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694682073, "uuid": "117c4afa-f1fe-4cbc-a764-dea9b2b34e9d", "value": "6144:CMyHvuuieC+N0UasXQDwKvjKrTewT4GN3tGI:JQuuH993X0vjKmGNdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694682073, "uuid": "574d9655-2249-4b27-aa47-af879fade179", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694682073, "uuid": "1d7ae64a-2303-4a59-b293-f7bab0babc5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694682073, "uuid": "5489785e-7e76-49c0-99d6-7d658f3aea43", "value": "72loader_p2_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9816df-530e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1694703380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703380, "uuid": "87ea9237-d683-4be7-8d6a-d8c14dca225e", "comment": "Malware payload (AgentTesla)", "value": "f2c62f2ee6aa94509c39557a628534a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703380, "uuid": "e84a7214-03d2-403e-b35f-dd77b1949521", "comment": "Malware payload (AgentTesla)", "value": "fdc2c161030c533a7ecccafa2c6482ecdd027869450a4a3f6debca0616084272", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703380, "uuid": "98a0c59c-0f25-49f7-9f36-dd9b302146a4", "comment": "Malware payload (AgentTesla)", "value": "05f73538fa0dedaedcfc6a9b1d55e34294975501", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694703380, "uuid": "a8ccc33a-c352-42e7-8a81-aa39f920f570", "comment": "Malware payload (AgentTesla)", "value": "4ea154347cc35655f505e61a77b954df49eb19f87eea423070cad60f728990cd30bdb8b97d80a0f973f89028bb6a4940", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703380, "uuid": "6200abdf-3176-4e95-aa48-aef44a0a0cf5", "value": "T10B04D0836F4D9C46C1EA1C3801E2E33986B603E15A768643ADE91CDB7F776CC7A416C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703380, "uuid": "3f74e592-4d84-40f2-8677-d221cbcd82ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703380, "uuid": "9e4e680c-2d88-4a38-8d11-44256a1ef82a", "value": "3072:RamAbK3EawuisPmvByx3x7/VVE6j1/s2Hl3Izfxg2MEmPh4O8:ILb09mvwdNV7Zajx3Bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694703380, "uuid": "a031c036-5fb1-445b-a4cc-f1f04340b114", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694703380, "uuid": "da6759dc-97c6-485e-9790-7516ff9a78ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694703380, "uuid": "33dadaf0-002a-4191-b7c8-3566a5469a31", "value": "f2c62f2ee6aa94509c39557a628534a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824f6de2-52e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1694683470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683470, "uuid": "52a96cc0-613d-44d3-a6d8-58a6a469e652", "comment": "Malware payload (Formbook)", "value": "672ec08e90c7379936773ee5fe3b0431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683470, "uuid": "5de5b325-a237-4857-887f-3c5131092fa9", "comment": "Malware payload (Formbook)", "value": "fe36ee5707daa891a4902579d1ef2a98d681bf50d87982a1a331432277924365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683470, "uuid": "432fd7d1-e711-4926-8fec-3784a8b2cff0", "comment": "Malware payload (Formbook)", "value": "a94b7be7b432942b59d4baeb546e8f038f52c290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1694683470, "uuid": "ca6488ee-edbd-40e2-b653-0298c801253f", "comment": "Malware payload (Formbook)", "value": "e7faccb2dea932306cd1380b014fafa53e48c37287963a00b9e4f46480f5168d8a23fe5060deb3b287200c6414223176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683470, "uuid": "0f386c59-a5cd-4bf9-8bc5-db99a222bca4", "value": "T1B5D4128531E8EB3AFBF783BE01755304677495E9A5A8D31C0EC8A0C66B6EF410605FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683470, "uuid": "9e450860-1ad8-4cee-92ae-5f7f57824115", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683470, "uuid": "65fbee59-3e32-4105-96cb-d0df03047255", "value": "12288:ev2oj8FwLm/xXe6TfCUOHmPsdIlp8LCujucZ43OJxmxQlU2wFn:euoj8F64XeE9rl4CLs43YQWlU2wFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1694683470, "uuid": "10ffe56e-3bc2-4320-a3bd-3bfb3f106cbb", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1694683470, "uuid": "1239d680-1b5e-45d3-8fac-adecedd0fd71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1694683470, "uuid": "3a4c3486-adbc-4a12-8e10-1ffdb5f0752a", "value": "djwa937rJ3uqReA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }