{ "Event": { "published": true, "date": "2024-03-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-03-06", "timestamp": 1709769782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "09089b25-721c-4eb6-b3b3-2f6f2fe9bfea", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b323ab-dbac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709724581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724581, "uuid": "07c3e8bb-8aeb-4f0c-97cb-3be9a2b8bb42", "comment": "Malware payload (Mirai)", "value": "16e7b5809d0e37df047ba8cc9728a3db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724581, "uuid": "672d5160-6713-44de-84b7-cde95004b603", "comment": "Malware payload (Mirai)", "value": "0117deedb55d34c59a2dfdcd4119cb8968a37bb13ab756264f8c613958d50d88", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724581, "uuid": "93de5924-9f86-4a48-a89f-65ad1cfd3ad5", "comment": "Malware payload (Mirai)", "value": "d382ce8b3b60ce1441db764efd3342abcea17ce6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724581, "uuid": "972a7414-d337-42cd-b6ff-321e94241554", "comment": "Malware payload (Mirai)", "value": "14d4ef470294e64b71a9e64202fb3ca69971ce97d97b8f37ba350facb52d2bdf90c7470e8a244031b8b37fc80da295fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724581, "uuid": "9bbd2d22-9f7e-4826-9a56-0a44f387a54c", "value": "T14E04881E6E228F7DF66D873047B78E259B5823DA27E1D640E1ACC1105F6039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724581, "uuid": "ab0ec45b-4744-43ea-a60c-4fab7c52097c", "value": "1536:T16zePrQiQY3aoY05Y9vt6Sw6cFL+z14R7oOe/3LM76qfTOSV2dLi6jyfjLdN:TnPvQHw46SKFahy7ox3LIS4OLnyfjLdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709724581, "uuid": "76a05ed5-2771-40ef-9620-19e67f30456c", "value": 173824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709724581, "uuid": "fffd2c16-932b-4b25-a497-953b4498f3ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724581, "uuid": "b176077a-b557-4398-8f36-43ff5c1f2fe9", "value": "vlxx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5387b24b-dbc0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709732957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732957, "uuid": "a1fdacf1-089f-4f56-9049-ba58d9cd84b4", "comment": "Malware payload", "value": "20e7a31073ca9fbdd8a062e73dba182b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732957, "uuid": "794748f0-7cbc-4e8f-8cc0-371e7ad55e98", "comment": "Malware payload", "value": "01806718027eedd14d532f9c10657b9f9db5f7425cdf7dea267a5182e9a9f588", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732957, "uuid": "4edd079a-0cd6-42de-b527-16d88b771930", "comment": "Malware payload", "value": "85d073beb3a5a45341a97a944e9b3829f9519fea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732957, "uuid": "8f73b6ff-d1fc-4004-8c2a-f3b056534adb", "comment": "Malware payload", "value": "78abee67b8806a1852cdbd054e800ee6ce9c8ea1a282b5e35e3dc79a947d68acf61dfc5cb531b25b8b44aa7bd2085b49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732957, "uuid": "f29a420f-d70c-4025-8c1f-20221b1f9088", "value": "T14FF25C25B69C4237C9BF4278C8E211C1BA35E30233D2DE6F4897511B8D47BD53AB1E9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732957, "uuid": "32612cec-1ac6-4dea-babd-631d735bec57", "value": "768:ulG1OGN5szOLNRrtYpLkRmsmjzqb9+vOBjXd9Y:uwJNyzYN1KLkRHoqx+uj7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709732957, "uuid": "06a15efd-88d5-48c7-9109-f7de60293d9f", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709732957, "uuid": "cc5db3b3-25fa-4a30-860d-4cc3d64f1c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732957, "uuid": "b4ae3f56-48cc-4b5f-bcc4-5023d7dd09da", "value": "3011574829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ae3519-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718953, "uuid": "ab62922a-8a3f-4039-8879-faabe06f5a88", "comment": "Malware payload (Mirai)", "value": "014b405dfc871dc18d25f7129d94551d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718953, "uuid": "46e64fa2-3217-42ab-aaae-79aff416ed41", "comment": "Malware payload (Mirai)", "value": "0482f5a14f2de81f74a5e0045c7aa9590d9e0017afc3c093a2ecfa528e01eac4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718953, "uuid": "95755f71-e17a-4d12-87e0-924f210a2ffb", "comment": "Malware payload (Mirai)", "value": "89eb2f2e028484fdfe1b6764d1b8df3a281c7c48", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718953, "uuid": "1c1418ce-08e0-4f19-b3ca-0278cf8e95a9", "comment": "Malware payload (Mirai)", "value": "394903f1393bcc4cf42704ee505b1bf975e6ce7d16fc5740487e33b30e7cb042b283f7ade19e1d5e3dd106970569250b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718953, "uuid": "5e63aa79-8c9a-476f-8681-8b286525542a", "value": "T170D33A17B5C180FDC4DAC5B44F9EF536DD32B1AC1238B16B2BD4AA221E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718953, "uuid": "cbd0fe60-5cd9-4e7c-bd12-f806fa0c8a88", "value": "3072:tGtwnNiaOnUT5FKPT9OSQ7AOaogjV2iZlBWCgGiAIQPdL:tGtwnNiaOnUTPuLyWIQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718953, "uuid": "9f5a963e-17bd-4fba-ad45-5e70c8837192", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718953, "uuid": "8984a771-d8e9-460b-916d-b78338f4d0e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718953, "uuid": "c212119d-abc3-45cb-b913-459cb0a50bf6", "value": "014b405dfc871dc18d25f7129d94551d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b06efe-db93-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1709713504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713504, "uuid": "e4ac6930-e9ab-4da5-978e-63071de495b5", "comment": "Malware payload (Adware.Generic)", "value": "6880cd9876eeebf79d17df4996cbd58d", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713504, "uuid": "f6ffab4f-d784-4dd4-95a5-55c3c7ba25f4", "comment": "Malware payload (Adware.Generic)", "value": "049e3f2984b1ae312dfd5d845e933f841cebd00141710d3e883bcac0c079917a", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713504, "uuid": "1c558b35-6750-4b20-ae1c-98db28491df5", "comment": "Malware payload (Adware.Generic)", "value": "b82d23e4b5808a1b241b43b24f8f6c1a3e6312e1", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713504, "uuid": "322ffa67-b065-4631-a024-e8c250a193df", "comment": "Malware payload (Adware.Generic)", "value": "abdd9b66c09366120a6861d91b74f18fb031a4bfa4edb2cccf3d85c5e928a0e782e899c3d8f9edcfbf36fbc9ad67beac", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713504, "uuid": "991dc536-50e3-4f28-86dc-2f4695dc33cb", "value": "T158673337F225B93EC86912324172E22005BBAF1A64174C5EABE42D0DFB7F1912E7ED15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713504, "uuid": "d5b0789e-1106-43b2-8bc2-0f1da6f859f2", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713504, "uuid": "d23a134a-7cb3-46d4-8dfa-f3a5f22ab494", "value": "786432:HzbBqYCYV23hu8qvSI79IOKho3tP4o1AAAQWVk3xB:TbBqF8dvSI79IOKS3tPRAAAQdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709713504, "uuid": "6d5635ec-3c17-45f0-a01d-bb2df7559e9d", "value": 31651664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709713504, "uuid": "54c67805-5a3d-4a42-8704-62c8378e4c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713504, "uuid": "ee039cf4-f0ac-43f2-a248-8e112993d003", "value": "SecuriteInfo.com.Program.Unwanted.5387.24133.28564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2546a81c-dbbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709732021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732021, "uuid": "bd0cfa57-f79a-432f-a15a-967a0ca68c5a", "comment": "Malware payload", "value": "46e6a0c97132a518620763caff0da368", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732021, "uuid": "42643551-c2ca-4e0a-9971-fe2cf64452e0", "comment": "Malware payload", "value": "08cb42002f6b659182088f9756483627d0b4ebb9ed32eca89239ee626d1c1ce4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732021, "uuid": "d415f868-07f1-4b71-9d6f-8a469d1f5dbe", "comment": "Malware payload", "value": "e39db0fb68e2df5a2d068c9c29f1e0c464aa66f2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732021, "uuid": "af7aa6bc-6cde-4fe8-b42f-193234901332", "comment": "Malware payload", "value": "361c6e98040c7116e02b001136ca93d35135cdd9ede745842614839e741dfa3ab710ef0329f8894affe6ebbb524b9543", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732021, "uuid": "a5f9c3ef-4ba1-45b3-bcc7-6273de3cdd8f", "value": "T1C4C37C0075D1C4B2E5BE19381474D5A25B3FB920CFA49DDB2394123A8FB06D2AE39F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732021, "uuid": "1f40bb25-f0f5-479e-a779-648dddeddf9a", "value": "503f24b2f16afaad05eb71ff2cde7fce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732021, "uuid": "0bfdeb2a-d40d-445d-84d2-74d3f771f1c6", "value": "3072:tU+CK0llptaTHfPwr5Zm6Qi0ZqDPgVbObYL:tUxbllaborXQt+bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709732021, "uuid": "53e6c93f-c6d6-4dc0-afe3-1fc97ac8c3c3", "value": 123744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709732021, "uuid": "be1f3328-e7ee-488d-8383-048046d4aeee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732021, "uuid": "4db46f02-d39c-45fd-9178-b36a06de87ac", "value": "SecuriteInfo.com.Variant.Lazy.447095.520.18383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae08db3e-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718936, "uuid": "a235fc05-e44a-4a1b-ba9a-79597b403d8c", "comment": "Malware payload (Mirai)", "value": "cafaef5f9b9e207be3cd414d82f139b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718936, "uuid": "8a68c052-004d-489c-885b-f79f90dbcc32", "comment": "Malware payload (Mirai)", "value": "098b177a957daa664bf1e5edb8cec6e2055b9de2fac9cc9909674c2b1880c020", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718936, "uuid": "962dd0a5-6025-4b6d-883b-f3f272e4ac85", "comment": "Malware payload (Mirai)", "value": "09e445bf41c3435057d9eaaded8b19881f345262", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718936, "uuid": "2f35eac4-2e46-483d-a609-318e0422a331", "comment": "Malware payload (Mirai)", "value": "f6a5f900912e935d7842758118a2d3ac94b9d90f804481f3c5ecab8c469422928779b23bc5c45f48bf8b38da666d7f4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718936, "uuid": "99ddc198-d8d9-4d49-87b5-4353664444c7", "value": "T14704D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718936, "uuid": "30267f07-f754-421c-8257-2721e4b8b8af", "value": "3072:ueEksFM+wX5OZaVR8H3NaMZOTTMJxt9U+7fKbYE:ueEnO+wXBVWdaMATwJHy+uM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718936, "uuid": "5b19f24b-dadd-4f77-977e-c3f84236777e", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718936, "uuid": "2663b951-dd44-48b5-b54e-01ff12a394fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718936, "uuid": "4c7c4d76-2807-40fe-940d-8907a654b749", "value": "cafaef5f9b9e207be3cd414d82f139b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9abebe71-dbac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709724487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724487, "uuid": "aa68602c-9e51-4564-8ec6-859987bfa367", "comment": "Malware payload (Mirai)", "value": "4ebc79cae0074b449564ed7ecf1c241f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724487, "uuid": "25cc98e1-23ef-433b-908f-cdbdf96b2721", "comment": "Malware payload (Mirai)", "value": "0ae72010943ed311823428a958e40b650b937f8667f0ab377f6f2fa0cc63adf3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724487, "uuid": "543cc6f4-a6ba-4e2a-babc-fb4e845caaf8", "comment": "Malware payload (Mirai)", "value": "09794c5df2fbeca226685de93ac8dabc4008c5cd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724487, "uuid": "76ffde83-a06d-4395-8ccc-6005dd0db4e9", "comment": "Malware payload (Mirai)", "value": "efdb628495c84ab07753d612504c6b83afc1c5a7c45f875831764338db4a264a5a59793c10e5b3587d793dec07d535b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724487, "uuid": "fc91fc57-8df1-4c18-86c5-6dcf1af72b51", "value": "T17204FA1AAB510FBBDCAFDD3706E90B1239CC954722A93B363678D524F50B50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724487, "uuid": "8e421c91-5fc1-4c65-906e-3c6814d24456", "value": "3072:uCQDElnTDhX5MZ6vKOgwRl6adAbVNjjK/iy8:uCQQR3haZ6vFg+ljmLfK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709724487, "uuid": "c41ce8b7-c6ba-4409-9391-7431873e41d9", "value": 177856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709724487, "uuid": "b06c7e4f-7c9f-4518-8e9c-d5c42951fe96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724487, "uuid": "eddd327c-4a12-4ad7-8479-79f4cd0abc19", "value": "vlxx.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa77deea-dbc2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709733962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733962, "uuid": "177b7175-cf78-471e-937f-78aa1d9b3d4a", "comment": "Malware payload", "value": "0883ecc862a2b88567310c5e7704182b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733962, "uuid": "e578f630-faf8-4baf-99ca-26af636da5cd", "comment": "Malware payload", "value": "0b582d8e93f7ef3b40b989103e8020ab1d1cc7c18e2a0c7e678050104124d8ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733962, "uuid": "dba3f6f5-c9d0-4bed-aa8d-cd0a76fc66c6", "comment": "Malware payload", "value": "4fdf9fae9fe1362d57f46603db258c9a8ac96b19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733962, "uuid": "6658dbc3-3a98-4b83-85e4-59234d9139ed", "comment": "Malware payload", "value": "fc859928a40b72f450aef66a698d1c77f0115b444707243f91d541b49c53539c1d7e8ca4c585edb9d103b2395ad30b59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733962, "uuid": "b38678e7-aa09-48b3-9248-f26216f85998", "value": "T1EF551A93AACB4EB2CDD327F055C753766338DE108A26CF6BE608C5369E936C56C4A701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733962, "uuid": "7891754d-c984-43c2-bb71-509b04df49c0", "value": "649d036d609f33de97e4f0f2138dc058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733962, "uuid": "145cf5c5-1a62-44f3-ae56-4a8df63dfe6e", "value": "24576:tjH89XdywlQR5DI2vgXrxkDgTTChBO3h3VuQ5hMtbt:2XlQTIf/Mtbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709733962, "uuid": "c70631b6-a259-49dd-a85f-2b9d30c06880", "value": 1370291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709733962, "uuid": "7c847637-9ddd-4bd9-a6fc-a4dc83fb7621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733962, "uuid": "dfe30d05-4da3-42b8-951c-83616cfe6f1a", "value": "0b582d8e93f7ef3b40b989103e8020ab1d1cc7c18e2a0c7e678050104124d8ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab88fa5-dbbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1709732191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732191, "uuid": "13bdd987-ab7d-4c32-afde-580d073d72b2", "comment": "Malware payload (Adware.Generic)", "value": "6a80889e81911157ca27df5bc5ac2e09", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732191, "uuid": "4537c0e8-67e4-4a50-80ec-f00c16c7318f", "comment": "Malware payload (Adware.Generic)", "value": "0b74c13914f712fce5bb41c25a443c4214a97792bdbb6fea05b98350901405ff", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732191, "uuid": "48095ee8-a52d-4ca0-a558-a1316e9eb4b5", "comment": "Malware payload (Adware.Generic)", "value": "02ac28dd7124317e294fac847a05b69411c9cdb2", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732191, "uuid": "f937bdc3-12f1-49dc-a9b0-62bee2c87798", "comment": "Malware payload (Adware.Generic)", "value": "9c67b71a6d831ee33dc00d60d1b66ed94c756046e12b64160ee63488b365c3ea1f65b1f349f297670532d6478024ab41", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732191, "uuid": "76735adc-6902-4172-9ba5-b4ebbe5d682d", "value": "T1CBB5E03FB268653FD5AE0B3146B39360997BBA71B81A8C1F57F0090CCF2A5701E3A655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732191, "uuid": "def3c0e5-6804-4f91-81d6-f265dacbe6dc", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732191, "uuid": "95519648-7346-44a9-8eba-57413ff194a1", "value": "24576:U7FUDowAyrTVE3U5FR7EqKt4QqImIRxbFCtrzARkiXP9oZcEo4V2cUifUjYRm96F:UBuZrEUuXpqIzfbFsW/aOEPrSgmKvrjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709732191, "uuid": "bbf93568-262a-472d-88ff-156b3edd5506", "value": 2444656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709732191, "uuid": "725efea9-565e-49b2-ad09-dbe08044e697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732191, "uuid": "14964fc7-e833-4fbd-9e7c-f4e2824652df", "value": "SecuriteInfo.com.Unwanted-Program.0056626f1.2518.12093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46839dd9-dbc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709735512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735512, "uuid": "09c4a253-a341-4300-83ba-c96e70ce6a6d", "comment": "Malware payload (AgentTesla)", "value": "9e7666352bb7b1b5eaabc1a012c449d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735512, "uuid": "2bbd6709-dc0f-471c-a0be-b57338cba4ff", "comment": "Malware payload (AgentTesla)", "value": "0b8bba1fb948adcd670f612cc272f13f023811abd35706758ac967997bb5d0a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735512, "uuid": "8057034e-0f26-461e-b241-d65e45c415ef", "comment": "Malware payload (AgentTesla)", "value": "683e7a9f0927f8c28b7dbfe11f61ff2bec846d81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735512, "uuid": "f601b90e-c142-4494-959c-6fcdb7bfb648", "comment": "Malware payload (AgentTesla)", "value": "e64a89eee3d9d978268d2ea97e97efc027fd97747b4e810d1d4115880a28fe58c8b3468bb8bb05525b734a097b22e484", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735512, "uuid": "0f73c162-ecee-4a19-958a-3d7c96c86dfa", "value": "T16EF412587ABF6877D2BF44F9202A61C14FB1919B6899E7C86CC390D985C6FD307207A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735512, "uuid": "bd236112-9c61-4824-9f79-b41ce6342d50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735512, "uuid": "68c4657e-e7d2-4015-883e-3a08f4666ebb", "value": "12288:UaHvjpkDaBs/KL0+QFH6QtyaCKDywIrHAXkrNdkwL2f9B2DXt6:xFTacoFH6mC0NIrHnrNCw6f9B2p6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709735512, "uuid": "a6367045-4023-4500-9897-5c0c32ce21c7", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709735512, "uuid": "d15218da-f5c5-4091-9baa-cddde3f45d64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735512, "uuid": "a3e7f69e-507a-47e7-aef5-5b32597cc267", "value": "0b8bba1fb948adcd670f612cc272f13f023811abd35706758ac967997bb5d0a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6027c5-dbef-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709753110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753110, "uuid": "870af2cc-8373-4c69-b841-796399655f53", "comment": "Malware payload", "value": "05b1145c3e9ba76b0cc08cb0eee71d13", "object_relation": "md5", "Tag": [ { "name": "ASPXShell", "colour": "#8AF4DA", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753110, "uuid": "bc580a4e-5953-48b2-88b8-d982452e275a", "comment": "Malware payload", "value": "0c34df6d8c37a53aecf9c04517a319ad4e0eb2f03a5527c8bf9144c09251a7eb", "object_relation": "sha256", "Tag": [ { "name": "ASPXShell", "colour": "#8AF4DA", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753110, "uuid": "b9e7d5e9-6eff-48ff-afa8-9d91d7a9b4c3", "comment": "Malware payload", "value": "3816e55fefb29879dae5b260687f10beda46fccf", "object_relation": "sha1", "Tag": [ { "name": "ASPXShell", "colour": "#8AF4DA", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753110, "uuid": "0b007e25-eac4-4a4d-9661-a75390e34d1c", "comment": "Malware payload", "value": "034b042116000983d34d59d5ac1a7fb827d29cf6c508aa663379dc2baee9fd605acb99164805d2f0a92abf38de87f629", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXShell", "colour": "#8AF4DA", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753110, "uuid": "216f1fe6-ec94-4fe1-a689-63e0d7a4644d", "value": "T10CF1E63BF44C490EEA11102BE1B78DA1DA6AB5B50337297AF866372FD85D66C01702F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753110, "uuid": "4404f069-4cee-4f96-9411-4823bd1170ed", "value": "192:quWX3+5HNnC4pvTytMZAUWtkUW8UAWijhUrdo3eTaZcwGU:njCev7ZPWt7WTAWi9Co3e+ZcwGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709753110, "uuid": "e0dbfa08-18ca-4489-8908-df0793551c81", "value": 7552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709753110, "uuid": "115b1d4b-3547-42bd-85ea-141becf7f00c", "value": "image/gif", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753110, "uuid": "1f33c019-da81-427d-bb2a-83377de42f51", "value": "8apXJq5b.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63dd4a72-db58-11ee-b7ea-42010a9c0006", "comment": "Malware payload (StealthWorker)", "timestamp": 1709688317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709688317, "uuid": "8a20fedc-ed5e-4413-8801-f1f93ba5499a", "comment": "Malware payload (StealthWorker)", "value": "0721b1d0c9c68c18116273f2c293ff21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709688317, "uuid": "9efd760a-4462-4767-9aed-6eca26b49897", "comment": "Malware payload (StealthWorker)", "value": "0c3ee3977deb2ab25d67d6b346b7c96497c4ff18b76678ca990b8493f23248a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709688317, "uuid": "4161b1c8-7fdf-461e-b861-5f7a089068af", "comment": "Malware payload (StealthWorker)", "value": "dac53205b4ba718542138d90eb56f1641f5807b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709688317, "uuid": "638ecc42-af0a-45a3-bace-e65a57c6478e", "comment": "Malware payload (StealthWorker)", "value": "0cf060dc686889534d1d287ef5ce1da09ea72a2de205e9ef8cc838cf013b93569af0947df8a600dda55a00e4d50ca90a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealthWorker", "colour": "#1255EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709688317, "uuid": "1d667be0-ac1d-434a-8ac9-e8134d5e08c3", "value": "T18E665C91F9EB15F9E703483095A7623F6730620A8739CECBC7405F86F8675D20A7762A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709688317, "uuid": "dfe18c78-8539-4981-ae8c-66feccd5c7e5", "value": "1c2a6fbef41572f4c9ce8acb5a63cde7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709688317, "uuid": "8475a034-cb2e-4b0c-b8fd-9860430b6758", "value": "49152:k92mic7iMnbPvRUAm+ugRkqjR7Q8TOc5KubExvCsNGEgveIXB4IuBNT/IeswF69B:BmP7i+Rf0es5u2BNTAcSE8wIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709688317, "uuid": "1a0f6b99-c38d-4773-a55c-e08e15e78bc2", "value": 7107584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709688317, "uuid": "6f98be90-1413-41fb-b2df-64a4b3922cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709688317, "uuid": "65de1423-de23-40db-8a98-be383da4593a", "value": "0721b1d0c9c68c18116273f2c293ff21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2d9b08-dba2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1709719976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709719976, "uuid": "17660db6-808a-4370-9390-7c60bef881bf", "comment": "Malware payload (AsyncRAT)", "value": "0eb889c47388d45dca747b4ee2c67eda", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709719976, "uuid": "f5744a21-9a79-407e-a0ca-cef7246e0e98", "comment": "Malware payload (AsyncRAT)", "value": "0e9843ac44d44e81b5baae5c100464c9ad0a36d8e02cfb3e5e9165d07d70af20", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709719976, "uuid": "720d6d25-701e-4de9-9036-7be656aca081", "comment": "Malware payload (AsyncRAT)", "value": "28d805ca3315727aca2b2cf0e4f6cc97d9b7c6ce", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709719976, "uuid": "86a52802-d1d8-48cc-bf86-d3f466657223", "comment": "Malware payload (AsyncRAT)", "value": "7f461b5ef5482a9d339cf1d5eb71195ebadfe5822594bdddae33a3facec5ccf6220835f27a3cfc0cf871b77e0b4448c3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709719976, "uuid": "31cab5e2-d004-4441-a79d-c63b0cda0ae5", "value": "T1C8232C003BE8822BF2BE4F78ACF26145857AF1636603D6491CC451DB5623FC69A526FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709719976, "uuid": "103bfb30-de73-450b-ba3d-491cdf5382ff", "value": "768:YufxhTXbDdbWUn7yqmo2qRoKjPGaG6PIyzjbFgX3iZBK+Crr0BbOLBDZ6x:YufxhTXnN2vKTkDy3bCXSfK+00ZOdd6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709719976, "uuid": "3fb660b1-233d-4515-bfe7-6316bbae3c0e", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709719976, "uuid": "4bc7fed2-7eb5-484e-ac85-fcd562ccd241", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709719976, "uuid": "352121ea-ad19-4f4d-b04d-54191e82ccd4", "value": "nBL109533.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05ee51b-db69-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1709695720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709695720, "uuid": "21fc6198-a0ea-45a0-9a40-7164a996ce9a", "comment": "Malware payload (AsyncRAT)", "value": "e29a0e59ee8a40469e3bedfe2612f567", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709695720, "uuid": "f42f1714-5935-4a44-9842-36954c8335e1", "comment": "Malware payload (AsyncRAT)", "value": "118088ebdecef31805885de379e8332d7551078d4f3c6c15db52a70b108cbd76", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709695720, "uuid": "5b258903-8785-4e59-9cd4-f3a239335de3", "comment": "Malware payload (AsyncRAT)", "value": "2254d7b5bf1524bb1a224875abba9110f7a815f2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709695720, "uuid": "314cbeff-a3fe-42b9-8db5-50c96d1c3d0c", "comment": "Malware payload (AsyncRAT)", "value": "34b22e32c474c06ea1339235130b847834a7bdea0b08f7ff4e71ada014afb8d0d2c272fba17004a369f7d831c498a59f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709695720, "uuid": "27b252cb-aff8-4fb5-90ef-ab6eed100cad", "value": "T14217AF2F3194C219D51DC13EC1B2EF44A47B74B51732C5EB329E29A98F229C3DE3A661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709695720, "uuid": "a66c524c-b7ae-41b0-8b45-f676416b613d", "value": "6b13a2372dba0d243dbf26348410db6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709695720, "uuid": "3b638a39-d467-4067-bd22-e02369a2e51b", "value": "196608:WwUNEud08Pz1fCmX14ZEErpm5IQPI9UPDlQ/jMiDNR1T7EPPe:Ww2L8+1OEnuyPZO7DREe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709695720, "uuid": "2533e8c3-ecb4-4851-a2cb-c5e7c44bb68b", "value": 20257888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709695720, "uuid": "084414d0-0388-4494-b3db-60e26a35f681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709695720, "uuid": "ec7b1bdf-e8f0-4327-99a0-6cbc7edb5bac", "value": "SecuriteInfo.com.Trojan.Win32.Penguish.aqk.2138.32152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62963509-dbf4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1709755316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755316, "uuid": "42437f9f-f374-4304-a8db-703b1cf9859f", "comment": "Malware payload (Metasploit)", "value": "2b043549f0c3d896cf2274a08630c80b", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755316, "uuid": "940352ad-a05e-4ac8-871b-3681d5af01ec", "comment": "Malware payload (Metasploit)", "value": "1210abc7e03bd2719c36d7bc02eb479c567a1a91c41d4740b9566da92ce7e869", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755316, "uuid": "8b82367f-547a-4f97-af44-37d22de9b98b", "comment": "Malware payload (Metasploit)", "value": "68092d37f0ad7515a73b3fec691c502b0e2fe11d", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755316, "uuid": "1265daa9-134a-4808-ab54-a8b3b7dcee34", "comment": "Malware payload (Metasploit)", "value": "be9f898eb148bda45b48259f23d2e902d18e00b6ca37f534159fb5f241df0fa95b397a6b4dfd41968302bb4bcc344b9e", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755316, "uuid": "b30a140c-2638-4d5c-a043-a37de9c809dc", "value": "T15761AF932191B8EA415283BE3E5D6AFA807FC264954A6044F78C4F59F9DDE23398E6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755316, "uuid": "a8abb0b7-f0a3-45ec-b1c2-3909f377925d", "value": "48:e+MThimb7ROtBr4qSkuKZnWFNgQfBZL0HuQfhFi5QsvuiBrVxqT/s0z:FGT0v4qfuSnWFNgQfBZL0HfmAiBrVMzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709755316, "uuid": "899e3356-031d-4ad4-9d4c-9b60dafbdbac", "value": 3223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709755316, "uuid": "b299d6e9-dcc0-496c-9f90-67a2bccceb08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755316, "uuid": "d10cb807-45d5-4295-aeb6-747cb9ba0588", "value": "ea1Wv7aq.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d0d623-dba2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709720014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720014, "uuid": "59744f61-7239-4b55-9362-4530e62fd156", "comment": "Malware payload (AgentTesla)", "value": "242e286671beb6950ac8cbcdc2625378", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720014, "uuid": "4de91a11-5513-42d6-853d-b5229389d6a3", "comment": "Malware payload (AgentTesla)", "value": "16e3a82a5c0094537926cf5286fdc10fdef7ca5984ff63009582125a8efa1546", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720014, "uuid": "a10f1c4d-e1c7-4e61-83f3-5ab4aa2c7765", "comment": "Malware payload (AgentTesla)", "value": "b0f59ec2bd6e647cfe2b1fa60ae1f22dd5fc9805", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720014, "uuid": "ccb7c025-fe96-4bf4-9843-e8939cd9dd37", "comment": "Malware payload (AgentTesla)", "value": "d499d310d671a59a2404d6e958508032474711913375f6b925dac4cd179aff4467a4023c87be7b9d869ba704191b3f02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720014, "uuid": "6530914d-9661-41e6-93c9-d4c252f8f08c", "value": "T11EE4F114BA92AD27D1BD04F8047215C083F48AAB346AE7C98DDB25F933EDBC7169254F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720014, "uuid": "68f94492-7754-49ec-b703-9cdeef73e6f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720014, "uuid": "c50f425a-0d5f-4b23-a76c-72311eadfe28", "value": "12288:wR7/jjDwjiZJjl6TwsfGPZBsgW46uyFtA8BHQubsrxLR1klT2OW1gBv8sjyIWUa6:wR/jIjUlTBPbsgeuyFikQ6s+6UEOyNUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709720014, "uuid": "261fed02-7979-4b77-8bfa-ed49581dfaf8", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709720014, "uuid": "39d332e7-bbd6-4d91-8b7a-9ac5b187c474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720014, "uuid": "c2abc8bf-1fa3-409e-9687-ed015709c6ee", "value": "z1proformainvoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74a7950-dbab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1709724132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724132, "uuid": "3240cf2e-7669-4caa-8aa7-9cf75a5b08f6", "comment": "Malware payload (RemoteManipulator)", "value": "856e0406d6986ce8c0c544baa88a1409", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724132, "uuid": "d106de2d-7f7e-4ffe-860f-3722d9be2364", "comment": "Malware payload (RemoteManipulator)", "value": "18990cfc38044e3be0d954ebfca6cd08404a67841f48a9540ea5397e7b83fb00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724132, "uuid": "f2a0a8e0-10d8-48ba-94c8-030fe42e2637", "comment": "Malware payload (RemoteManipulator)", "value": "cd61ac9b755439c1d8e7116b344a04a745a9aaeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724132, "uuid": "878555c2-cb80-45a9-8c99-6cafdaee0f41", "comment": "Malware payload (RemoteManipulator)", "value": "37265ad714bdd91ada99253f9472520a20cb5d61d096e4361a6f743be8104cda8e47350f6ed83a7f0f077a905bf9c1c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724132, "uuid": "efbc3a0b-028c-47d4-8610-a99887f8e296", "value": "T1C9271253FB84AD3ED4AF1B364477891C9D3BBF5166164E0A27F46C0C8E365802A3F686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724132, "uuid": "601970ff-a962-456a-a192-c46751520890", "value": "a2adaf9422c8d5596ce912860ce76592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724132, "uuid": "53d7dfb9-2170-429f-8f62-7dd78db33c7f", "value": "393216:KNKczZvLdLd8gBsuTlicKzB/xONCdfQt4qxT:GKczRdLdlBsylicKzBYCdM4qR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709724132, "uuid": "943b2d64-3476-4693-ade5-2bb36f5261f3", "value": 20325104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709724132, "uuid": "8320da64-f1c1-464e-9aeb-b9a56c295556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724132, "uuid": "d6cd5a64-74e2-4d93-9d5d-b1f230bc3d85", "value": "856E0406D6986CE8C0C544BAA88A1409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ccc0aa-db7a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1709702915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709702915, "uuid": "1f4ea21f-42b9-4338-a8e9-7fe1c4015e74", "comment": "Malware payload (XWorm)", "value": "6965b7b76bb4e37b1fd4ca2fb58dbf68", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709702915, "uuid": "035c802a-538a-4432-9407-5c31b51c91a6", "comment": "Malware payload (XWorm)", "value": "18c160d3133a43f43918a5b270073a54932aad547c35b37e4ae67b494af257ef", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709702915, "uuid": "83484bfa-ed43-4cfd-926b-90b6fc284d77", "comment": "Malware payload (XWorm)", "value": "c523e29937b891e5b23beb8182e25a2b7c31e37a", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709702915, "uuid": "7a0cb773-0260-4077-bc8f-ac1ebb4739fb", "comment": "Malware payload (XWorm)", "value": "f15745d5dba09c2e9035b197fc26170da102bedb7162f24d04d45c81e7152c39838e81256c70c2e78db88ebf99d225b1", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709702915, "uuid": "17106de7-21a0-4b06-8ccf-71a54abbb68d", "value": "T1EA455A8257E810A1F1B227341BB133689A73FB61E5B4C14DB96C1A5D4F52F848E31B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709702915, "uuid": "965c63a4-6b6c-415f-87ae-081a8b2e0bf6", "value": "96:5AuvmbhCGVUPq/K/pQQs4llcYVIpRyE28fy:auvt5qShQQs4llcVpRyEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709702915, "uuid": "79974926-7d11-41fd-b022-d9329c7deb1d", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709702915, "uuid": "b09d353d-a622-42ee-865c-b21e191180a6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709702915, "uuid": "67e24107-5bcf-4089-b9c9-4c211eb0216e", "value": "65333902.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7767c5a3-dbf3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1709754922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754922, "uuid": "5e53e1b9-b971-4fe9-a8fc-4ce91c506925", "comment": "Malware payload (Metasploit)", "value": "c090b068bf42892198b06415d6c348bf", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754922, "uuid": "666f5a34-a5ce-41df-b471-a9bd44669ded", "comment": "Malware payload (Metasploit)", "value": "1b0b6d51d6ea22574c9252ec096477a78e1f2ef10e92cae027292f4418c885b9", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754922, "uuid": "7c58188d-8068-4d25-b551-31cc217a1b66", "comment": "Malware payload (Metasploit)", "value": "a3b0cc8346690154db96605285e3216ced441832", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754922, "uuid": "f3269a18-cc1a-4e75-814a-663b6bc29680", "comment": "Malware payload (Metasploit)", "value": "1bde78cad77f583c7d3f2cb356d9a4fb4bee1d995c87a956f19a1c1455770175341de9f10aa4bd51704323842026b736", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754922, "uuid": "5214d4c7-e532-4cf6-a93d-13b7939921b8", "value": "T1E161C0932151B8EA414283BF3D4966FAC07FD224A64A7044FB8C5F98F9DDE63398D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754922, "uuid": "0fb5ddaa-7427-43e4-ab04-15bae89bf67c", "value": "96:aXZGtJLH3/otSgkWvD+CfBZL0HcmAiBrVM3+oy:jV3ApvAHcmAiBrVc/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709754922, "uuid": "2a209903-156f-409d-aa32-c3047e7d680b", "value": 3238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709754922, "uuid": "787b82be-3269-44d4-a4df-8ca34589f340", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754922, "uuid": "41fc9eae-9b23-4fbd-bcc5-6e7590ebe304", "value": "FzaPxMEv.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c355c37-db96-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1709715013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715013, "uuid": "c825fbc3-57a2-4d4e-97f2-7726f3cce234", "comment": "Malware payload (DCRat)", "value": "622af327a5c66ca6d6d41bf02384b590", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715013, "uuid": "a0679c6f-f1f4-46d7-86a1-388f1e0cc3b6", "comment": "Malware payload (DCRat)", "value": "1b41fe8ede3b534d1ce19e0d2976fa735e7e2187d17dcbea6c337ed176ad038a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715013, "uuid": "3e4f0315-b1ac-44a0-b41b-2dae445f192a", "comment": "Malware payload (DCRat)", "value": "2e09d3d9017aec9781b77144323eacb06e7838c4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715013, "uuid": "c933d098-1795-4668-8fe1-8861383d73ac", "comment": "Malware payload (DCRat)", "value": "0494259d7b245557015ad5959ae8cf71aef79245505d920cc0ab7fb8d841fef6e0e28fd2a45799f0b10ae79719d84aa4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715013, "uuid": "911b34c4-07a3-4301-824d-01a6207fd413", "value": "T1D4C52302BFC29272D063197379396B11697D7E202BB6CADB6344662EDD306C0E731BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715013, "uuid": "d8adcf1d-2637-4634-9c6d-5c2c1692436f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715013, "uuid": "b48c1a92-d936-4947-9323-e4da48f6945c", "value": "49152:IBJgMDRANx3WB2aXuAoVNcqUhwMH9tM+EvhyJWXovJaDiSNESDgKZR8f:yn0VkZ0yF9tMhGwHuV5KZef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709715013, "uuid": "d4c28556-ee37-410f-99f8-2fd92f1854e5", "value": 2730343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709715013, "uuid": "3cec0b7f-e524-484a-bacd-290b04c80eba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715013, "uuid": "7d7dec1a-3b55-4133-b909-39c73e4867bc", "value": "622AF327A5C66CA6D6D41BF02384B590.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16953eb-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718941, "uuid": "2af4fae5-2116-4b45-b056-b9ed3622818e", "comment": "Malware payload (Mirai)", "value": "0797755b58fac8024b211406b2e3d858", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718941, "uuid": "f821c351-522f-4f5b-8ece-ed0983d4ea84", "comment": "Malware payload (Mirai)", "value": "1bf3eae2a08bda3bd8883267b3f4e5ac0f1bfe931de383e55aeb121dfd806494", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718941, "uuid": "ef5b2203-3ded-49b4-bda2-eaa58001a2d3", "comment": "Malware payload (Mirai)", "value": "6ad9277f49a37cd073eefa794d3ea3a74d587e6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718941, "uuid": "bcfb8e15-8362-4b5c-9ef5-43c9f9496b3d", "comment": "Malware payload (Mirai)", "value": "f02b87126134cd0800a93bf99201dfc996434b5ee7578342f80155a1e89c78e0668909189bdd2f7e45f2be87dfe86c2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718941, "uuid": "6674f6b6-0b05-459d-847b-8e9d6f23c960", "value": "T1D5042A46EA404B13C0D627B9FADF42453333AB5497EB73069628ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718941, "uuid": "590a1577-0bf1-4920-a107-52d344988eda", "value": "3072:BGL8ONbBLbcBCkoajwdyqkkIPT/6EBp1C/nJ/o/wM/R+E:YLzBLbEloajwdybkQRBnC/JgIM/R+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718941, "uuid": "ad7fd7c8-7e91-4e02-83a5-c2c5e2558a5b", "value": 179789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718941, "uuid": "07643f35-8a92-4f3c-bd72-9b825cf09084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718941, "uuid": "7a5c796d-f854-4895-bdc1-3e364ae3d857", "value": "0797755b58fac8024b211406b2e3d858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff1fd46-dbc4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1709734884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734884, "uuid": "2dd9a064-a908-4a47-82cc-b37f81fc5eb9", "comment": "Malware payload (zgRAT)", "value": "9bae6d3afb22e8f8c8aba60f652d55ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734884, "uuid": "62d367e8-7920-4e09-9714-b8d05b68ecab", "comment": "Malware payload (zgRAT)", "value": "1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734884, "uuid": "6a9407e5-4453-4c17-bc0b-28627f2aae17", "comment": "Malware payload (zgRAT)", "value": "9d909c53191dad75c84c75067594bd470cf34dac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734884, "uuid": "2c8a8a0a-f374-4d3c-bf73-b2a4af8fdc9a", "comment": "Malware payload (zgRAT)", "value": "2abfc55ba08bfaae83f9aebd75ce220f0a4e80c592a42f5c4bb6815b25eb5009f7a91fc0b285abc306a1d7a0fc623258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734884, "uuid": "c509a4ae-a067-4df6-af6c-84f96ef939eb", "value": "T1F8E4D0DD33FE6B46CABF92B920610C606A77EA04D293E7D319090AE01F8675E4F67513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734884, "uuid": "fa0c9053-e8e7-4f05-9391-6a6208a29e3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734884, "uuid": "d9f53969-938c-4a23-8b17-b59767d3491c", "value": "12288:tsQ4ZUXCJVkKs1Xx83mSsFhtFrnQbWWODTDBAYL/u5cvprvhrmYTl39521aV:todVknRxQBsFrFrnjtDT1AYL/Gkprvh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734884, "uuid": "7ce286da-4ccc-4f20-b16e-c72f1e623b82", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734884, "uuid": "9352b95a-6a07-427f-be1c-1d42af92f82a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734884, "uuid": "c4fa4792-06c7-43b2-a479-27ee334dafa4", "value": "1e66433493d9aad550a2febe2433bd117129e968b055841c7ae1997369ac0511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e21acc-dbb5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709728292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728292, "uuid": "bdbaa9fa-739a-4937-b920-8c97490c9c98", "comment": "Malware payload", "value": "d50ef958e78dabaa06e17f2da366827e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728292, "uuid": "dfb246d1-f939-4896-a503-368062d9a13e", "comment": "Malware payload", "value": "1f7d1333f4b7278b0ce6aa6dff95e3dee456f8f92c7263c29671ebd8eb62684c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728292, "uuid": "72570cc2-b3ea-42c7-b944-ab928fccd8fe", "comment": "Malware payload", "value": "3a23ed7198d6342e1956d524e869b7a269b78d9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728292, "uuid": "fc48c57d-50b0-4e41-87da-ecca6cbc8b70", "comment": "Malware payload", "value": "f3398a361f4e171e15a58884e11bd699a32c263aa4116e1e9152bab1080c6fbe2783b856cad63e2ce7c4744cebae1817", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728292, "uuid": "6e9ea546-6d99-4e54-b7cb-1174c7692ce8", "value": "T1EAE2F1C4CCC7903DD6A5ABB87AFF2B4A1401BB7649D7420D7742EE7136B9EE0401A21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728292, "uuid": "0c42eda9-9ef6-47bd-9571-672f325264e6", "value": "768:SnjxOhfPNfhvW5+1o3w1MFuLspRBb8Ln9M23yk3dVT:ajxido3eIRh8Ln93Ck3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709728292, "uuid": "2319853a-b97a-4251-8038-2f75808d12c6", "value": 33464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709728292, "uuid": "c4b11bb9-fa99-4950-9931-79fb1996e579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728292, "uuid": "3df0001b-7ee6-48fd-9920-8c14457781fe", "value": "SecuriteInfo.com.Linux.Siggen.9999.30817.7359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef51c51-db61-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709692040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709692040, "uuid": "2474c43c-15c3-4259-a472-9666691f3a4d", "comment": "Malware payload", "value": "9047c334fe9d580913c35de8d77ea28d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709692040, "uuid": "0426ea47-aad6-4c65-8dc7-8ac8c5d8e0cd", "comment": "Malware payload", "value": "230c5985a4a3b5f0e43b469a3de232a42829623815047c68a4e72748350dc9a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709692040, "uuid": "0d0a826b-522c-4046-bae0-1f4abcf25b81", "comment": "Malware payload", "value": "7847d998d14dabaf5ea8675bbbc3e9d4b9e8e4c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709692040, "uuid": "b2c7a6e0-7385-4e19-b865-060684aced81", "comment": "Malware payload", "value": "f52491d9514d51d56a48d2563dc3e11c0084047d282a2dfe151013637af1a3196d85b266e6cf098701d207c524841201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709692040, "uuid": "7a3c937d-ddf8-4800-9675-bced6e29588d", "value": "T1D5F49E1275D1C072C2732130AAB9EB7156BDFC324A354687B3883A696B742F26E34777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709692040, "uuid": "aa63f12d-767b-43e2-99d7-e81a6470e0c6", "value": "213e0a4928f644955b6c40c3acf835d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709692040, "uuid": "32174a06-b259-49e1-86b0-437440115346", "value": "12288:QNp51L0Z775xs2qnf8PtVXJSLKlK4pKJe5d0nocsxa3k48118t/HY4EErtkTd2h9:WJL0Z/mnet60yocssl8gY4hkTd2hCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709692040, "uuid": "75050378-41d3-4d16-b112-27b87e14ede8", "value": 790064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709692040, "uuid": "fad68986-247b-42a7-9065-b363ccb79e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709692040, "uuid": "0c7c6b99-c6b4-4c09-8aad-d3905a7aacf5", "value": "SecuriteInfo.com.Trojan.DownLoader38.19589.27482.20067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b3de6a-dbb2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1709727161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709727161, "uuid": "d93d89a4-9026-4665-a36f-dc03aa1c313d", "comment": "Malware payload (RemcosRAT)", "value": "91d1b6907220b816ba21d162fdd9acdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709727161, "uuid": "69c6ef67-7c84-4362-96c5-992d60dc96d7", "comment": "Malware payload (RemcosRAT)", "value": "232046ca94380ae1e96d74e71feaaa72abacd35e04f26b00c7010318769c8eca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709727161, "uuid": "afd5d2b5-8f03-477f-aeb8-abb3c72fc243", "comment": "Malware payload (RemcosRAT)", "value": "f210251d1c5af5663ab59801f014f34a1e257836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709727161, "uuid": "ce473cab-f0b0-437b-880b-1f8f5326d2ae", "comment": "Malware payload (RemcosRAT)", "value": "d53ed3bcbef159cf7f0510205400e7f700232fb4c33ccb079caf7c25133c8e42f033f193ad49f95c74f1ab9633f8f2d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709727161, "uuid": "6b3f6efc-38a9-49c9-8ebc-0e45e3ebafd2", "value": "T132A3BEC3330AA5E6C8BE0930862396868B72AC3D8561566B73F3722F5D77721647264F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709727161, "uuid": "7d69bf54-c77e-4576-9d3c-924786efb7a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709727161, "uuid": "39a92187-2368-4533-bce3-25c81ea6d1f8", "value": "1536:0gz/qBSKcOr1q6QkjfkQUk8+k6kawM1x8Dkf9danie5imKpi:0gISK5+1k12b/Af9I5hKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709727161, "uuid": "dba934f5-f843-452b-9fa9-bc7d3aa983e5", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709727161, "uuid": "14dc7a39-d267-4384-b3ce-deceb66753b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709727161, "uuid": "1d491ab6-4254-489e-92a1-d614c13c09a7", "value": "91D1B6907220B816BA21D162FDD9ACDC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdaa4bf-dbd4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1709741563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709741563, "uuid": "38b07d32-8d3d-44a4-b683-ddd6a9e580be", "comment": "Malware payload (Pikabot)", "value": "4b1518535af6344af39bd90aa02a6c0d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709741563, "uuid": "54e4f447-f8c3-45f0-8aea-dcb5fe362d8c", "comment": "Malware payload (Pikabot)", "value": "238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709741563, "uuid": "fbee5e33-0d41-4134-b1eb-38fcda6e6b64", "comment": "Malware payload (Pikabot)", "value": "183b74ec94b19c1f4af194e4d606270053669913", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709741563, "uuid": "2c850aca-1a6f-4671-bcc2-b5b652c9031f", "comment": "Malware payload (Pikabot)", "value": "27a5d8f8ed8a8fb64a3d8f53c56385ae223070ecc18ce8460b19ec13ff035d4bf064ccfc5f31778b9b54d0ec87447f40", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709741563, "uuid": "2aa1646a-e5f9-458d-b1c8-df142daa14e0", "value": "T1DA05B02138C2C072E67E213B85A9F77519AEE8310F3097EF5BD8067A6F346C15A35627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709741563, "uuid": "2e8e220d-568b-47bc-8a05-2e9f145fc99a", "value": "55f1ba0b782341fa929d61651ef47f0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709741563, "uuid": "0409b49e-0f95-494c-8765-96b8db525146", "value": "24576:je9nfmpSVmL+Cf72yb1SFEtEfPmY4uRD7HpUMhOw8ghE:qBmpSVmLfCDfPJ4cDFPhmghE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709741563, "uuid": "2fe3dd1e-16a6-45e2-a90a-c95ec887793b", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709741563, "uuid": "ab39fd6b-5c68-4471-acff-18c2c8a00fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709741563, "uuid": "73d2ca0a-b8f4-47f1-8db2-d05e07b24eab", "value": "6772.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2758650-dbc2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureCrypter)", "timestamp": 1709734083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734083, "uuid": "77bf18e6-2a30-4c13-9cf4-e107094bfc91", "comment": "Malware payload (PureCrypter)", "value": "b1ad8358baf4e879f8b639bb37900c43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734083, "uuid": "57dbddaa-174d-4c76-a81e-f8d8f895ceb7", "comment": "Malware payload (PureCrypter)", "value": "23fb58e4ba4119044805c37bbc7fdf2bc69b48964fc1a5008308958dfc10e1e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734083, "uuid": "7dc01ff5-d5c5-44d9-a50d-cd4cb03fb6f8", "comment": "Malware payload (PureCrypter)", "value": "a71c8bfa576177535de7f23e05210dd4aeab369f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734083, "uuid": "8455537a-12ed-4d77-a911-53fdf2ea78e5", "comment": "Malware payload (PureCrypter)", "value": "f469031d97fd0f3c90fb705ee586e8cae0a350e15d70e97753982be6cd5f0de89ead867a289ac7fad87f2c04caba77f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734083, "uuid": "317d1d8e-bfdd-40e2-b24e-e062b5903719", "value": "T179F2C617F26A8150C15BD33BC6F6482003E5DEDEE4E3E35E788A730A193B385859DA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734083, "uuid": "27c6b628-9227-4acc-be96-0f325bb5ebd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734083, "uuid": "0672f29e-6622-4e6c-aeb0-84f98157c7af", "value": "768:+DfjzHwpLs1vLL9Eh4Iu1/CTPQGjnI1JWE0/ay:+TjzHwpLsZREhDByWE0/ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734083, "uuid": "4a767177-c8fb-48b8-ba0e-4279c46e77d1", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734083, "uuid": "f1c80d19-78e8-4a40-96e1-4289dc9ef5c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734083, "uuid": "36c6cef1-43b1-4ebc-83e8-4060285677ee", "value": "23fb58e4ba4119044805c37bbc7fdf2bc69b48964fc1a5008308958dfc10e1e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe25e5b2-dc07-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709763738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763738, "uuid": "903281fa-55a3-48e1-8e50-dca88bea3be2", "comment": "Malware payload", "value": "7e7b2bde591d9cbe7693a7ac7a3cd1bc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763738, "uuid": "77c18b33-5d1b-4ca8-81d2-b8e33ac3e5cd", "comment": "Malware payload", "value": "2700c52922d56c7fb2e1de12640cbe19884dd919461866f78c980dae51e892c5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763738, "uuid": "2d8ff895-881c-4292-aa28-f427b194c6ce", "comment": "Malware payload", "value": "ee733b00c888f98abaf45e77892c489daed913b8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763738, "uuid": "02131e11-167a-4c3e-9961-a697da13b0fb", "comment": "Malware payload", "value": "37af8e721dd80d1e93fe086d996533643f2e0c481e54ccc06ca8719f471c1a1f9c2487bdabb3ff91f9496ccab93d00e8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709763738, "uuid": "cea9614c-1f3a-462e-a968-7a66f90dc413", "value": "T1023633119F392E6B0A588236787F6E1D1FF20EC044C9F0D6A7E9748354BEB9141A786F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709763738, "uuid": "8bd86933-e307-4cd1-b8f3-72ced8b311cc", "value": "49152:OqdbGY6LYD1griiGXPdguF6PDaVReWj8KpgxMpwP/AYs1jF+N7SmHO/08uFEaAk8:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709763738, "uuid": "08782ab2-28c5-4637-ba9b-be759fe5b079", "value": 5339844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709763738, "uuid": "2b68c792-7654-44f2-ae06-9f67ccc15a7e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709763738, "uuid": "c584a10b-ca83-4e83-aebc-62c29ada492a", "value": "gobs.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405bb86a-dbb4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1709727771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709727771, "uuid": "9aaab721-db62-4ae4-a311-947b5af735d7", "comment": "Malware payload (Gh0stRAT)", "value": "950fb981639316a70646026530100894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709727771, "uuid": "12e03526-bbf5-47a5-b0e5-fd31e55b4dcd", "comment": "Malware payload (Gh0stRAT)", "value": "294ae7dee3cf309163323e5d23cf71bab0507e996188c5a23309e8fce49942ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709727771, "uuid": "f82fbe0a-b761-4b56-b576-9d0439898cbb", "comment": "Malware payload (Gh0stRAT)", "value": "8b12c2b1e77e2adb2ae744cd7837aa35fd8c427d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709727771, "uuid": "24785896-12af-4283-89e7-c25cd3d281fe", "comment": "Malware payload (Gh0stRAT)", "value": "1405fb1bcbebfdaf33aad05ff839597a44df229368983aa7b47449f98643d17ebc57c3ba5e9913db6f04127897ab166a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709727771, "uuid": "bf88ff6d-5175-4f58-8f2f-1debae302510", "value": "T183449E62F5C644F6ED15143014EA2BBBA639FE450B06AEC37714EF291D33292A73724B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709727771, "uuid": "36e34110-dab7-4c02-8638-9b0c74159e17", "value": "0533f8fc6d242682a6c09fa97fd55f21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709727771, "uuid": "13750677-9f0a-4f48-90e9-1fa7bf1a0a08", "value": "6144:B2Rnh5EsIm2EJ7RNYQRcyXthY09inGogjf:Beh5EsIYJdNPd9G090Nif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709727771, "uuid": "9668a8c4-5211-4383-88d7-6fc5f33460dc", "value": 274446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709727771, "uuid": "d31f84f9-8e72-4f46-a9ad-6c6aea1cc76d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709727771, "uuid": "99010caa-6611-4dfa-a42b-33a592de8e74", "value": "950FB981639316A70646026530100894.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a01998b-dbc1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1709733317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733317, "uuid": "bf879a30-150e-4487-8360-98ab036b33c8", "comment": "Malware payload (CoinMiner)", "value": "fb8ddd837ad8b94f1faf0b4920ce7b2b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733317, "uuid": "1291a441-8d6c-4537-a50a-be067f66440c", "comment": "Malware payload (CoinMiner)", "value": "29645afd1579bf501163d73ffb4cefe7043e85b47f030a2c633d721a9b10efee", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733317, "uuid": "0f9a2851-d70f-45c3-8523-f7ea0a769207", "comment": "Malware payload (CoinMiner)", "value": "c3bc51f18a1180be27c4ee0978aaa9e1295dbd4b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733317, "uuid": "f8cfceb3-9477-49ea-aa47-28e21fd853fd", "comment": "Malware payload (CoinMiner)", "value": "c7e32c03f73ab11d96eae3c7b6d8f8db707fb3831b9b11b9f1a554fb3bbea6052bc664c3bd1c6d707ca41d29bdb2868e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733317, "uuid": "3a42e29b-038f-42ae-b6ee-9c447cfea218", "value": "T111F3AE04B2E1C0B6E5A75A3508B0B6B11E3FBC726BB186EB2685337E4F712D05A74357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733317, "uuid": "6cd7593e-ce8e-484f-86db-3cf00af43db5", "value": "efddc832809352fa5626b950f8ce5fce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733317, "uuid": "da35a837-2826-4e97-9129-95e206bad7c4", "value": "1536:IwYZ5gZyjech8y/nK/bobGPgeMWKQxljH3PBe/8YkfbM9Wzw1mE3SmJQENYmAzTa:YiZpyDz/WVPX/9CWz9xmJQMYmAzsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709733317, "uuid": "71fe3ce3-7f55-4d9d-893e-0aed75d53927", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709733317, "uuid": "846b08d3-5139-440b-8d2d-6c9dfb2582ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733317, "uuid": "fded40d9-5dff-465d-8020-547e270c136b", "value": "fb8ddd837ad8b94f1faf0b4920ce7b2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df590dd2-db99-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709716441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709716441, "uuid": "a13881af-0968-46f9-955f-e3cdc5197333", "comment": "Malware payload (AgentTesla)", "value": "422dae158a15725dd2f81a76ed1be6e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709716441, "uuid": "7ffb30e5-854c-49b4-a368-d729baa306e2", "comment": "Malware payload (AgentTesla)", "value": "2b638047b4126420741fcbd3c7ea9b276f48a8005a629955f8a568cc7e7634c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709716441, "uuid": "3fa4264a-762e-4ee7-a1f0-6f68bd3ab369", "comment": "Malware payload (AgentTesla)", "value": "fc02bd1445823f87cc79fe6c4488786fdd862450", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709716441, "uuid": "9b8ccf06-3b01-4b2a-bbe6-1b37f69a8923", "comment": "Malware payload (AgentTesla)", "value": "40bcdd642061c5f5be2bce2fbb53e43a9015c11818aa4a78d9d7274d8f81c890e7f5d66484fc7fd174248ab6b67649be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709716441, "uuid": "e8f8f014-f549-4192-b3ac-86d2c2183ff7", "value": "T10CF4120573F94B55F9FB5378A078440107BAB62B7AA2D32E1DC0A0EA5D777010B15FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709716441, "uuid": "b468dad4-9fef-49b1-9ee3-7563883a5782", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709716441, "uuid": "61cb9193-1f98-421c-8439-16a41529072c", "value": "12288:P6FO1lnaAU9/jHt3lutbcqBMfpbQMQGuTOJgPnp5hONvtMkx+qLhmkR:Be/jHt3MZc8c+NTOyANlMk1LT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709716441, "uuid": "9c68427f-1101-400e-816c-415d66f45ecc", "value": 748040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709716441, "uuid": "6c1839c2-efe5-43a4-986d-5b884e11c0ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709716441, "uuid": "61e8cc30-aeef-47eb-b18c-230d9401e3eb", "value": "Product list.png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b818c1-dba4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709720881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720881, "uuid": "85ab52c2-3d59-491a-8bea-68f990e3e3b9", "comment": "Malware payload (AgentTesla)", "value": "1b66af68f8a9493ac8426fb7d2e27659", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720881, "uuid": "625d4dbd-abe7-4a23-ac32-b379ac58976b", "comment": "Malware payload (AgentTesla)", "value": "2b9f20a668208149cc54154a7da1238620e1242310f4000a1198b14c0466b2b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720881, "uuid": "7af003b9-2c13-486f-acf9-448911a978b2", "comment": "Malware payload (AgentTesla)", "value": "eef1fd6d024daaf4b9ed9af79e705deb4550f5e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720881, "uuid": "d30dc466-2280-4f55-be43-a79aab2a0c1e", "comment": "Malware payload (AgentTesla)", "value": "4c4bb401e9c62ba14e67b33e1c2b1c904546e9adda3688c0946ad0dce5a79bdc91d630afca9efb6a5a15ef93e15e798b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720881, "uuid": "c7a9c70a-74d4-4e92-9ca9-712b65ff0159", "value": "T106F4F141B3F81F1AEABE9BF5613411140BF6656BB6F5E30C4DC460DA2DB5F018A92B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720881, "uuid": "3b93236b-9ab0-431d-adda-4807fb4f213c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720881, "uuid": "19989c6e-ef8e-4a5d-a558-edff47107a58", "value": "12288:NBt6AA/jOONWf1suK/obWDr3r8pKWwI4+FRTdJKjZkYAZCYjxu8DDLK:wD/jOK21LPCDMpFwIVKWYAZCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709720881, "uuid": "4d1ef586-b57f-46c3-9e58-57a1e1979909", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709720881, "uuid": "e37fc8c2-0a44-4065-810a-e134397d6c09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720881, "uuid": "1cb90da4-8af4-44e1-938a-4e36336e158a", "value": "SecuriteInfo.com.Win32.PWSX-gen.24055.12922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a9fac4-dbcf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709739668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739668, "uuid": "a3e2e3af-f2f6-4065-a4b3-c0f2e685562f", "comment": "Malware payload", "value": "d3423d951570ee0d955848cc500dc3bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739668, "uuid": "96b016e0-9ad3-4bf9-82c9-492ae4120ff3", "comment": "Malware payload", "value": "2e5a33df7fca5b2a0cbdb624cb3363d4b8aea7ffee1e83c64329dcf083607363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739668, "uuid": "727c739d-6b2d-40fd-a72e-fc40252970b9", "comment": "Malware payload", "value": "97c23aae15748e12bcab295c576ba271647a1460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739668, "uuid": "695ca6a5-9989-41bd-994f-c54ed27ff804", "comment": "Malware payload", "value": "af022fa2db52aaecf1588e777eb598b8af11143b032fd961a96f019916843d1e0b37553d1a6125db81b2597a2a1f6719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739668, "uuid": "9ae748d5-c906-41de-8d97-938084384458", "value": "T12B055B52B3C7D1B2EFA225F2D6B493761939BC35133C89CB7390382DE9A06C16A35395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739668, "uuid": "6414bb80-0068-4f4b-b283-9645f4e89331", "value": "c6226f6a092dcec547d41454113dfb56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739668, "uuid": "8aad5af8-b35d-4f4b-98f8-08949e9c9201", "value": "12288:7+ldKhooajkd8OqC1YYs6SePwPNRqJYyUNptUAqnjtB32L:7qdKhov5OfYYs6SNxptUF732L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709739668, "uuid": "2ece6eff-b096-47ab-90ff-a16cc5116ead", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709739668, "uuid": "6ea5757c-80cb-4934-9132-d34fd1a3722d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739668, "uuid": "60fa75e4-870d-4549-9452-99dea3026626", "value": "SecuriteInfo.com.W32.PossibleThreat.14052.23623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1f897d-dbc3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709734505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734505, "uuid": "9b584ce4-108b-4973-904f-b370397400be", "comment": "Malware payload (AgentTesla)", "value": "86d0186be0822a6a181878147843a89d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734505, "uuid": "2d7fd50e-5366-45ff-a59c-822481193fc3", "comment": "Malware payload (AgentTesla)", "value": "2ed67b7b3aa4d090177430d67a07cafdfc25e754604411ff68bf610b892810df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734505, "uuid": "37c0a1fc-51c4-4b59-a8a0-b732a620ba45", "comment": "Malware payload (AgentTesla)", "value": "2581dcf2284e6d325888888c71866698ce878eea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734505, "uuid": "2edd60cf-cdc9-406f-a2f9-c4fd22337521", "comment": "Malware payload (AgentTesla)", "value": "02f8a9d114c9e33f6f33e5d67b1b2eb77ad0fbfac4201608a9b2f3c9b612e8c0604397c87eaf922b7ca21cbb62adfe71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734505, "uuid": "0066fe51-65b5-48e7-a19e-4f354e781a08", "value": "T106F42200A7FCA33DE5FE9FB8F86491011BF9B8322A67D28D4D8451CD8476B510E61BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734505, "uuid": "cb033622-80ee-45ae-9526-363b783bf5cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734505, "uuid": "b30b4df5-292b-4da1-a68d-6bf36a477a91", "value": "12288:+zVMvvjpkDaBs/aoGIFPfm86tIRAKz655V5XYbh6a+v9u9orREc99p6LnKQPxB:qMnFTanu86tRKCH5Hfv9pREct6rKQJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734505, "uuid": "44a255ae-7a0c-4ad8-a590-cfc1c6a6db77", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734505, "uuid": "81537317-f95e-4b53-b950-b1526f073836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734505, "uuid": "c040eba2-a3d3-4fdb-bdb5-4580e8c5727b", "value": "2ed67b7b3aa4d090177430d67a07cafdfc25e754604411ff68bf610b892810df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a071c871-dc08-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709764010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709764010, "uuid": "7d27905b-16bd-41fc-b42e-a2957e111a05", "comment": "Malware payload", "value": "8be8228a720513916b86906754c0be19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709764010, "uuid": "716fd3ad-7e97-4d3d-af87-a0c93535eba2", "comment": "Malware payload", "value": "2f2b52c573ef08733bd89ec1ea48369d2e068fe5cf01d95c74af2dfaac50d65c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709764010, "uuid": "5a179b3f-0a50-489a-bbe4-b17423aac15f", "comment": "Malware payload", "value": "2a4a3aa346d0eb457af01ad7063566bee4e8efe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709764010, "uuid": "07097b6a-54b8-48a7-b274-fb996bbf311e", "comment": "Malware payload", "value": "8a2b6a84f2ba473a40cc7ccab5b65e3a8ad03cf94618a020f830dfaf2ab6a5b28e9aeaabf40b41ee037d3b69a75e3e15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709764010, "uuid": "69a53cfb-46fa-47fe-abf7-27d91559d645", "value": "T15164AF13A6CC7CE2C031027167BB97E5D72EED214BA1C58FA6C42A99997C0C376327D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709764010, "uuid": "88b5c276-190a-4e2c-8906-bc5741f474d1", "value": "99ffa1fe3b8cdde3dbe015b777fc147a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709764010, "uuid": "cf820905-b286-46b9-a7f7-a4ea0037b985", "value": "3072:PRNOixl3I2PpJPltc1//73h7OfBssFT+XVmomzZm0adTbfzliCKVz:P7OWO2jeF4edXSwdTrp8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709764010, "uuid": "bd01ccad-11d8-4a48-bd06-c9970b9baf8b", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709764010, "uuid": "0f223a36-2458-47e7-96ed-fdf6610979e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709764010, "uuid": "9a22ddc0-f8e3-4cd6-a5fd-98aa7bdc9009", "value": "SecuriteInfo.com.Variant.Doina.70962.23498.25743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63665ccc-dbc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709735131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735131, "uuid": "01187102-82fd-439b-916e-1cf65ef699af", "comment": "Malware payload", "value": "274fe6d4d89576c29d3b51722a5ea623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735131, "uuid": "fc1d1d5c-da62-40c1-a9d7-de3766312e92", "comment": "Malware payload", "value": "300e8ce709aa935c9d01ecc030034bc2f7f91ce5c7d39f9ca8f91e6573822e32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735131, "uuid": "13c82b57-a22d-460c-8a5c-72592d5c575a", "comment": "Malware payload", "value": "bbab8011291f5446e9893ece48e01ce76f663cb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735131, "uuid": "6cc1a3bf-0127-40bb-bb3f-0a1a9da1935f", "comment": "Malware payload", "value": "64374a1795e1c9aaaf88648c2b968519f8105a928576e3d8a151440d4857a055ab6f9121b0b0823d92d546fe4aad9753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735131, "uuid": "c78262e6-9945-4583-89eb-8cd761872ad1", "value": "T1AB5622FD6250371CC01ACC349433ED04F3BA551E4BE5E6A976DBBA807B2B821DA55F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735131, "uuid": "735c42ec-ef1a-424b-8abe-384124710329", "value": "b9681f00f1ed33f6057977c9165bc7c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735131, "uuid": "ab1f4001-997b-4ddc-a0f2-9d05d0aeb06a", "value": "98304:GHrdT1+yBdqx6xsMT3thgdDlpU1Rce7I8xcXCy4CrIISuQIPPycf/glyBDg8iSvZ:GrdxJkAPboDQ1iekMVy3t3BX00D6uZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709735131, "uuid": "e05a990c-7ad2-42a0-938d-9269d6a92c71", "value": 6121984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709735131, "uuid": "433810d2-632b-46ac-842d-01a333dc8728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735131, "uuid": "4500723a-fd54-4b45-9046-fbdfde7a9fdd", "value": "SecuriteInfo.com.Variant.Lazy.265729.1714.11867", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95462d2-dbf0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709753797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753797, "uuid": "928c8eca-7b7d-40fd-b2cb-3f2c9c4c813e", "comment": "Malware payload (RedLineStealer)", "value": "b116641699225bbcea28892995f65115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753797, "uuid": "545387ae-fc19-4a19-b360-8745b6965d1f", "comment": "Malware payload (RedLineStealer)", "value": "309d20f7a18a1ae1fed72e5c27b0ef2cc0d52dd1629efc250ca74b916730258f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753797, "uuid": "90d39409-df82-47f0-80d6-84e653813a54", "comment": "Malware payload (RedLineStealer)", "value": "b43f932fa89ba3ca01bbd7739a7e01d0508cfd70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753797, "uuid": "e3a15585-f2e6-45d4-bbb8-7b1cc4ea4968", "comment": "Malware payload (RedLineStealer)", "value": "12fa0f5c5cb69879b1604bbbab5dc290034174571c577121113cfa5cf2c4138de110a4a57c2cb1a41c8d3cf8a2b74c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753797, "uuid": "803f05db-b089-4856-b714-607b8a78961f", "value": "T17AA35D3067AC9F19EAFD1B74B4B2012043F0E48A9091FB4B4DC194E61FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753797, "uuid": "6b1ac49b-f60e-4169-9a9d-da2a7d9377ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753797, "uuid": "6f27477b-08fc-44e6-861c-76d14704a310", "value": "1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2X3tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709753797, "uuid": "ef71131e-00fb-4feb-8191-67c5932ea6b6", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709753797, "uuid": "6e90649e-3367-4955-b753-eef97368b3cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753797, "uuid": "430ac781-feb1-4531-a449-4fedfefe203c", "value": "b116641699225bbcea28892995f65115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f17d53c-dbcf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709739500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739500, "uuid": "7ed5fab7-e4b8-4c26-82a0-83ad19747457", "comment": "Malware payload", "value": "4e99e24649e1b32cccf15bc3a2a5f421", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739500, "uuid": "18e460ef-aaec-4103-ae05-513d912c606e", "comment": "Malware payload", "value": "31054fb826b57c362cc0f0dbc8af15b22c029c6b9abeeee9ba8d752f3ee17d7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739500, "uuid": "8f4f8b72-bb1e-447e-94a5-91969d9a1d26", "comment": "Malware payload", "value": "b69e922b5b0acb8a9bc0626449a3916425a178e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739500, "uuid": "4e1fb3fb-f1f9-4d42-9667-d7c94c974e9f", "comment": "Malware payload", "value": "d3ba4f9a982610c6d327091d4b75fb11386858c664bc8242dd0e5083b57d2cba3439e2b7f9c63b450a5be0c1a68a7da7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739500, "uuid": "9df519e8-77cf-4972-8384-67c14ba89c26", "value": "T1A9074943F89110E8C2EED174C5668222BB703C895B3167D76B60F7B82B73BD4A67A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739500, "uuid": "a56a2343-81d8-4ce4-a7c1-922d6d43f826", "value": "98304:T7YvDFIIsWJfre5Q0OcRzUSfCLyEPEJ8/2h1S:XOvJfCa6znIPEKy1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709739500, "uuid": "0514f888-d4a0-4caa-b38c-266b2235a022", "value": 16789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709739500, "uuid": "3e036560-3e97-4281-b558-9ab7ebb1ee6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739500, "uuid": "168185e7-48f0-4a7d-9383-934f5f738cb9", "value": "SecuriteInfo.com.ELF.Agent-BGX.9930.24911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29cf080-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718916, "uuid": "b6527b6b-20ec-47f3-8c7e-fcd1637f99cd", "comment": "Malware payload (Mirai)", "value": "be963430a32f23b695f2e7b9a0a269d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718916, "uuid": "e6210930-ed4a-40fc-979c-b99c8a91876c", "comment": "Malware payload (Mirai)", "value": "3199e1aa28c4f4f66aa7fd1298f036243873bbdc08f57057dc5f0450717e3193", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718916, "uuid": "793357fc-e968-496a-9b40-936e0f57d21e", "comment": "Malware payload (Mirai)", "value": "43700c487d71ec83acf4f243d10c778b7ff1f30a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718916, "uuid": "b9a53b3f-0420-4dd8-9749-a474c0b268fc", "comment": "Malware payload (Mirai)", "value": "2e04c8a4750a8d7a03486102cdce461a9fa8021e6b7348d20ad729a06e75a1af78f23ad322a9014dc23ec549095ad3d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718916, "uuid": "83ab10ee-eb4b-4ee5-bdb2-7ce745e05616", "value": "T1CBE329DBF800DEFAF80AE33748530906B530B7E145925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718916, "uuid": "c0180bd7-0049-428f-862e-273715e668aa", "value": "3072:RhRsZeqhrvKj/mCn9DA1wMlmvVrjbi1Lv16Ksy+O5wO:RvsWbnxAllmQLv1Qy+UwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718916, "uuid": "6ccfc52d-037c-4630-80bd-1a6e0b1e47de", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718916, "uuid": "c1944c3c-0ee4-4a1e-8c1d-5fedda2f45ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718916, "uuid": "244acc45-ff31-4b53-b102-b970ad6ec83e", "value": "be963430a32f23b695f2e7b9a0a269d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9293cb2-db92-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1709713398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713398, "uuid": "8ffd5d7b-c926-4b42-8200-8fe5d8d28f62", "comment": "Malware payload (Smoke Loader)", "value": "26372b0b4b307a2d1b7ed4e6039ba23e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713398, "uuid": "dc7186c7-79d5-49ce-a42c-085e90f72547", "comment": "Malware payload (Smoke Loader)", "value": "336454ac34e8f8e0a87e35d3e140b5507a59fd100211f19c9f52829fb94ebe69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713398, "uuid": "f4bfbcf4-3727-4635-a1b0-ed548cdce05c", "comment": "Malware payload (Smoke Loader)", "value": "423a2290db7b757245efc42327ac9667c0bd91c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713398, "uuid": "28e146fc-b8a0-4da5-84b0-75928322842e", "comment": "Malware payload (Smoke Loader)", "value": "e4f2bffbdf70e3de2cfd72977f4a4b0f8be353e4e172802f909a558d651012dd4f48a8365d70f457f3473cb2c4804398", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713398, "uuid": "d8882310-1519-448a-8204-da7ee5540358", "value": "T186F3AE1172E3D475E0A7F9304AB582B18A3EBC716BB4519B3796273F1E322C18967327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713398, "uuid": "a564e9e7-ee3f-49f8-871b-40a711e107e6", "value": "c6d19c8fbbcd0c83570e7dbd10119e65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713398, "uuid": "2c0beedc-2ad0-4e9c-ab91-062edb4dd6c7", "value": "1536:YY55gZdDecFo+b3K//ErpPriC8YEJfIHooSi6B35R5W3ScYCcojrECIMckz+rug:hiZUCzKhJfIHBs35npcYCcsECIMckz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709713398, "uuid": "8cc6005c-e33a-489b-8258-6e9c18c3ce28", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709713398, "uuid": "136cba8d-2c48-4e31-83ca-0d225c5290d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713398, "uuid": "08313d13-25be-432b-a26c-685cacfb17c2", "value": "26372b0b4b307a2d1b7ed4e6039ba23e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f4564e-dba9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709723009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709723009, "uuid": "3e265db6-3e10-41d5-b864-22cc9c6ee2eb", "comment": "Malware payload (Formbook)", "value": "e1a4cfd3357d6e4dd940d53ae63f0571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709723009, "uuid": "93d281f8-8894-47f1-b9a4-d8d718388a9a", "comment": "Malware payload (Formbook)", "value": "3507788e93b0a17601bdcb5be7e9409846e3e65a1260ea011aa7e67ee6d8d690", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709723009, "uuid": "991126ce-53b5-49bf-ae86-c68e6abc54ee", "comment": "Malware payload (Formbook)", "value": "7a2854f5bac1ef6acde9951d2cd5a1fa8e5b19e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709723009, "uuid": "b97cbed1-bd59-434c-888b-719dc1c7162d", "comment": "Malware payload (Formbook)", "value": "859c0c1476109098fef770b9f3f6120d24f611985d9f2c29713e31e032344f2f587463dc794707df7965fecaf57ee5c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709723009, "uuid": "d324b375-d455-4a9d-a18c-17cd23c0e911", "value": "T1DDE4CF9239CA716FDD2F4678034FEAB22A795CD17392486E5F40760D0C35A4A80EEDDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709723009, "uuid": "f6356f6d-546e-4ae7-a749-b724253cd0f0", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709723009, "uuid": "960ca172-3f30-4d14-bd9d-4ac7e43f6a10", "value": "12288:tGnhe2edwm/bbuwc3Wkyyn3p9JOKMCCmKmLfWLx35hXGbqvrd9qK2DX3q:SheXwmDKrByKt0zhRvr3qH76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709723009, "uuid": "d1367eac-3bbc-4947-bc08-d10373bd36a7", "value": 706072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709723009, "uuid": "2a402bf0-ed75-4efa-a652-9d02c53e7b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709723009, "uuid": "0368a722-29bf-434f-9e7e-f23ecf735ffe", "value": "rTransferencia4334300002017359pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57385a3-dbe7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1709749926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749926, "uuid": "954555f7-d9ea-4de0-b0d5-e0944260f2c3", "comment": "Malware payload (Rhadamanthys)", "value": "2581e50033ad492a7d9ab79227037143", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749926, "uuid": "cfe6e7f8-c599-41fb-9f31-8106a2a8d018", "comment": "Malware payload (Rhadamanthys)", "value": "3514f315ddb7d42ad66bf71ab0c2b7951f45d8f99a5edc4beb7405d86a6b5c19", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749926, "uuid": "49ba38a9-4311-48be-9841-3a0ef59a8c1e", "comment": "Malware payload (Rhadamanthys)", "value": "d8db1d42bc4e06f98d7f5c0d8a7c77f4cf5dd175", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749926, "uuid": "9947856a-7c56-4b5d-b0e7-815d149c7dce", "comment": "Malware payload (Rhadamanthys)", "value": "9a57ecbe1ff957494b3542ae4df9a964fe2103a7358d7689ffea9c69ca8812d57d08ab6f83ed7e4fe916302d2588d5a6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749926, "uuid": "194f619e-0f81-4c5e-81a7-024242a86bea", "value": "T1614111111BE60735F7F38E771C76A7209B76B80AEE12AF0E41A5428808A2600E575F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749926, "uuid": "45a8ebcf-f38d-499d-b1d6-4c1dfd17997a", "value": "24:8WYaNBmYhZHcvm4pyAcPkr+/47u+nQ6E3S14dd79dshavt3r3KrlcKOdm:8WYazmSZHomuK1j3SqdJ9FvpbolMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709749926, "uuid": "a73aad0f-6e37-4eda-97d2-26ea9b61914a", "value": 1990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709749926, "uuid": "5b5760ca-0d23-4c4e-817f-77880d27e591", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749926, "uuid": "c44166f8-9810-4737-9ff3-b26de4416520", "value": "Instruction.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87e2e5d-dbfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1709758467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709758467, "uuid": "7500dc04-5ee9-4e83-82d3-b2d06156907f", "comment": "Malware payload (njrat)", "value": "a72e66b3923e34d7692a187ebd0a3c04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709758467, "uuid": "0db7f0d8-e2d5-44c8-9b5e-33d409462bf7", "comment": "Malware payload (njrat)", "value": "36a849f05907b2d81a955ff817f2dc127309fe6ad76933fec34691cfd20fabbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709758467, "uuid": "0fbf85fb-0951-4ed0-a0ae-0635fd618a56", "comment": "Malware payload (njrat)", "value": "e6868a8c4660a067e1af5152f2a2e78ba4778e50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709758467, "uuid": "56d3b4a8-25e1-4b51-b5b4-7ef3ae014ac8", "comment": "Malware payload (njrat)", "value": "83076cabd141c1298af517c8ebfec97688aa5a6f5872f00bbdf73b4b4c72c92eeaf56b4aa847ace5325c3f4f77ef718a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709758467, "uuid": "e96122f7-78b1-4d2c-b649-4a358a1e7a17", "value": "T19393C04D7BE08568C8FD4AB705F2D41207B7D14B6A23DE4E8EF570E92A63290DF50AE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709758467, "uuid": "2b0f9f2f-96cb-41b1-ad37-9bbf566b65a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709758467, "uuid": "0586a384-45ac-4d20-932f-deed0feb3bf3", "value": "1536:+v+R1CNpqUG+gRJNNdl4Z+5ulKLrF/zQbvKqsVechmQ1X0LJdee:+mXCP0+yJXdXulKvt9q9cxkLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709758467, "uuid": "f020af80-70fd-40ff-8859-8c6db58809c2", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709758467, "uuid": "0fecc0f4-c76b-498b-b56f-7e3ce17ecea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709758467, "uuid": "898e7186-eebc-4a35-b9a5-5c3d17479d66", "value": "a72e66b3923e34d7692a187ebd0a3c04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639d8c50-dbc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1709735132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735132, "uuid": "92ce337e-ebe6-4812-b5e9-949d7e3872a8", "comment": "Malware payload (AsyncRAT)", "value": "163e9f51615afbfc868c18495facf8fe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735132, "uuid": "4737c467-5ca7-44b0-bbe0-555c22da2f2f", "comment": "Malware payload (AsyncRAT)", "value": "385297b8e564708d62c0e55c433b22c6307d4a4e240b9091ff51887de6bdd44c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735132, "uuid": "19baa720-88fa-4036-b6c7-39b73d6afdd3", "comment": "Malware payload (AsyncRAT)", "value": "81c49fbf4da6dc90fa001f8d78472d351ac7a187", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735132, "uuid": "767e7176-e4a1-4efa-b5ad-7e125d60e9f4", "comment": "Malware payload (AsyncRAT)", "value": "d780ed72c3a17bea21a39b116fd5d871994d41c79fa34fc1d6f956f5f1272772d20e6dbef980bc66d2e76223b4776d34", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735132, "uuid": "1d969a65-11ba-441d-885d-0f81a40396fb", "value": "T17AF31E14F8EB3119E42BAEBADAC9A1FA8E9D76532615370A0733C2430D115DCED93E35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735132, "uuid": "bdd8bc95-21b8-40ee-9fe2-88c69659a0d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735132, "uuid": "61c3adaf-7f88-4000-bb26-bf220c36ef1c", "value": "3072:NaceTAwkqdaADufnyBy2+VxYTsvUSnIQLgaj/9xAaz:NoTAZqdLKfYsvPnIEgaj/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709735132, "uuid": "b9b38715-71fd-4fde-9fc7-5a965d7b25c8", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709735132, "uuid": "3b4e3f14-1922-4659-aedd-9f3a3d552e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735132, "uuid": "f4bda6cb-8755-469a-90a8-0ab32ba0d738", "value": "385297b8e564708d62c0e55c433b22c6307d4a4e240b9091ff51887de6bdd44c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b652fc89-db8a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709709930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709709930, "uuid": "7954b6bc-6b20-4460-bc7e-e9fdd6af89d3", "comment": "Malware payload", "value": "27ce5598844f3d27d7abcc9097c2c692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709709930, "uuid": "9f5920a3-b343-4309-9d56-621f5e6be773", "comment": "Malware payload", "value": "38ca05ca06dad8bd650e58050ae7db66f7f6008dbec8b0b2f7e4f3910346c741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709709930, "uuid": "4751eb03-21fb-40a4-8b31-781b94c34da6", "comment": "Malware payload", "value": "7f9f881c00e9975dc18d804fd315eb09237fa4b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709709930, "uuid": "2338c841-2053-4be5-958a-ef11b32665a0", "comment": "Malware payload", "value": "b60f80ed5d7b24514c22a984fc0c15f2d64fd67cf9c26f3db3df428771d6f32aa1143f03153767cd93df72ffa4f69a14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709709930, "uuid": "e3d09dba-2c47-4716-98a0-87f2c55d2c94", "value": "T18F75332BAAC09423CD01657D1A1AE247F8BFF3ED123F90436B309F93FA595496D618C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709709930, "uuid": "18fa7ce1-1d65-4452-a483-2559e456b01d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709709930, "uuid": "4ca9ff76-f952-4a6d-b757-61183cd12712", "value": "24576:vFVsXAz5Z/hk9pUxL3HJCHnEATznSO7jUwn8sb7xeFFGIPcwkZEAEKV0dgrqZNX:TsXQ5Jx3skazNpntPoFpSEAEuvrqZNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709709930, "uuid": "7292a950-2973-4792-84b0-b9919679eb89", "value": 1558200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709709930, "uuid": "68160081-d9bb-4303-a7d0-fffa8063c5c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709709930, "uuid": "1442d781-1c55-46e7-9574-5ea8577b8676", "value": "SecuriteInfo.com.Win32.Malware-gen.31849.9616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e23aa3f-dbf4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1709755336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755336, "uuid": "33db08fc-50c5-44ce-9519-7e093f5c1e62", "comment": "Malware payload (Metasploit)", "value": "94c78c0c1271112dcecf17ef9557d2c5", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755336, "uuid": "41fabf07-c12b-4daf-af0e-50c43bfa2353", "comment": "Malware payload (Metasploit)", "value": "39d5ec5af27ce18da21501d59d72063bbae2f7886a9da17cac4aa9f496f1dde8", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755336, "uuid": "929b3339-85ab-424e-8055-3e76f558e10a", "comment": "Malware payload (Metasploit)", "value": "59ea37d1e02df76a6cfd40ef24aa2527277ef4e3", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755336, "uuid": "c08f8666-40eb-4452-a072-7e8ea24f74f5", "comment": "Malware payload (Metasploit)", "value": "84bd218cbdfd1d16c081452a7bc79eca736f8953d1c8ac1d4128d661326383df014f43a48cf76aa07810b61e3e49feb0", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755336, "uuid": "0ce26b62-54d2-4814-8a8b-4930dc0b3aed", "value": "T1C461D0932151B8EA014283BF3D996BFB807FC224955A6044F78C4F99F9DDE633A8D2C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755336, "uuid": "a44ef260-917e-440d-a5b8-7c3e035db005", "value": "96:mGtHz3/otSf+1jgCfRJL0HOmAiBrVMeeo:ZT3GxCHOmAiBrVteo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709755336, "uuid": "ca45e75f-d009-4904-95f6-b9b5d2785bbf", "value": 3248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709755336, "uuid": "c197d316-aacb-4220-b35a-250710579bdc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755336, "uuid": "be060b40-08d1-4373-81db-de90e7339d5a", "value": "mLiFpWHE.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e200a4c6-dc07-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709763690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763690, "uuid": "5bba9ba9-77d6-47d2-ace6-26a290d8b13d", "comment": "Malware payload", "value": "65449e1b1f857cb5168a2524d5d37681", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763690, "uuid": "8e75b248-d782-4fdf-bb48-49eac3e02f7d", "comment": "Malware payload", "value": "3a5c4bcadbdfdae9975bd89b29a553cf249d1c9492f4f08e99a1468b27ac8306", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763690, "uuid": "41735f1f-e979-45a4-b50a-8cac12174945", "comment": "Malware payload", "value": "2a22c03165abd965b816f17dfc30c9d4fe826ac5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763690, "uuid": "1dbb8890-b045-4bf1-ad80-ee11ddae4211", "comment": "Malware payload", "value": "914149b85cecb22780c4f59410ab891fcb845fc7ceeb21a07c6ef6efe3a6a1526b4ae1009eeba861991eada33dfd1ae9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709763690, "uuid": "95d186a9-e337-46e7-a192-9289476505dd", "value": "T193C5ED5F2E579568631A98B7086E423BE088BE80768A834C774DD0B37F382B1511E7ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709763690, "uuid": "24f4f98c-aac1-47e9-b818-1e2fcdb0b157", "value": "384:oCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCdV:3xxxxxxxxxxxxxxxxxx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709763690, "uuid": "74a117ee-e518-462d-ae99-53f13ffe5b5a", "value": 2672944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709763690, "uuid": "a5bf39a5-46c9-4b86-9a6c-384a47700cc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709763690, "uuid": "a7e9e812-5bd4-4c02-8155-89670d86d5e5", "value": "Leak Porn MMS Teen Girl.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14160ea-dbc2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1709733947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733947, "uuid": "7922351b-6ff1-4fdd-8042-d331c77e8e76", "comment": "Malware payload (XWorm)", "value": "7a996462c7ff2b49c097bae22da37122", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733947, "uuid": "beda864f-a51f-4ca7-bc88-75886d62e2da", "comment": "Malware payload (XWorm)", "value": "3b5e7b59138c1eabe859d45503e46ed37ff7afa770c6eab837010661030c36af", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733947, "uuid": "ac7906bd-d875-4dda-8d02-b19703deff5a", "comment": "Malware payload (XWorm)", "value": "fac9c87c0df223def2c6a8b09cc11059df1ae159", "object_relation": "sha1", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733947, "uuid": "7fdaefb9-782d-4035-b613-54ba9fe99767", "comment": "Malware payload (XWorm)", "value": "f6e4cf57c70f50bad18adf54df273f91a0648ec5bfb4799512582450eb7d4fe25912b6bf1e25732ab7993cfe99537a49", "object_relation": "sha3-384", "Tag": [ { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733947, "uuid": "d0127285-4089-4c57-bc69-66c21c5b0620", "value": "T1F751F86C5BAD19C0DE61B97E30102DAE8DA807A24B14025A28FF82437B3DBBD425B885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733947, "uuid": "50b94ce9-8ec0-4617-9be6-ea7a87a30f28", "value": "48:9UwVKmWl6PodivR6j2dqvNjvcTHE7Efb2UV3VVjTTxq3:ywVKmWl6Po4Ve7GHPN3bj56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709733947, "uuid": "c7e8f555-c8fb-4343-8c1f-b650146f0b4a", "value": 3166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709733947, "uuid": "086134e3-e4e4-419e-8a8b-ca1e1dc3a774", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733947, "uuid": "83ce9753-db86-4a6b-b2b8-c641200476fb", "value": "4675673688.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4590e7c9-dbc4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709734652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734652, "uuid": "07ef894b-427e-4052-87b7-7b4467563242", "comment": "Malware payload (AgentTesla)", "value": "a26a40f74f17fa5e6b6dbf737c4909ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734652, "uuid": "ca14507d-e4bd-4620-aaa7-b6f73cd95c5b", "comment": "Malware payload (AgentTesla)", "value": "3c3319cdea610a64e68f388916aea9d48e726e8d8eddccdda8b48a0c48cb938a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734652, "uuid": "e06bee71-b94d-46ac-ac72-be26fa73ed50", "comment": "Malware payload (AgentTesla)", "value": "0d2e1016b02bb2d03b5a7bd71c33d6f3328bd706", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734652, "uuid": "6b3fc4ea-b0a6-4aed-b07b-518b98204af3", "comment": "Malware payload (AgentTesla)", "value": "f00efd55ecbc6010d10c21ad5c9b0c3e3d7f38265f6763419eda315e7dfec3a8c5819e01e7f13c08ac6a6362a41f47df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734652, "uuid": "fdb4a5fd-2a05-40ab-ba01-147dcd28c233", "value": "T13C5412E297279126CDC56E70604DD5E3B8B2A3071E93E55B2CC8F738CF857C6A7540A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734652, "uuid": "e53890ec-4310-4deb-85e2-25400a08681a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734652, "uuid": "f5694473-9133-4392-9b9e-5431b562d15d", "value": "6144:ast7rU7d3wGfF13wXsMnvemeF0yy/AZWARRaTlbY:FVm3fb3eVv0FzyLAL2bY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734652, "uuid": "48b502b7-c7ee-46a7-8bc2-75843f354006", "value": 282760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734652, "uuid": "1cd03460-face-41fc-9a67-b5f98fe50417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734652, "uuid": "cbd14891-b411-4175-b4b0-1d5086c4410a", "value": "3c3319cdea610a64e68f388916aea9d48e726e8d8eddccdda8b48a0c48cb938a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394fcfdf-dbb5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709728189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728189, "uuid": "67f5afac-9ddb-4b5f-a628-bf0d71f8c549", "comment": "Malware payload", "value": "4cfe473e8752402f42a19012359621a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728189, "uuid": "e872f2dd-c389-443c-b684-87edc84ad556", "comment": "Malware payload", "value": "3f83d9bb61b123df4ab78536f73bd3c035bd32526b4db62ed1815bf0fbf34993", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728189, "uuid": "99613caa-621b-47f7-ae2f-9c0e4cff734d", "comment": "Malware payload", "value": "6471e6e9aaecaff990c06b820858e4451725a663", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728189, "uuid": "146b549a-8897-48f6-ac14-148f28c04e9e", "comment": "Malware payload", "value": "a15a1fd1ad43b164317f9d8a337ce5ed5e7cdd760fee67e8ea3e23d217a7b0774d6ee0fb1b4b815727f41dc79529966e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728189, "uuid": "ada6245e-9981-4f8d-af10-6f18d3ccbd8a", "value": "T13DF2E11DEB10DE90DF6A423816F877E216A51E71CEA67C0C78E770C692562E03597361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728189, "uuid": "a7c25ca5-cf29-41e2-9ea8-71045ac3223b", "value": "768:gxL/fL6GhQMbbfnpaAehkIgPkN2+CzMn2O+4ndft/nmgJmS5:Sj6LMbbfpathkIgfrAn2gRmYl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709728189, "uuid": "5a98dfbb-fb59-4bd6-9521-0d6490e174bd", "value": 36860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709728189, "uuid": "0cbb59fc-7de7-430c-80b3-f52dd6a2f722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728189, "uuid": "b5d1a11d-a77b-4360-ac05-142a9953435f", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.31761.28470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804f60c8-db85-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709707692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707692, "uuid": "ebd078bc-313f-4ed6-a45d-086b582ef981", "comment": "Malware payload (Mirai)", "value": "30f976baa2d03734e6ca5c993f02cd49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707692, "uuid": "36ba7701-9779-4cc9-897b-1c08dba44756", "comment": "Malware payload (Mirai)", "value": "4185b72ad60bd5f4f7dda7101edddc86a1a2ac0192e3975562857705ec7b3943", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707692, "uuid": "f697e0d4-9e76-45d7-a1ce-4177c3367824", "comment": "Malware payload (Mirai)", "value": "0a9826d321f599708ec3d8150fba7cda94026a5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707692, "uuid": "0fbb4f77-1d35-46a2-9dac-ed696c83ea8c", "comment": "Malware payload (Mirai)", "value": "16d0393d1c3c3227ab1b75ab8d59f1a81ac92481df30e1b7e0a11469c1dc0ec42da1be2676940ec7a574d6aa380ee7f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707692, "uuid": "74d86283-7f8d-4aee-acce-c1782aeda335", "value": "T13104D716AB610FFBDCAFDD3706E9070139CCA44722A43B763674D928F54A54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707692, "uuid": "cdadf3b2-9ed5-40ab-b18e-82708364b9b9", "value": "3072:FoM0KKCD2XQ0AcrlBLwVW3CmRx9X6hHRyCcaolZj:qM0bDQ0zBLwVWCm3R8VpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709707692, "uuid": "185b318c-3266-4049-820e-35d5183117d7", "value": 186236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709707692, "uuid": "be68df12-ba9f-4a6f-9fa3-1cc4523829cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707692, "uuid": "3b800e9a-01e4-413d-bafe-566fd06a0782", "value": "30f976baa2d03734e6ca5c993f02cd49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7263d2-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718960, "uuid": "4cabd008-8356-4fdc-b776-92017df9d003", "comment": "Malware payload (Mirai)", "value": "67db742c21fb57f5dcb83586a528f7c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718960, "uuid": "ebd2b837-5f11-4d7c-a70a-207ff7ef12fd", "comment": "Malware payload (Mirai)", "value": "41f27b1f9203087297b8b5b00e305f0d6c2f289822ed0cbca168a8a79c5e9a60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718960, "uuid": "acb540c3-1962-4fa9-b7cd-16cab5089d80", "comment": "Malware payload (Mirai)", "value": "7694827fad469d376c0526a95505ac27223eca4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718960, "uuid": "78cd296f-4a61-435c-82ec-3b6ada81de0e", "comment": "Malware payload (Mirai)", "value": "168ee6fd62bcb2928ec3f05216a1275b8736abb01b6d0286fe249c46ffee05000526487146d215d8f99f79e199017bb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718960, "uuid": "97556c06-1556-41d8-a7a6-6a51e4fa0d17", "value": "T139936CC5F643D4F5EC9304B1613AAB339B33F0B52019EA43D7799932ECA1911EA16B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718960, "uuid": "e6639b78-4b10-4a9c-8645-9528d283f136", "value": "1536:xpmWc2AcighsZ82ic18cHHHD1mSsM8meUigBQ9TnkISGtAdd0xZ:xpmX2riED2im8SHHhmLVUBQ9kVTd0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718960, "uuid": "92a0627e-5d82-44de-b98f-5b22427be4a8", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718960, "uuid": "208964ab-f60e-4cf6-8fbe-5b0aa057af10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718960, "uuid": "0364e031-c4e0-4c7e-9578-9ea3538e2736", "value": "67db742c21fb57f5dcb83586a528f7c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911e7dcf-dbf4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1709755394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755394, "uuid": "a29a03fa-2c48-404c-90c7-166f74dda8e3", "comment": "Malware payload (Metasploit)", "value": "4515815996bb92bfc101ec785c75dc65", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755394, "uuid": "1dd935b3-cdcd-4519-bc7a-2782d72d1c90", "comment": "Malware payload (Metasploit)", "value": "4377e4584c8fdfba307ac4f61b6a3ae0e93fb1708ebfc6d1723a53e8fe500941", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755394, "uuid": "c1fd85d2-d93a-4d54-a156-940de869a49d", "comment": "Malware payload (Metasploit)", "value": "13e092ca6ed899868c025d088dc05cc04c6a1484", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755394, "uuid": "17be8874-d12a-45bb-968d-b1e673db3c74", "comment": "Malware payload (Metasploit)", "value": "a19755835a1cdd1ea96a97b4eda397f27681414eabc4a5f90121781401cbe05cb978def78bd1ac90568fc7e1b9e2a422", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755394, "uuid": "c5208e22-a439-4bac-b5d8-fab3f6e84c3f", "value": "T13861B1932151B8EA414283BF3D5967FA807FC224954A6044FB8C4F9DF9DDE63398D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755394, "uuid": "49b4708f-1155-4ecb-83d2-d23cb7c0b720", "value": "96:mGtmfgj3HuSHWvD+CfBZL0H9mAiBrVMVot:ZqgjEvAH9mAiBrVDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709755394, "uuid": "b18d6c4a-73ca-4590-b780-734c6e5f4d9c", "value": 3238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709755394, "uuid": "7060d594-9b0f-432a-a60a-bea76d527797", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755394, "uuid": "326f6b04-43c9-42ff-8307-1049cddccea9", "value": "j9BfPHdw.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d5fda5-db93-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1709713499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713499, "uuid": "2f422c77-ac21-4c0d-81f1-3c9128cb6a51", "comment": "Malware payload (Adware.Generic)", "value": "440e2e9c8e9cbc64eda27f7d7842d3ff", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713499, "uuid": "efaa4b2a-c485-4e3b-a893-d1b2b4bcca52", "comment": "Malware payload (Adware.Generic)", "value": "43984c0e919ea8830867aa2ef5dc9287f74361a112b7f0eadc3933db28b8e658", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713499, "uuid": "fc6a5242-67ec-4584-8ccf-388e7d3aa56b", "comment": "Malware payload (Adware.Generic)", "value": "698b7e7364cb8f9cc0c67ba50b87998c7c8dfa5a", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713499, "uuid": "7f4c057e-9011-4124-8e08-0c9a4e15365d", "comment": "Malware payload (Adware.Generic)", "value": "60bff932a58fb6b02fa9f649252b1118c2e0dc7b72071d69e6d565909696edc77de7f4548d1a1b9ff9224034f831bb5e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713499, "uuid": "3f1a86b7-8b67-44a1-b375-d13f53605e1b", "value": "T182673337F225B93EC82912324172E22005BB7F1A64164C5E67E42D0DFB7F1912EBEE59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713499, "uuid": "9cbbb640-afc7-4ef2-ac76-ebc894dcd2e4", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713499, "uuid": "ba637895-9f39-43a4-8d57-923cd37571c6", "value": "786432:kzbBqYCYV23hu8qvSI79IOKho3tP4o1AAAQWVk3xyo3C:GbBqF8dvSI79IOKS3tPRAAAQdhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709713499, "uuid": "42cee0da-2309-4011-ad7b-48bc1fe062da", "value": 31651384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709713499, "uuid": "74868aa8-133b-432e-a7d6-9e873e399568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713499, "uuid": "13e41113-a64b-4bf2-9113-78300bab2969", "value": "SecuriteInfo.com.Program.Unwanted.5387.562.4167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdadaec-dbac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709724650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724650, "uuid": "ca57b221-7b94-411e-98a7-9e241569615e", "comment": "Malware payload (Mirai)", "value": "6f408abb664eaa395bfc0e42d4bac1c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724650, "uuid": "7e1d3cb3-97ad-43e0-9907-14c6b3e82124", "comment": "Malware payload (Mirai)", "value": "46e876424731e459b057a8142378bb8a661962f1ee82fc1ca7502a3d80a51669", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724650, "uuid": "b5809838-c8fb-407e-874f-c5e509ffeef8", "comment": "Malware payload (Mirai)", "value": "20fe0eedb0516de8a2550c928e5c6ae9ac868e68", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724650, "uuid": "c1a6b1d9-b90b-4f3c-ac3b-2344e8c3eca8", "comment": "Malware payload (Mirai)", "value": "83771bdab0574259e7411f2f7b389f1e5c0e0195c633d864153ad8196515a90b8ef336a8ef19b26406314e6bd664a9f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724650, "uuid": "13c97d63-b387-4fa5-b565-9f39970cebeb", "value": "T1E2D30845F8415F23C6D612BBFB5E428D3B2A17E8D2EE72039D256F20378B95B0D36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724650, "uuid": "e7a1dd07-18b1-4d5a-8b60-5d2aab9c5d37", "value": "1536:dPTk45W6gJXa0BZkASzPFuAewIP4VUNGqT+YYfAgHxGTUEF2ld0pwywAFG1lOW8k:tTkesZkNzFui04MPaYYfAzwEzc5mjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709724650, "uuid": "67578544-f6fc-4808-9f54-e138ad50ff73", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709724650, "uuid": "3a1b6b61-4e4f-4adc-aa26-739724d7512d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724650, "uuid": "2633bbab-12c1-4e81-9023-393659030568", "value": "vlxx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e580264-db69-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709695716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709695716, "uuid": "a2a6fd7d-a444-43fe-9f46-4d3ac8ce87e8", "comment": "Malware payload (AgentTesla)", "value": "a364ed3ab21866c2f09f27a173e7765c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709695716, "uuid": "d2d266be-c791-498f-95de-5432305582c8", "comment": "Malware payload (AgentTesla)", "value": "49b6e39d3bad9886d52682f7cd3e0b2ba25b9cc6b6b58802858c8d3722d7deb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709695716, "uuid": "c4f9b314-60b7-4b98-8d1e-cd04cb8fe1a0", "comment": "Malware payload (AgentTesla)", "value": "7873d0cb5b54e445f4a0ee9691b20d3d842abae9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709695716, "uuid": "ad90c44d-8797-49fb-a0e0-de41b46693ba", "comment": "Malware payload (AgentTesla)", "value": "a6915d1e85fd7c76aaf4050f6cde6eba68bba228e62fbb7cb5d507adedd1ff147a7fe9e2e960ed63b472809143c8dd44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709695716, "uuid": "19563da7-2078-4293-986a-eb9649c9378a", "value": "T175F4024162FD4728E9BFA3B85478480143B9BB6BB9A3E31E5DC071D54E737008B52B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709695716, "uuid": "0590c0fd-207a-49a1-a698-b784b8f8c5a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709695716, "uuid": "50b42d8e-f482-4c71-b6ee-a91d1cbe9de9", "value": "12288:16FO1lzajY9/jFaUIU/noXtmjiKoHA8EdbK5O12bFO2Z0Mb/sL:3P/jMUIU/EmiTg8Ed201d2Z5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709695716, "uuid": "adc8223e-ecbd-4f2b-9a67-09735b69feb7", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709695716, "uuid": "39a63c39-0691-44a2-94ab-a752a8664dae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709695716, "uuid": "9b8bc535-85f2-46d3-9e88-d96bd604e2bb", "value": "SecuriteInfo.com.Heur.11794.18481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1df797b-dbb3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709727613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709727613, "uuid": "573b350c-dff6-48a0-a108-048a374570b4", "comment": "Malware payload (AgentTesla)", "value": "5253f06e68ee65074a8e5bf3b7cbfdd0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709727613, "uuid": "86967fb2-b886-4b75-aaa1-ed507d69fb8d", "comment": "Malware payload (AgentTesla)", "value": "4ac9c7a54a112dd411cb66b584ee61a9bc5a0e300350f469e6bcb923ff16d023", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709727613, "uuid": "591268a3-ed69-4c7c-82a3-03b9f297e463", "comment": "Malware payload (AgentTesla)", "value": "ec9410b4be13007b144f296c355e9fe6d7fd0809", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709727613, "uuid": "6ac390f3-7a4b-481a-99dc-30c3ec348c99", "comment": "Malware payload (AgentTesla)", "value": "39dfcaf74179a6ff42c242bcee2220e2ecb65a8f863016012006e8478172cfd1330dd5bf88dccaae1a27fe795c9c541c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709727613, "uuid": "3caa3c8d-e5e0-423d-9d7a-e812daf829ca", "value": "T16305D097B702BEA0C97D62752003747063F1CD918A96E22F3DD5F6E079263C5262A1FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709727613, "uuid": "c62d7084-c202-4ae0-88c3-b879f8a0d6bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709727613, "uuid": "2ad7b380-a0b3-40d0-84f9-fc640906c690", "value": "12288:JStAPDknbqnNfU5rJPUUgQmxzbuMynVEHGBvpgpPNUYU1+qcwC:96bqnNz/r6nVAGBvpItV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709727613, "uuid": "ae0d5dcc-935e-4925-8e1f-370db94bdfb4", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709727613, "uuid": "a53d2316-f236-4dd3-9d7f-e799ccb69ffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709727613, "uuid": "f108888b-bf14-4385-976f-61013a7b1063", "value": "V\u00e1ltson \u00e1t inform\u00e1ci\u00f3s licencszerz\u0151d\u00e9s.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79809bd6-dbf4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1709755355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755355, "uuid": "a17f11b1-0ce8-4ba0-8303-b657454413ad", "comment": "Malware payload (Metasploit)", "value": "a81e2294011c2ed8f85904926ad428ed", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755355, "uuid": "f823bd0d-8fef-44a4-ae64-feaaaa4635ed", "comment": "Malware payload (Metasploit)", "value": "4c464611b5ab88d75a4a573cf864776deb293aa2a8fc3c1c5fb17adab6cca8e7", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755355, "uuid": "9027b443-9461-4ad0-9efd-fa6795e78fb2", "comment": "Malware payload (Metasploit)", "value": "a8b82e61e65394ec5c59408fdc1798001aa197cc", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755355, "uuid": "6fa74230-3ba5-4301-ba81-5b6c0dbfbd36", "comment": "Malware payload (Metasploit)", "value": "317e9ad220da28a8560efcddfbcdb46cc4ef1f8c1e070bd8a929e601a24891bda3e6f8efbf735c3b5804561661f3da51", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755355, "uuid": "603e07d1-d197-49cc-b505-4bc52535320a", "value": "T17361CF932151B8EA415287BB3D4966FB807FC224954AA044F78C4F9CF9DDE233A8D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755355, "uuid": "efed4a41-338a-4af6-bf51-a34a7b45d32f", "value": "48:2+MTLimb70HeaSkuKZf+1jCQfBZL0HuQY3hFi5QsvuiBrVxqT/sH2:tGtkHeafuSf+1jCQfBZL0HCmAiBrVMs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709755355, "uuid": "13406749-818a-4978-a090-5020ad419b15", "value": 3230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709755355, "uuid": "fa4729f8-0f6b-4548-a14a-f28fd7fa51e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755355, "uuid": "e7a09548-078d-4851-8216-4465a317cb61", "value": "ccjSyTeh.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a7edd5-dbac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709724503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724503, "uuid": "e15b379d-9ffc-41cf-aa9d-2aed19f932b5", "comment": "Malware payload (Mirai)", "value": "a97aed220d7f236de08bf41a67c6f0a7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724503, "uuid": "5d4d04a6-9a44-466d-ac71-c52a7b8a27eb", "comment": "Malware payload (Mirai)", "value": "4cf3c3b480df0a5f72e91491191098386667a1dbc602d5bf843ae4e4e7771cd5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724503, "uuid": "cb8ad059-6cb3-4402-8107-1d2ed677c208", "comment": "Malware payload (Mirai)", "value": "9ad9a645c22e68fa3e9e7a14567f80982be8cb31", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724503, "uuid": "052e6fb7-2219-4543-be11-613e0d900ead", "comment": "Malware payload (Mirai)", "value": "c488e5dc656e7d91b386bad8074981092c962a5da3ac924fdd2e825a8007955ae4e25dbce1e91e043a814cd8dfa03961", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724503, "uuid": "8e85c246-8fb3-4f47-a18d-0e91a6835538", "value": "T180042A46EB404B13C0D627B5FADF42453323AB5497EB73069628AFF43F8679E4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724503, "uuid": "53b74a88-31be-49d8-9906-83435420fc15", "value": "3072:EZHZZVjxrvAqTkYaDsh+OcAc6/HSwBjum2cJsoyM/RMuWpO:EZ5/xr9oYaDsh+nA9RBqm2+xyM/RbqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709724503, "uuid": "29476029-f66b-4ced-926e-734ef01787ad", "value": 179803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709724503, "uuid": "66992894-cd01-4e1d-992b-5a2e895f2cf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724503, "uuid": "21c3bf33-b4b0-4309-b921-d420f2572034", "value": "vlxx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cad1ac-dbc4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureCrypter)", "timestamp": 1709734538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734538, "uuid": "14457a38-0b0f-4056-b668-f72fefc803b6", "comment": "Malware payload (PureCrypter)", "value": "e6ce53f5f02adf6ecbbbb5b2deef826d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734538, "uuid": "0ace9650-277c-4737-8997-ea76e9892630", "comment": "Malware payload (PureCrypter)", "value": "4dee51559f65ae85ed8486c69057f092a6d117c4f9697a0998ae4d49c4dd3f35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734538, "uuid": "f530c67b-dec1-4161-a9bc-868434cbb2c2", "comment": "Malware payload (PureCrypter)", "value": "7a941a3962f4a3777f923ed3d971951665daae46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734538, "uuid": "f2298479-6e2d-46b9-8919-07aeaf132935", "comment": "Malware payload (PureCrypter)", "value": "b79bcfd7452a19b6e2a1bad16578102d6d9f338fed7e8097b22340315096c0e0fe47fe800ba2b764406161c61abab261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734538, "uuid": "deea366c-849f-44a6-b1fa-a531191f6207", "value": "T128F2B5ABB27981D0C15AD73AC0D780A003E5DEEEF593D32A788A330519337D5C99DA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734538, "uuid": "a01cbfb1-35f3-4dc7-8b28-50945fb8e465", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734538, "uuid": "c4f2b371-4dda-45fa-94c5-4aa888ba1d77", "value": "384:WiCOtIBHLkS47tcrsZ6g4xYz1w63s6PKPtRYSN0tus6T+MEE6Cr3q0kYOSh5o0/X:WzOtIBR45nZ14xg1wX3PziqEm6H0/aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734538, "uuid": "60c320df-6d11-4304-9301-2cbba79ad551", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734538, "uuid": "f32acf79-2cf4-41dd-b0ac-f0e93b29d75b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734538, "uuid": "abb516ce-e941-4939-930a-ccd6cbebdc2a", "value": "4dee51559f65ae85ed8486c69057f092a6d117c4f9697a0998ae4d49c4dd3f35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd0410b-db7a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1709702906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709702906, "uuid": "1f71806f-c473-4442-8eb0-1839a55fe335", "comment": "Malware payload (XWorm)", "value": "ade08125c449e14d601f978f18d61ec4", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709702906, "uuid": "737875f0-8178-49c3-9643-286f5d2819b2", "comment": "Malware payload (XWorm)", "value": "508f5db44ab52911a474f526bfcb7bc16db8dc2ef04f58bf6e2a053b74d51ea2", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709702906, "uuid": "a0112e9f-0483-49b4-89a8-0cf140449f1e", "comment": "Malware payload (XWorm)", "value": "6387b1e091252f6aa8b13e1a6a61eaa6023506f9", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709702906, "uuid": "0a833127-1b3c-49bf-ab03-cd5015c8ef47", "comment": "Malware payload (XWorm)", "value": "dc9b43ea242036e89eb264b90464cd911a728f0dd9279b6a8d28051b30591f918bbe810dfb55899a523f30fd66cba7ee", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709702906, "uuid": "7b010309-dec8-412a-b31f-7af641693b12", "value": "T185510AB7AC42B258F6EB8834A1489F27357A14549CC999EF4E6F08053BF17A01FDB00B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709702906, "uuid": "5522dc56-a5de-45f6-89e3-2e40e80fddc4", "value": "48:9I/+dKmzs/fmqU7FD4pQWwRhgQldGp6P0Z+tTr4aY0k+:iGdNMfU2yWwbgQqFWUSk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709702906, "uuid": "dc701957-2007-44dc-8591-e3e7834da367", "value": 3159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709702906, "uuid": "d578c49c-5ef5-4f1c-8e18-1955251e4d76", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709702906, "uuid": "234bfbbe-84c1-43a3-83b3-efced0b5ebc6", "value": "65333902.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5652948d-dbf4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1709755296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755296, "uuid": "13041fbc-8ec6-4f5a-bc2c-32276969ae6a", "comment": "Malware payload (Metasploit)", "value": "53f52018e5036cfdd8bd558462ebbc0e", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755296, "uuid": "e8c82335-5881-4f76-8759-27fca9d9680a", "comment": "Malware payload (Metasploit)", "value": "52f4b9da3052bd5bf99bc87bc9d9eb5f94ce65ab89198c5408daa3d17ab7c4af", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755296, "uuid": "bdd743ae-7261-415f-bb5b-76181af38fff", "comment": "Malware payload (Metasploit)", "value": "fe0715d1a1cd9fb71cd2d297a5336cb2f217cb11", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755296, "uuid": "151727e4-b1d9-4c88-9169-8666d0ec1a53", "comment": "Malware payload (Metasploit)", "value": "1ef0a26179ae50d5d3793c05d4d3c1fc4b8696a1d9e1b10f3086eb1f131db60ff07f30a6ff12f0f4dc456c3025c9a748", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755296, "uuid": "0b843a4d-2d8e-470f-950f-f883e3c79eb2", "value": "T1A761AE932151B8EA415283BF3D4A6AF6807FC224954AA044F78C4F9DF9DDE63398D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755296, "uuid": "073c639c-9b59-45b3-9faf-dd481a9dcf41", "value": "96:rGtNMdj3luSHW1INCfRJL0HxmAiBrVMo9T6c9YH:ecjya5HxmAiBrV7TfYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709755296, "uuid": "665464c1-59cf-4635-bca5-0bb0a22406c3", "value": 3244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709755296, "uuid": "3a3720ea-8d7d-4f12-a5cb-a280de18b26c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755296, "uuid": "92b6b931-fda8-4be6-8b45-7433817546ae", "value": "Sz1zv4vb.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6e0f74-dbc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1709735255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735255, "uuid": "56bd5a68-3475-4b61-a02c-9c547de955e7", "comment": "Malware payload (SnakeKeylogger)", "value": "678efd821f0947313b2ff26fc788d47c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735255, "uuid": "82cf4409-5b31-4cf1-b95b-941f2fc76838", "comment": "Malware payload (SnakeKeylogger)", "value": "53ca502aaa95fc57f67552ddf0116f642c1c1cf81b8170b7881e68a8a423e45f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735255, "uuid": "68080480-1e5e-4181-acbd-9895553ffee3", "comment": "Malware payload (SnakeKeylogger)", "value": "221ed05f177b36b16c026b814c8bd9a6c472c770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735255, "uuid": "e7538763-0328-4059-8297-7a2a8ca2c5ab", "comment": "Malware payload (SnakeKeylogger)", "value": "03dd75ad300f212668155f81bb96c6c1449c60cf58cbdcfb13bdf18f7507abe9a94af101e195425f89ed0747951cceeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735255, "uuid": "1d34564c-9a97-49ff-a4be-747721e493f6", "value": "T15EC4236936A8471BC87F1C3BADF4D0668376108A725CDBDE5FA8532AA0C2F47136B714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735255, "uuid": "494916e7-895b-40a1-9b6d-e10aa460560b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735255, "uuid": "241a5dbd-4ab6-4b61-9d84-fbf070f28b13", "value": "12288:WxzScVvH/QF+alXwMT5gcy2HXx0trCF45rutsbr305CxvwSA:QzSOv4+mwMT5By23x0FCYStI305MvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709735255, "uuid": "4940531d-2158-4b89-86a4-9bc7b589b2a2", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709735255, "uuid": "84ed913f-01c5-4ea1-8772-a1a58f1c8af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735255, "uuid": "a2d3de82-ca9f-4b95-974b-3b1260c25060", "value": "53ca502aaa95fc57f67552ddf0116f642c1c1cf81b8170b7881e68a8a423e45f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a445a7d6-dbc3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709734381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734381, "uuid": "4dfe0953-de90-4cbe-bd62-663012796347", "comment": "Malware payload", "value": "7fa6e8ee5187c1b86f67fe74ca0836c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734381, "uuid": "6a66ee52-a0aa-4bf0-bff6-7cd0a601be38", "comment": "Malware payload", "value": "580e334a9fd92f01406519e2b370294ed1804f6402919d9c79c65e7e50e4677a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734381, "uuid": "0165d698-d0fb-4eee-a304-76e7cae69424", "comment": "Malware payload", "value": "d3a6503fb7a5070853c7e99124bd0ad16be9a0ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734381, "uuid": "557b1bd6-dfe4-43c7-b5d0-3dd995874249", "comment": "Malware payload", "value": "71262e54091fdd5950b9c582038d9a9511fcc3bcf0ccd91c20e1610b19f32999e5709be209a7e8b843169c9107a43511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734381, "uuid": "d95d9a6d-ad7d-49fc-bea3-ef887b15772f", "value": "T1EE65E04573E44CE5E5A78278CDB28A41E7727C465B30C7CF33A0626A9E73AE09D39721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734381, "uuid": "dac3f3f4-a05d-446d-a9e3-24030e2da33b", "value": "44fdab8d0f326e93fd3d8a50badf6cbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734381, "uuid": "b891bab4-7a41-413f-9007-06b0fc3a34d9", "value": "24576:mWy2ao//M5fgXe4i7ojhsP5Lgrk1TWb4AN5:mWyP4U52e30jaNf1TWbdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734381, "uuid": "9f84a716-31be-4b5a-bec7-77e9f5b5cec4", "value": 1500160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734381, "uuid": "4b003307-1273-4e13-93b5-6c024578b421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734381, "uuid": "dd0ccbdc-0874-4437-b7a7-a837a3fd38a6", "value": "580e334a9fd92f01406519e2b370294ed1804f6402919d9c79c65e7e50e4677a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af74ec1e-dbac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709724521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724521, "uuid": "2cdb6a17-af0f-4970-908c-07326d965d9c", "comment": "Malware payload (Mirai)", "value": "569940cf4b23198024a4efe8db74e933", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724521, "uuid": "68ba0c91-e0cf-4fbb-b9b0-3254ecb1cf9c", "comment": "Malware payload (Mirai)", "value": "59655aca776c2b83b6c9911e773aab364076a17366595968b4f173397f891817", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724521, "uuid": "64266692-da03-4001-91d2-790d02d31d4f", "comment": "Malware payload (Mirai)", "value": "1459328602be1fc529824eff9b2b30bcdea0a221", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724521, "uuid": "69527ec9-043d-4c7a-8dd2-fb76b5466789", "comment": "Malware payload (Mirai)", "value": "65095a408ea4aea985f831c156e41f05fb8cc90a4ef2d404dba48e8f5cc89e4468136edf1aba0d5794901ff2f5acec15", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724521, "uuid": "f1b7b8d6-c790-454e-a13f-20a794cf95aa", "value": "T1CF937DC5F243D0F5EC8705B15137AF379B33E0B91029EA43C3696972ECA1951EA16BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724521, "uuid": "5bb73904-8a21-46f3-b720-b03e3219e642", "value": "1536:sUYl80AvyebhzEzASU13JIaJi7M3gLkiNgKVL4GRUS3tkDNY7:sUYq0ovNHSy3JIPIWkDKVEeBMG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709724521, "uuid": "07d60941-6674-4cb0-938e-f6ceaf5c260c", "value": 89672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709724521, "uuid": "25816b67-04a0-42a5-87b8-9d73e4e9b7f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724521, "uuid": "aa1abfe3-aaee-438c-a061-000e5195b5a2", "value": "vlxx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995c947f-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718901, "uuid": "e2be38a6-b29a-44dc-a4c8-6e3d8186d073", "comment": "Malware payload (Mirai)", "value": "9b336b07a7cac34c607554721801cd25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718901, "uuid": "872bcdd8-af56-44bf-a58e-ab287c78e937", "comment": "Malware payload (Mirai)", "value": "59ab3c1f23f9e480f6415f2b591f10fcadddc4951793faa77b724057e35dc9d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718901, "uuid": "d8b58a1f-f72b-4314-af63-b58dffebf9cb", "comment": "Malware payload (Mirai)", "value": "29648a588a1706425a60b5c7ec6d8d2e0a6d14d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718901, "uuid": "06d434b2-9c5e-41d4-820b-31d71addc17e", "comment": "Malware payload (Mirai)", "value": "c90681992770139af739d805108ff671f4953382f1da25a22bf5c3110c88a8b3443875217181539dafd8638321410680", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718901, "uuid": "c704cd6c-7ff8-46c0-b6e6-7ab2a9834580", "value": "T10FD32A06B30C0A47D2632EF43A3F67D093EF9AC121E4F640256F9A8A9171E365585EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718901, "uuid": "a44129a1-6324-4a56-ba81-c1a217b65126", "value": "1536:BjU8zbGfMKn/CZIsnSf98D2xpnvTXNQ4sNMwgNjPMfgvAtIe0jDWRfqPY0k5R/z+:BWDOnq8D2x57XlQgxPM9tx5RblI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718901, "uuid": "5f4deb92-090b-4714-aa4c-16bcc8b4d431", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718901, "uuid": "fb1926f7-4bcb-403c-b61f-52d32c3c7b62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718901, "uuid": "e94b79f7-41de-4c4d-8770-f60c1e727ab5", "value": "9b336b07a7cac34c607554721801cd25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ebef1c-dbbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709732179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732179, "uuid": "5dd6eca0-b668-4527-bd6f-60174c418e5b", "comment": "Malware payload", "value": "01eeec277c8c1d6c99828aa4c98ab12c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732179, "uuid": "bad35b7b-74f9-42fa-b6ef-e24803dc3bec", "comment": "Malware payload", "value": "5bed6a23ccefe65a6a5738be6c1032f5325302c4a615307c1bae741eb813dad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732179, "uuid": "a0f9add6-232d-48dc-8c85-89378d3ce7f5", "comment": "Malware payload", "value": "111bff4ec2efb1783f3d81494e66d17f725ea4f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732179, "uuid": "b16516da-11c9-433f-96f1-6c877feff3a9", "comment": "Malware payload", "value": "ca30d6845edb7f53db096a586ed453730cf9b3cd291d9a3344935c24079a794611e4747a53aac93a964fadf0ed1925fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732179, "uuid": "d52e7a0a-7cbf-4c24-8f74-9ee856e3e654", "value": "T1EFD4191927F82654F1B7A6B89AB64D25E673BC711B10C2CF0190817E4F37ED49B39B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732179, "uuid": "eef5867d-8681-41f6-aa82-c955769cfc33", "value": "9b960f28d6527bb959b793c0e1525cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732179, "uuid": "9f31d534-d678-4961-9784-6f2db20250bc", "value": "12288:BOXTGVgMfb96X8gPRUWDqMqByjSB3a0Vt7Pgw:BQCZfJ6XFk9S2zPgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709732179, "uuid": "9e98926e-0e82-427e-9d59-28c829ab4005", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709732179, "uuid": "7699f218-c1df-40ad-b8a7-37144073566e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732179, "uuid": "79bcdad3-0506-4231-93a7-dd276801b3ca", "value": "SecuriteInfo.com.Variant.Doina.67409.27979.20599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e0e89c-dbc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709735114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735114, "uuid": "33b4c65b-ff09-45cc-b3c3-350b3f150689", "comment": "Malware payload", "value": "a9976476c177e2ff0715c825c7a04537", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735114, "uuid": "aa7b4ec4-294b-4f23-aa87-234a0856a13c", "comment": "Malware payload", "value": "5c447b90903d12946bb3d765e6abface9e35fc72afa8d6257a0d3a27abbcc255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735114, "uuid": "6c2b6f32-afad-4484-a4ae-3d02c8652d08", "comment": "Malware payload", "value": "912b1c36bf8db3b7cf280e7ccdc70423f8bf59d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735114, "uuid": "50c0223e-d0ae-48f5-afd1-adc3afa9069b", "comment": "Malware payload", "value": "ae81383e0ab2f8490e207b2ccbdced5891776539e217bcd5421645d1a3289bcefc6647b78eedd82b9fc538fd4af4f990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735114, "uuid": "6db6aa8b-c7eb-4980-a066-36a76e57ec5a", "value": "T1B173F18B0E3FA167F6C7CE3061CAC22A6D37B2C16EA049675879A5803ED1FF5390605D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735114, "uuid": "729f3427-1fff-4c30-a303-c2b7c000a2b7", "value": "56a9d13d9157db61c7218d411b5298b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735114, "uuid": "dc671cd2-4ccd-4d89-bf27-b7887d346f5d", "value": "1536:AiTDv7ITh6buNEbEHysDAqxcHUpMyHj+pbacZ/AhfW:AinvMThXbyy+qMujIbaceW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709735114, "uuid": "53284aed-421c-408e-9c01-d32bfd396921", "value": 73632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709735114, "uuid": "22fe4fe9-1533-4a3f-862e-be921333b405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735114, "uuid": "2292b179-4a1b-46a9-94f0-8057ccd5d828", "value": "SecuriteInfo.com.Trojan.Ymacco.23643.6881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb236540-dbac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709724541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724541, "uuid": "1ad674e9-2ec6-423d-9a9e-29f7dbc7cd98", "comment": "Malware payload (Mirai)", "value": "b8e1b24d769adb4c495bd096786c9162", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724541, "uuid": "6cf4d71d-780d-423d-a2a3-a12269481372", "comment": "Malware payload (Mirai)", "value": "5c809d2b24264b120e263f6ca4323a531dac208bb8a95946da1f64e399429911", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724541, "uuid": "15c77714-6541-4757-b781-29b916068df1", "comment": "Malware payload (Mirai)", "value": "dbef07d089069c2baae2d029752724625ce3777a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724541, "uuid": "5002f0d8-967a-4117-83c9-2d3d1c79aa6e", "comment": "Malware payload (Mirai)", "value": "771fc0256134e435e0f247dcc462703711f360477a1782f553dd4797cf5377f766f4c20cdd30b999b777f38da4f9e48b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724541, "uuid": "7a088c5d-5531-46ca-be71-05fc4ee636c6", "value": "T107E30A56F8819B12D5C111BAFE1D128E37131B78E2DE7302AD246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724541, "uuid": "b754d5e5-8660-4e50-bd85-979543a7a720", "value": "3072:0CKgUmbgWz4XFQ9sHwIaOOxGjBPCm3CR5Rjh:0CNpn4XG6Hha9q/3CR5RV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709724541, "uuid": "cd12b407-0220-4b7b-ae1d-054dabe58ee9", "value": 143260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709724541, "uuid": "40a5643a-0114-4625-b427-d37c265ee01e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724541, "uuid": "cc3fab5f-d9ed-462b-a456-30ce305952b9", "value": "vlxx.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c951fb0-dbb5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709728275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728275, "uuid": "62fdadc5-e21c-4e98-95b5-cfc787c5b316", "comment": "Malware payload", "value": "8b887ddcc05661bceb27b06cad233086", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728275, "uuid": "89e82a24-5cb8-4e3d-a5d9-2ea2e972cf3e", "comment": "Malware payload", "value": "5ebf2827a1d6209d4a82bdd07a7c884b83f9ce49aca7521114f4cfb2e45b693b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728275, "uuid": "b5c363de-2504-4cba-8ca3-f313e43dc214", "comment": "Malware payload", "value": "35dfb1035ec4de87a9e8ccf368af8cd4150f4127", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728275, "uuid": "c75168fa-e245-48fb-8abe-e7b57b01165c", "comment": "Malware payload", "value": "3a8c39bf728ab562ae2bb63706e23db8a7c64e93b7b50487f386fb3a29bd60d6f52f0465c70619794240278a04b035e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728275, "uuid": "9995242b-e6e9-4f3c-aa5a-2b80f793d68d", "value": "T1BEE2F165A2C8CA7AF43157F7B8F7A6D0C8567A2E13C4250933178B944FA67CAC218BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728275, "uuid": "fa7ab08e-d6ec-4589-9b87-8d4a894fb82d", "value": "768:XkaCROoOwkst7LULj930DcTCYbqBqkjy5JZNt57ixUrdVH:XRiOoOwkML69gcTiBFjy5XjFixUrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709728275, "uuid": "7113a656-c7f0-45bc-a8b5-10f639e227fc", "value": 31592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709728275, "uuid": "f30bb9df-5560-4fcd-be3a-84bece1f361f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728275, "uuid": "298d61e6-9fca-4f07-b2a5-dd03a6ed5b95", "value": "SecuriteInfo.com.Linux.Siggen.9999.22047.21613", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b28766-dbf3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1709754942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754942, "uuid": "33fa7c32-31a1-4d67-b2dd-c0c10eaf794d", "comment": "Malware payload (Metasploit)", "value": "2bb1a1a44be17fe1a55a0bac319163ef", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754942, "uuid": "8065f0de-3044-45c6-b37c-c31f84e6a68b", "comment": "Malware payload (Metasploit)", "value": "60694a0680edba3640008ae16bf7f521fe91b93c1a2c440657b6d86c0ec7c00f", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754942, "uuid": "c39147e0-adb6-42e9-8e33-9ee53e53541e", "comment": "Malware payload (Metasploit)", "value": "83c0f9e66a92fce506be9afd8aa7ea651d11e5af", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754942, "uuid": "e5667bdf-4ef5-4aa7-bf1e-87f7b9663f36", "comment": "Malware payload (Metasploit)", "value": "d57b53a8b60752b30c41ed7863cfcdeb95bf2583ba921ca2342409ff440015d7ddfd30e108a044d64d431c19d751dc3c", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754942, "uuid": "c96ad369-c662-4e7f-86d2-1cab81c0db41", "value": "T1F9619F932151B8E9419287BB3E4D66F6807FC224915AA044F78C4F5DF9DDE633A8E6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754942, "uuid": "ac7a1d1e-9968-4cf0-9064-f5fd66bb8bb1", "value": "48:N+MTLimb7+Z9CHuKZ3W1INCfBZL0HuQLhFi5QsvuiBrVxqT/sn1Pj:IGtuZ9CHuS3W1INCfBZL0HLmAiBrVMuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709754942, "uuid": "ccf4045e-57b9-40a8-8988-4409e015b009", "value": 3244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709754942, "uuid": "f35b31f5-99aa-4d60-abf2-9c1846e44345", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754942, "uuid": "cd03caac-d469-4315-9f50-78d8fa93169d", "value": "XwYdHEAG.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafb6ea8-dbc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709735332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735332, "uuid": "ecf3af42-9b3a-4b36-929f-e0d0604e31b4", "comment": "Malware payload (Formbook)", "value": "c9816a3700accbf435d91e112f2ac978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735332, "uuid": "e152ce54-2ff9-417b-95be-0d1cb8ce51ab", "comment": "Malware payload (Formbook)", "value": "614ae605266b9829b5577ebd8562f5fadb2ef82337597d32e54c8ace9f1ea25c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735332, "uuid": "ab8c4dd0-8df5-4c84-8973-5c897a79074e", "comment": "Malware payload (Formbook)", "value": "e06b1561a422b24a8bcb87c91374598a66dec2c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735332, "uuid": "7ad4ef7a-4c76-4be3-b1a9-fd8c51bde24d", "comment": "Malware payload (Formbook)", "value": "510aa667b235248a4c711dbea44385da0f1d7afb234d0bf0b1dba65340390a4ab420c8eebadfe60816afd47213f125c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735332, "uuid": "0546535d-3173-467e-b54c-0ef968692bb2", "value": "T107F42331BF88CE5BCE2F4835903157448B7C14150FD9EFCE5FA9A0AEA1B99C6039962D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735332, "uuid": "b8f5e258-61ce-47e9-9b7b-f3494b537c17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735332, "uuid": "ecf1b61d-ee69-464a-aa20-408e27039702", "value": "12288:/DzScVNgNetDrrBp3Sguj/zNdBL/urcJW0o/Pjk/ehHDgbbuvEpX:rzSOHdBpig+zlmrDnKehHDSmEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709735332, "uuid": "d6802502-de2b-47fd-9010-da4cf820e2d9", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709735332, "uuid": "6beba57e-6ff9-4a05-9876-91637db1df6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735332, "uuid": "6f087d5f-bef3-4a16-b3b1-04b3886e74c2", "value": "614ae605266b9829b5577ebd8562f5fadb2ef82337597d32e54c8ace9f1ea25c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccf4964-db98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709715712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715712, "uuid": "cbdf436e-b50d-4c48-85c0-177f70a07a77", "comment": "Malware payload (AgentTesla)", "value": "919ef76a71736049d91204e72e708bc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715712, "uuid": "b0e7b8b3-e000-497a-8e34-d8eaf66f2356", "comment": "Malware payload (AgentTesla)", "value": "61e617222671bb531f25efd53cfc40311283984ef4d1366dc747a913e8294f40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715712, "uuid": "cdb4a3b7-5495-4950-842b-f5d8288c3503", "comment": "Malware payload (AgentTesla)", "value": "724826a9cfe9e19ad5a7c94168e1fc78a5614d91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715712, "uuid": "89a71010-8650-4d70-ad7f-200d26c98c9b", "comment": "Malware payload (AgentTesla)", "value": "db6e661fa9fb0b5ce6d5e548b126f4288dcba8ca47818d13b4257b06c57ea8ce9be094db9c4d94634d2db5e67c1bca0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715712, "uuid": "35e4c9bd-b71f-4b87-9107-add3aa55e596", "value": "T120051202A3E85A68F7FF87BB1AF6E41157F374929622E36E0AC590CA4C317C1454E363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715712, "uuid": "66aa1f7e-3256-41a2-8722-f4b6cbe6dd11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715712, "uuid": "f5b95010-4cb8-49ec-9712-02dd42a98fae", "value": "12288:eGgL02iNBykEgfuV1d5hknTg6sHyrAdRDAbFyJvGG1IWjbsCgTIL0SLJaxzBiCST:eGgI141d3wDObJvBjQjBi0fiCSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709715712, "uuid": "0502c3a2-35c7-44fd-acfe-6daa63de9bc7", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709715712, "uuid": "df025a2a-94fc-475a-84c4-9d8706d42a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715712, "uuid": "35c245bb-5445-46e0-904a-8034e45ccb2d", "value": "PDF Order no. 20242902-70611 05.03.2024. - DIV GROUP.PDF.img.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9985abb4-dbc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709735222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735222, "uuid": "d0d328a8-659a-4d4d-b53f-0e28d87b39d4", "comment": "Malware payload (AgentTesla)", "value": "3729fd79c5ce2cd6d57789a9a88cb17a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735222, "uuid": "9acf4827-6ea9-40d3-bf6a-98d5d9b619be", "comment": "Malware payload (AgentTesla)", "value": "62af6a96cf3dd3258981b60d39b46c3fee3cd00e60bd188073560cd29a904968", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735222, "uuid": "e215f50b-9661-4b4e-895e-e2fa130f4aa0", "comment": "Malware payload (AgentTesla)", "value": "b07216ee67c623a45dd8c1e5fb86d9ac3aa0da13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735222, "uuid": "4623c129-bbae-44ab-a414-6fb7dca523c7", "comment": "Malware payload (AgentTesla)", "value": "4dc4eaedbc937a1a017ab74fad9dfedc020922647face68db4a73fdc7ca4d75d1f039de6eef3960aad691f32a0fa620e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735222, "uuid": "cb1ad69e-66e6-412d-860e-a9e4f8647eb5", "value": "T14A25220C32B6DA37DBBECFF910564145477B968E2051F3E84C8679FDA1CAB058B24683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735222, "uuid": "55629178-8dd6-4c39-87cf-111eee01db6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735222, "uuid": "72318b54-e3ee-4283-8b78-8293b485f43e", "value": "12288:TlW3HmzBh35JcUAfBcjxUW9PzqUZGaPPBraBUQ0Ym:5BzrztUW1zNbPBraBUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709735222, "uuid": "abac1b36-8530-4b26-829c-3eb8783d5e59", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709735222, "uuid": "1dab7c8e-e242-44d7-b73a-28a94930e0c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735222, "uuid": "84de8934-5e7f-4681-9546-6816f135bcce", "value": "62af6a96cf3dd3258981b60d39b46c3fee3cd00e60bd188073560cd29a904968", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2010f0b-db69-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709695723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709695723, "uuid": "16a28eef-0e4b-4aa7-b3b2-f0dd1fa7348d", "comment": "Malware payload (Stealc)", "value": "7b757adf2a6a0aaaec620f2ef3f0da15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709695723, "uuid": "12a58f47-7e75-43c0-9f13-6c389b285de7", "comment": "Malware payload (Stealc)", "value": "6505124e089a5b658c16cc831297438239ad47a3b06a1e817880fb7edd19a1ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709695723, "uuid": "e6a71046-2201-421e-91c1-73f0cd9f9d26", "comment": "Malware payload (Stealc)", "value": "f790abf7a19720415ac0458e9430f10be9402d99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709695723, "uuid": "1e9b546b-dcf9-45d0-a530-5c4e025a9b5c", "comment": "Malware payload (Stealc)", "value": "0b6a64840acb77114e3bf4dac41e062bcc56f1646da612b13d570c8b5b0e36f0888e5c1256f3a6041cbbca5f93f620a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709695723, "uuid": "0e7cdb67-97dd-4be9-ab8a-1c3e7ffaaa80", "value": "T19B952349D85A38B9C4EB2C7A0A37D33A09B6CD40026DC9619BED3D73EDBA5C0DAD5341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709695723, "uuid": "7353af64-4760-4868-bf5c-5f39b2f356ba", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709695723, "uuid": "a2c393be-3d07-44c4-80d1-16b04421d0e3", "value": "49152:tIiiK2Sz9NWXiy46KGHl63BJJED0JcaoAgDesnUJiCj1tckD:qiiK2mNW1r66YJHoAq1qiCj1tV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709695723, "uuid": "b2ceea06-a752-40bc-8d35-6dc9d2c60480", "value": 1887689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709695723, "uuid": "937db513-bdf4-484f-9a9f-786fb5d986a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709695723, "uuid": "1613453a-cf79-4407-92e0-f716379b8871", "value": "7b757adf2a6a0aaaec620f2ef3f0da15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c773921-db85-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709707712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707712, "uuid": "81637d6d-7afc-47fb-803d-87d84d8aa6e9", "comment": "Malware payload (Mirai)", "value": "817de5d809f87e187400a823a9dc42dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707712, "uuid": "2f10ae34-8206-49c1-ac65-690be98c16b7", "comment": "Malware payload (Mirai)", "value": "65ff40099d3a49d96d8cd4fa0d8859002e2bb2901890f5afcf74e155fd676689", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707712, "uuid": "4197a9e5-da16-47e2-ab83-998990e7cdbf", "comment": "Malware payload (Mirai)", "value": "8529a538d67ffb7a0a6c884acdb0474e25ca8910", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707712, "uuid": "6e17dcba-34de-4150-9760-569a1eba01e6", "comment": "Malware payload (Mirai)", "value": "4c1ba8e886fdf203617ba806749515bceb8f9ba4ff3cec2fb10b689fbe5dc5cb50849f746e4feaaa4b708b5e1b4a68b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707712, "uuid": "49b387f3-cc51-4e2b-9cd1-dd7473386675", "value": "T1A5937DC4F643D4F2E94305B1217BAF365F33E0B9112AE942E3795A33AC92451DA1BB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707712, "uuid": "4552b24d-8daf-40cb-9fad-d7a744a8d8dd", "value": "1536:M/AcoC7du0MBS/tZcJUTJKpBBn9Sw3zJ2TOTt4fB6S3f16ewYf+Ws:6A3C7du3BGtZcJUTA7h9Sw3yOZSx3fnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709707712, "uuid": "de6dcd6f-7bf7-4c12-93dd-efd30d62f4f4", "value": 97608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709707712, "uuid": "3691afa0-996c-4782-b0a9-9811682bdc1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707712, "uuid": "5900ca70-5e18-4a4a-8441-ea4599d82b2d", "value": "817de5d809f87e187400a823a9dc42dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c46edf3-dbb9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1709729939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709729939, "uuid": "989903e5-a797-4c4d-b9c5-663690a2277d", "comment": "Malware payload (DiscordTokenStealer)", "value": "6d0f0988e1d04f178697173a1ca502c9", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709729939, "uuid": "7dde4d01-f6da-4bc2-9ccf-56ac87a37c46", "comment": "Malware payload (DiscordTokenStealer)", "value": "66ef4f74f1a19e98c8b2f7759a32f6871009c7ecac89e58a641d9367956467b0", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709729939, "uuid": "ab559daa-48b3-44cd-b60a-229b33bf9256", "comment": "Malware payload (DiscordTokenStealer)", "value": "45d121870222e85d117ca519c3eeab058cde356e", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709729939, "uuid": "6cfb469c-7f37-4137-bef1-ba35d92c700f", "comment": "Malware payload (DiscordTokenStealer)", "value": "4effa40ee34d78723aae8a401d84f9eda1a98a3f9867530f4cf8558e7d2450ec75cdafcca1488c9246812a53195d8e6f", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709729939, "uuid": "8d750392-42ec-485b-b808-303b3df8ada5", "value": "T169475B02FB819ADEC664913689EA43913771FC141F2B9BD36A44B37C2C767C96DA83C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709729939, "uuid": "a2ea4cc7-6f4a-462d-81f6-77f3addf56d4", "value": "f2dec354dafd3d7e669b500e1f959937", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709729939, "uuid": "2c586634-5590-4c04-be90-ebb9e1f12daa", "value": "196608:quoLqQgM0Kx0D2yxusZFBHm7Y6O78vcwdhpu3OAqFMHU:dtQjx0CgBHm7Tw6cwLpu3/qFMHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709729939, "uuid": "0bc74104-2d80-4095-8fa9-49c38547a609", "value": 26682311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709729939, "uuid": "d6a227a9-6e12-44cd-9b20-98ce232b5f64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709729939, "uuid": "517f3566-234b-4133-807d-864e5ef94a70", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9053a674-db8a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709709866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709709866, "uuid": "29660ae7-8a36-4343-b7a6-60e48fb6e7e1", "comment": "Malware payload", "value": "0057479dd99bf8a02eb4a0214fff8a38", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709709866, "uuid": "cf0ddb2a-a3d7-48c7-9965-a4267f2b888e", "comment": "Malware payload", "value": "6731122b07a12d5a22ac515f33c2bf698b98661041f3138c548cb9f42982798d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709709866, "uuid": "3ed3cb5b-c016-4520-9ada-91e294744078", "comment": "Malware payload", "value": "b9a060c06ab53e4edf7d4e65a2d12e0d573ba1f5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709709866, "uuid": "d3c29623-4a11-41d6-97c6-e7b856ab4847", "comment": "Malware payload", "value": "89f5c8d9072f9c5085a1e21ef45937cdcd04b0a0304e6353955ae4127b2d5d80130400b8a1c466497dce22c2a57571c5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709709866, "uuid": "86f93c0e-ac0b-4a1d-84f2-5560f9424fa5", "value": "T18D014143812101B5C4A95625C90EB93F86BAE77C0F0C332608C3DAD8C80AE1A52F13E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709709866, "uuid": "e1ab6b24-b5e9-4813-a73b-17508a46a3c4", "value": "24:wFxIQXcM3aMtYGgx8zVmwfzu9jd3xUyJbqdjEnn:jQXp3ahHcswi9RhUyJbqdun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709709866, "uuid": "9b41d0bb-d365-4f56-96ee-acbe8fec12e1", "value": 795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709709866, "uuid": "d39165a8-20b9-436d-9b27-49be3b25ae41", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709709866, "uuid": "14abb819-61c7-4fa0-b494-e5de8d01bdac", "value": "Officesec.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c8bca2-db82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1709706273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709706273, "uuid": "55b87225-82ce-48c5-b7f7-34018f23fc69", "comment": "Malware payload (CoinMiner)", "value": "1e112349b9c669c9b056a964ea1d108a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709706273, "uuid": "8f0238be-c6be-44f6-ab58-300a9fafe99c", "comment": "Malware payload (CoinMiner)", "value": "674966daaa8f626c60d053f232b8ad2ae3854754ff0582093807d5c6b63539fc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709706273, "uuid": "27a4dbb9-dabd-439c-85f8-ab34ceaf17be", "comment": "Malware payload (CoinMiner)", "value": "e15b131c3115fb9a962cb5ff8856a667948f0aab", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709706273, "uuid": "bea7cca9-7c3c-488d-89e8-de516431eb16", "comment": "Malware payload (CoinMiner)", "value": "3f9e6d392bc9ea3597843e38743fd22a3cb03fdf779393174e1f6e20544f20068fafbfced960eb617514affa59291b1c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709706273, "uuid": "b73793a9-3393-493e-8286-02788e9c2cf4", "value": "T113F2E1581681DB87E510AE3DE6AEAB34CD752DDD77897A702AF808000AD7DC007FA6DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709706273, "uuid": "d29719b3-a4d0-4422-9f14-97da6b1aab5f", "value": "768:BnLDGwJ35YFQmY9qSd9NQVwXX5sv42It5fbWb:Bn/Gwx5Y4R3QVwXX5iIt5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709706273, "uuid": "529ce7ab-4ef1-4c19-bd1b-26276695eb4d", "value": 36888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709706273, "uuid": "2706a544-7ecf-4204-8cf6-6235fd164afb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709706273, "uuid": "10144e71-9781-4089-93e2-ca01b0a5eac5", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.10684.6066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53635f0f-dba4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709720931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720931, "uuid": "da0d525b-f99a-4357-b594-30833a68a126", "comment": "Malware payload", "value": "dc0a3066f049c381a4d0397dae77d629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720931, "uuid": "0a351795-6812-43b0-bc52-7f12097cf767", "comment": "Malware payload", "value": "694c523f52f413055225e9bd8ff06e7d0c6ba8bc91b7ca54b9b8f9cc667e8ff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720931, "uuid": "cecf0fe2-499c-4a96-8af3-d613ed438a48", "comment": "Malware payload", "value": "f600de59a5fc29881954262562896a44cd7c85bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720931, "uuid": "9315fd1e-dc64-441c-a5b0-9204b4736804", "comment": "Malware payload", "value": "321bd87f515240e3ee6293f73692a4ac49bbfa65aee9b2a9ebf5966c73d8451ede742b7dd2257266d8da92370c2ffa5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720931, "uuid": "6bf5306a-defb-4338-9c68-2e64f5f86967", "value": "T1ACA21B5197DA8237CB784A301873561046B5ED064932EFBF3AC8B2991EB67018BB3F35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720931, "uuid": "06e9f963-3fcd-434e-842a-6815d0897159", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720931, "uuid": "a2af8dcb-0520-4e65-9f8a-91e4c39c1379", "value": "384:FZYRT4ItGi5gSM45d5W4MLRfTokY2ZWlumWv7ONWssCzYcCe:bYR8NieS7crWEDjC5zYcCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709720931, "uuid": "14fd1c46-3610-4194-85d0-d1b917595322", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709720931, "uuid": "9d331fa5-2b17-4551-ae09-afdae1ca9d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720931, "uuid": "3e28c3ca-98d1-4aca-95a1-45f1d56346fc", "value": "SecuriteInfo.com.TScope.Trojan.MSIL.24551.20725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3721b7d7-dbe7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1709749660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749660, "uuid": "914b31ac-2844-4a05-9882-f6010178fc7f", "comment": "Malware payload (SnakeKeylogger)", "value": "a5628fb416aad03a73e266af1a319075", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749660, "uuid": "54bda81d-2df0-439d-b0f5-485d70de685b", "comment": "Malware payload (SnakeKeylogger)", "value": "69f28ba36489a52b42e6ffc5da6ad1ac795f5939bdcc9b3a205d00f527ca8449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749660, "uuid": "c533384e-2c8a-4e23-ad96-e34be5a0a881", "comment": "Malware payload (SnakeKeylogger)", "value": "590b8259ea09985248d8ea18b1904ee875169680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749660, "uuid": "af8ecf18-2210-45b2-9e1f-be47618652b3", "comment": "Malware payload (SnakeKeylogger)", "value": "2858ebb43ec876f0dfffce49d008c7a6354b5b38d3ef775ccbf74f895ec40e247a899aeed16f8156046827b8d17e812e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749660, "uuid": "e85dcfab-2b67-4fe2-9595-8ce978aaf47c", "value": "T19FA4B0D82A649EB6C4634AF7DC6A990C3A31A96561D0E47424CF0E4CFCD8B8345F927F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749660, "uuid": "b746dd62-60f6-484c-a96e-f3c6e04b1b80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749660, "uuid": "7ccae93d-a775-431b-9c36-7496e5f5f292", "value": "12288:fCXFQTAajA6n1tiuSZ4EidlIw8SfcMAAAAAAAAAAMA5AAAAAAAAAAAAAAAAAAAAP:fqFQTAajA43o4EiIw8YcMAAAAAAAAAAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709749660, "uuid": "f716bbaa-bd6a-4e52-a64f-790298c1d630", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709749660, "uuid": "b12d5bab-1d75-48fe-8e8c-981c034c85fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749660, "uuid": "12b7f876-fbe6-4286-aea7-383253301331", "value": "SecuriteInfo.com.Trojan.PackedNET.2725.1552.3502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6296383-dbd7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709742974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709742974, "uuid": "cdae961f-8cf2-4938-b2c8-c5829204755c", "comment": "Malware payload", "value": "b4e0f478409999cfe04907640c7d7cb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709742974, "uuid": "1cd64b80-8618-4a1b-8459-e072446bc619", "comment": "Malware payload", "value": "6aee00d65fda34643fc709c3ec62fd349795e8da26f8bf8d48395507604f9a5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709742974, "uuid": "79ea6dea-b876-4880-b8dc-a0b7acfb7c35", "comment": "Malware payload", "value": "1751579e24f13a8ea567a841d059262ede6f5e72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709742974, "uuid": "ec0e7b13-4837-4989-902b-844c9fb3f0ab", "comment": "Malware payload", "value": "8c869220281fc8d5f205d1b2d53023bbcb31e46306c4fb7765be528d86825dc56376bae42e14f2c51c306601a1576942", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709742974, "uuid": "ef4f484d-fece-4081-8ffe-50ad276e3265", "value": "T1EB16333BA1848C20C36D2775A493FE558A10C5536B8CD766966ED50BBD31BC2CB3B8CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709742974, "uuid": "1415f8d0-fcf6-4685-a795-6ef348701db4", "value": "b0e61e0342235167ea6b0cd39dbbab85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709742974, "uuid": "6c9baa53-80ad-4a7b-bd82-f695ff106f95", "value": "98304:DjezfWnQE225WlxBP1FTHPwY7hSzmL26WPm4I4pDy9:3e8QEOtFozl6WPm4lFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709742974, "uuid": "fd32bb5a-a1bb-444e-b4a3-694d448f5ab7", "value": 4264824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709742974, "uuid": "c2cde78b-748f-414f-8c40-57e3956deb7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709742974, "uuid": "2d6b0620-ebab-463a-a579-91199080ae2f", "value": "getscreen-282720819.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084e83b4-dba9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709722953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709722953, "uuid": "05db812e-e1dc-431d-a990-987da925a609", "comment": "Malware payload (Formbook)", "value": "b1cf2fe62b5aafe6a430da9afa613bfd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709722953, "uuid": "1ea7d5d0-54cb-4b98-87c5-bf6d22c0231b", "comment": "Malware payload (Formbook)", "value": "6b5c3546dda8ba9d64e97c1033f9a05140af2f90785a3c5867f854eb4447b0a3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709722953, "uuid": "23e597f5-d495-4610-b0ff-68f0b153db8b", "comment": "Malware payload (Formbook)", "value": "ff0f977e3a8ba27db30095f88e7f7ca5d3cfa50c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709722953, "uuid": "32197065-5ac3-4936-9d76-15ff9e9ea168", "comment": "Malware payload (Formbook)", "value": "7db18d059e2d33d5eb2ac2ba894f92789a7595ee296cb50004d44a87a60822be63266aa2c01cf035b92a79c90fd42ee8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709722953, "uuid": "7f37b351-6c6f-4805-833c-8f1827a6295d", "value": "T18EC423DC23FAA053FAD95AB64162A7B39C3B9E538F1161436B00BE67BD71742864CC07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709722953, "uuid": "3313b005-8607-415c-8249-c3279957988d", "value": "12288:fdV0bCZrYDz6Isv4n37autQE/PfhXGbqvrd9qK2DX34:12bYcX6Lv4n3OufnfhRvr3qH7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709722953, "uuid": "326c6d56-d5aa-4f41-91e9-a439adb98d8c", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709722953, "uuid": "a6375ef0-e6de-4a0e-a1ef-7f0bddda601f", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709722953, "uuid": "44a02d30-66e1-4031-be10-37298d19adcd", "value": "n00000632024.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f539b6-dba2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1709720073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720073, "uuid": "513f7c99-bab3-4314-b66f-dd633faedaac", "comment": "Malware payload (SnakeKeylogger)", "value": "21612748bf86fc7272c68f248c6f4a84", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720073, "uuid": "fae7b07c-8bda-4237-a3c1-004d66f06fba", "comment": "Malware payload (SnakeKeylogger)", "value": "6cd9b3a78e090a7be215bba2083119ba9a65e491ced9f97e325b6c447199ee89", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720073, "uuid": "5e232d1a-9d70-435f-b72e-ebebc13fcb0b", "comment": "Malware payload (SnakeKeylogger)", "value": "f6c3049873d582027f0c1c774006972a3c88febb", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720073, "uuid": "3dcc4619-f6ec-45c4-830f-a59d2dfe00ae", "comment": "Malware payload (SnakeKeylogger)", "value": "2aa52a7b38ccc7192577f11e96e713c719dd5b1ab20741049321b279799a146ebb7cf0f9872bace294335d61029f5af4", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720073, "uuid": "aa053cee-9290-4649-9638-0d5ea9b92077", "value": "T18E263384107F9ED36A87243CDF2768842D4F45BD7E891D3C7EC0AAE18AE6CA5277E510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720073, "uuid": "c5404e18-4cf3-467d-8ad9-6fa69dd8fcff", "value": "98304:Bcbb251fRX38BeH3s2x6gKGYAMlbDVhU+eeyY20jhs17ymBJSngJ6jW:giyBe8gKX++HyY2MeMm3dJ66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709720073, "uuid": "fc636f26-7b51-4422-bf05-3d70f8d5c14e", "value": 4420936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709720073, "uuid": "4d3b3c06-6c9b-425d-89c4-033ee78d7d15", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720073, "uuid": "eaed5b74-4b0c-45d9-b93b-d2989b19c2cc", "value": "nThe Requested Receipt.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b328e3aa-db7c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709703912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709703912, "uuid": "edaffb98-1534-4daa-9f82-f76a02711bcb", "comment": "Malware payload (RiseProStealer)", "value": "469962a84b76a4e6c75f448a739230c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709703912, "uuid": "1d5d08f2-4166-4c63-ae9e-c6efc1b5982e", "comment": "Malware payload (RiseProStealer)", "value": "6d22ba4779752e3cc313f404b9ed0ef664b5b775f97c310149a2b1aceea302a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709703912, "uuid": "fc946739-f61a-4df5-accf-d6317ab83f18", "comment": "Malware payload (RiseProStealer)", "value": "7f75e106dc00e16d91dc22d98080c1c61a92186c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709703912, "uuid": "ce965031-ca7b-453c-9b64-f823480adf51", "comment": "Malware payload (RiseProStealer)", "value": "8d029e7b3ac434b50830e978b661ed110573a45586240f257829651ba833c426c7460c4126ae484e847e65648fc43305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709703912, "uuid": "2719a96a-6486-49d9-9f1c-8d5009eec3f0", "value": "T13344CF3175E1F0B2D9A7843489BBCAB06A7B7871A761817B2F641F7F5E303E04A25352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709703912, "uuid": "0c59499b-4c1d-4f94-9cfb-df871ff8f6bf", "value": "09d0411b4f65505d70685766dbc9fb8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709703912, "uuid": "3b59b461-f82b-4168-96bf-0a0059ca57ba", "value": "3072:D4mRMsbv3SmVddrgPPjGyBplg+sttlRUwsGSBjYgtvUt5pQQsI:nf7VddrgXjGyBpavYZPcJQQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709703912, "uuid": "2b4283cd-8c07-414c-8aaa-3c293c41bb15", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709703912, "uuid": "d85c79d4-9a74-4e02-a740-9f4f4db9c759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709703912, "uuid": "36334181-fec2-4c39-8c1a-b549897afac1", "value": "469962a84b76a4e6c75f448a739230c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9704e71c-db98-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709715891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715891, "uuid": "af68a10c-c0be-400d-a121-d9ccd477b05e", "comment": "Malware payload", "value": "5b1dabfd79624a6c314e84e9223f1382", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715891, "uuid": "3a58e8df-b9f3-454f-bcda-b3f310bf6511", "comment": "Malware payload", "value": "6dee81e04ac37e2ffa5d9bb0c22d782f010ebd72c249ccb4ad4bdaea24d36067", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715891, "uuid": "27892f1a-18ae-4326-b771-4a6cd3293f1b", "comment": "Malware payload", "value": "015a0f9f8340060ee49d1f824f82cd37981f6217", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715891, "uuid": "a2c87350-c57d-42e4-abd9-98d8e2abd7de", "comment": "Malware payload", "value": "f8d7f8aee7f2ee2d6a389228e85cb984a773f52f7f7522fe41541c2fa388345fbe6e4ee34bf5472a712daac85c7d3f03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715891, "uuid": "ede68749-ffae-4744-a122-c67d94547e62", "value": "T1849533E18F7BE1B2C3E544752A79376BD7BADE2890A106C32210F6E866BD903037D351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715891, "uuid": "e3a37aef-7bcf-4697-ae78-46546882ebd2", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715891, "uuid": "f5e1c9d3-4d21-4965-8bb4-439b3cc4c117", "value": "49152:NAvv2Q9GenxPXe/h6iXlQsPtT+0T5ehipEJ94J:Nw1GeRyh1lxtS0Fpo94J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709715891, "uuid": "01dabcbe-3f35-4615-8398-fb78627cfea5", "value": 1919173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709715891, "uuid": "366922b3-e2c6-4081-bc50-2de3b6705ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715891, "uuid": "7a0e8c8d-111a-4b2e-9d0c-133c17c5507f", "value": "5b1dabfd79624a6c314e84e9223f1382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d68da0a-dbc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1709735041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735041, "uuid": "aab0c3a1-1953-4ee9-a4d5-80ee059f38ff", "comment": "Malware payload (DBatLoader)", "value": "6f095bb61bffb2a3baf8f66152d061eb", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735041, "uuid": "af888123-d1b8-4c23-b7f7-1de5ddf23fe1", "comment": "Malware payload (DBatLoader)", "value": "6f85c61e613e3e056d4df1d2c510dd011ed682e1545fbd9496a07b8cbaac793b", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735041, "uuid": "66bb6730-4296-496f-95f6-af9887b6c389", "comment": "Malware payload (DBatLoader)", "value": "705d8ed944697d8bcd20c303c57a2a5a04bd8f12", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735041, "uuid": "9d26f5d7-ff11-40b0-af19-2efd18026b1f", "comment": "Malware payload (DBatLoader)", "value": "bc1e65d2281b6667d0cfbe6784db68165f784115494af909bece40ff4883b2daace1c1f39487c2d75ad2fd1fa649363e", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735041, "uuid": "a52a5c46-3ba7-468c-baf0-987e692d7ad8", "value": "T14F15AF3AB7418C72D1A7297C8C07A3E4A82A7D192D3C74477AE51EAC6F376507B38193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735041, "uuid": "8641f783-6992-40ba-b2e1-748f9c68700d", "value": "6cde445dc291f5ffbd53965e21b4ef42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735041, "uuid": "4c543e68-612a-4591-be15-d482571349d7", "value": "24576:+Xgr/BEuCNYeA06CG7Dmo/KvouloBUJ21eL6PZI:+XmSLMBUcEL6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709735041, "uuid": "d35bf3f0-e5aa-49b4-8241-796b69fda845", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709735041, "uuid": "4532d6ea-d74d-446d-add6-e9140fc1a1a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735041, "uuid": "300c168b-f9e1-4905-ad51-635590456f5d", "value": "6f85c61e613e3e056d4df1d2c510dd011ed682e1545fbd9496a07b8cbaac793b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eaa5ab5-dc12-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709768087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709768087, "uuid": "460c179d-36dd-4879-a23c-19df7593d64b", "comment": "Malware payload", "value": "c1234f0db70dc2fe5227a42b1aab7b98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709768087, "uuid": "1a10aaaa-f3d8-4f60-9e19-9d34db3a4683", "comment": "Malware payload", "value": "6fca374c8b2bec67d300dec69215d8a9ffb4983a2c032e213e8b4ecb3ba385f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709768087, "uuid": "501de9bc-dfa9-4b7e-b092-9314bdb7e574", "comment": "Malware payload", "value": "0782fc3d40c9ca5fc1728e62ce0e34e0146120f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709768087, "uuid": "73f94172-133b-48ae-b2e6-cdc14a5d86da", "comment": "Malware payload", "value": "12830d4f713d2d686375ed162c9e99202d716d9217909e7850e1e99b28cd4781f6d863b233e0e3023a363453defae4b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709768087, "uuid": "88928da0-b864-4a53-b518-87fa88e3b2a8", "value": "T1D9F633E633500925F1D6623B8AB74452C737FC959364C6DF12F963B62F0B2808D3AE66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709768087, "uuid": "e3392d99-334a-4daf-84dd-3b28220f6369", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709768087, "uuid": "82f7951a-f268-4066-8467-0e40789f1f6e", "value": "393216:gh9S2nnx837XfZh2Jp5MLurEUWjljEh01tGymWX8Wjs+da:K9Dnxq7BhpdbJ91symJes+da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709768087, "uuid": "7d6c0d6c-a8e3-41a9-98c1-a168537fea7b", "value": 16402589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709768087, "uuid": "a990e948-1f20-4b1a-b4fb-c9a4d6dd720c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709768087, "uuid": "68d8f79e-e954-4d8b-85a7-1847fcd46c35", "value": "SecuriteInfo.com.Win64.Evo-gen.25793.5323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454d36e5-db8f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709711888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709711888, "uuid": "249f12cc-36b1-459e-a3a3-41e198c207be", "comment": "Malware payload (AgentTesla)", "value": "a9b46053404bd481f6406f1bf9d1b671", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709711888, "uuid": "353a57b5-e849-4180-a107-cbc5b0dc4cc9", "comment": "Malware payload (AgentTesla)", "value": "714493fc45c41c612be2cd710980a435a78d6e7e5e2fe6f624e462c0b0da6000", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709711888, "uuid": "b283400d-63db-452c-b8b7-f56496891aff", "comment": "Malware payload (AgentTesla)", "value": "a83881a73bf3104baaca0cdd4e675fa8f6de3b5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709711888, "uuid": "ceb5031f-820f-4999-9e08-56cd9a109d8b", "comment": "Malware payload (AgentTesla)", "value": "7949a2528ef279aa55eb64d0ceca7613dd2279305d4c9e636f0098eddd9c581e831688a9e738e8360622ed7d9c50feb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709711888, "uuid": "ac16b13f-3b86-4b50-9bdf-3ff276a688cc", "value": "T12725E1AFDB54BF19E5BE33FAD012249453B287858302EFBB5DD4C6E2BE116D90213096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709711888, "uuid": "d1480f3f-d527-435a-aef0-0a5476401db1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709711888, "uuid": "bbf5bccb-6c58-4f60-bad0-85cc44b4cc4f", "value": "12288:y4CyRpq/YkCngjvXhXwFjZRCDB0nfCFp4pbuMynVEHGBvpjpPNUYU1+qcV:y4CyRHkWgj5XzB0nfCFu6nVAGBvpHtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709711888, "uuid": "fc128770-f56d-44b6-a55e-e1be86f872fb", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709711888, "uuid": "989f3dde-965d-464c-b599-a2f1858b0c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709711888, "uuid": "0b51d8ba-3c89-427e-bf87-5d4934a49e93", "value": "dodatkowe (03).docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c86970-db71-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1709699215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709699215, "uuid": "2b3b8b18-defb-4206-8b06-f4a6e03863b1", "comment": "Malware payload (RemcosRAT)", "value": "ccbd20da3ade00b9373a9008fb7f29aa", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709699215, "uuid": "dc38dcad-fb7e-47fe-a329-348f3298b611", "comment": "Malware payload (RemcosRAT)", "value": "716560400b53cafcc395a9bdf7dcdc66d060804a893dcfe37ad4c2387f517c4c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709699215, "uuid": "4f4f1248-d613-4605-a4f1-7c1b30702064", "comment": "Malware payload (RemcosRAT)", "value": "d99b20cfabee66b7cb8a415841f05eda84f06b76", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709699215, "uuid": "2a2f7b44-8dce-4f2f-907e-762b311c2e21", "comment": "Malware payload (RemcosRAT)", "value": "e29c74ebd63fbbaaa533d6b1854e797400af037559abbe7426fc65d998fd7877f5d66750d2bdfd12e48e3538317b8962", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709699215, "uuid": "78e18507-5734-494e-8e2c-78657715fc34", "value": "T14953C22EE34F0915DF55D6BB035A4B4A45FCB33D728500A1397CA7343BAD81E4A629BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709699215, "uuid": "20c7f982-b5b4-43fd-8983-38abb493aa43", "value": "768:zYlWpzQ4OVqZ/klBdwqyZUmD5UMwdxg9dFUrUebxUWNn5qygM7GKES:zYIRrOVo0jjyp5QPg9dFUwaxUWNndWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709699215, "uuid": "1d09c54f-ca58-4ef8-9ad9-f89829712200", "value": 62335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709699215, "uuid": "0d44658f-2205-4266-b88f-1d28d008f12e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709699215, "uuid": "87d238f3-3e8e-4c4e-9504-c0783b3640c6", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.13245.24325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6123b459-dbac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1709724390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724390, "uuid": "e32c12b0-8d38-4f5b-ac69-cb7475fa655e", "comment": "Malware payload (RemcosRAT)", "value": "472d8150e4aa666cf5b9904c2e5ca9cd", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724390, "uuid": "6c81c184-4491-4f6d-a80a-6bef8661ae43", "comment": "Malware payload (RemcosRAT)", "value": "724b5870f31a5bc553b89a5d72625b112f6a5970b52189f0027747cc82f5697e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724390, "uuid": "2f4f0785-f965-4df6-bcf9-e825223f5f4e", "comment": "Malware payload (RemcosRAT)", "value": "9334c0dbba480706ebb9e91065eeb14b11412795", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724390, "uuid": "da5afd4d-d5a4-4463-b608-04420d9876be", "comment": "Malware payload (RemcosRAT)", "value": "757d8a93b7a427c9842abc30f9ecac9696823a98a282e561015c3597be43ce88f0e633bb4aaa215bd1ab36485d00c173", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724390, "uuid": "b274d2fb-2fa5-46b8-bfe7-44c1eef1c8ef", "value": "T1C263386EE34F0954DF55E67B034A4B4A05FCB33D728140A139BC97783BAD81E4A629BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724390, "uuid": "a0517921-2fb1-43f2-b52e-dee3070eb9da", "value": "1536:5RMyO4fKyICgG5xl03oa38bgoZnJqhiQiUvmQ+Vh8Ql5Rfj:5y4fKyqWgoZ08QiUv4h8Ql5Rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709724390, "uuid": "87f916d2-49aa-423c-85f4-84acab79b196", "value": 71301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709724390, "uuid": "545881b9-3786-4d07-96fb-c27de8d232b7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724390, "uuid": "7b92078c-a11b-4c6a-aa2a-1369cf346761", "value": "SecuriteInfo.com.Exploit.ShellCode.69.22577.16704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5329e1a-dbcf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709739617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739617, "uuid": "12139618-0e89-4c85-a4bb-f0dc901e35c3", "comment": "Malware payload", "value": "161652fb5dfc37dae3a4295d1b5ef1db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739617, "uuid": "15463ee4-0a91-4544-bc8a-92073491e96e", "comment": "Malware payload", "value": "7514ae1ed274d7ea5cd6c3e76f6845f5317dc6f61fc441ac8112c8219ca26132", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739617, "uuid": "5cf2e29e-d73a-4246-84bf-096d0ae78b5a", "comment": "Malware payload", "value": "957aa5eb4a7993cc9667e02f0c3bc9e7281bfd6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739617, "uuid": "49a06b8c-a07e-4054-bb4e-c4eab77d093d", "comment": "Malware payload", "value": "cbd9de5b2ec1321662d0af6f77192c7363101cb71d4f2aa9e7d5c745facb034c4e440a0a325016802abbe1d3b6817869", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739617, "uuid": "2cbb5d0d-3327-49df-80cc-86db183e7dd1", "value": "T125E63947F89151F8C5ADD170C6668223BB717C899B3023D36B60F6B82B32BD46B7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739617, "uuid": "2084a49d-8e0c-4503-a6e7-e67c604ab458", "value": "98304:wbDIq0lbCyW4lybhtANyXwEjEFNJy6o1tn717T:pCBp3uCjEH06637", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709739617, "uuid": "cdca8020-8eed-4230-8ce0-e63f5ea9a19d", "value": 13905920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709739617, "uuid": "f3fc5d91-1982-4500-81e3-de8103ea81c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739617, "uuid": "c8d4576b-ce2b-4a5a-b8fd-604a895561ce", "value": "SecuriteInfo.com.ELF.Agent-BGX.32563.30824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e255b99-dba2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709720010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720010, "uuid": "736dee6b-a396-4059-a1e1-04a1fd33a449", "comment": "Malware payload", "value": "f22cf31da304cb1ccc760108d0b72bb0", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720010, "uuid": "aebd4959-fe39-4358-8c01-fefeebb13b96", "comment": "Malware payload", "value": "7694004002d60ed34bc6785f298e7ec3079464d491f0f2f0862bae1988a5e147", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720010, "uuid": "1f11ae77-d159-4641-a736-c06bb3a01cc7", "comment": "Malware payload", "value": "a5be487217e1148b7410612ff3fb444ea544352b", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720010, "uuid": "55354288-3795-489a-ae94-57a5dabb1f34", "comment": "Malware payload", "value": "af2a815be78626f546bf52d411f7bba0e99a7714321b354c79e23a2fdeb294dba3b9373d23fa2f6e29254eb73c2c1410", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720010, "uuid": "f66ddf7a-bb7f-4a3d-b423-84ea5e55f510", "value": "T1ED6412C059B66BBF0039C82C74BE5E9059A2BC2D0A64B09C73F0E66D61C5E71B67F463", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720010, "uuid": "d402eefc-7464-4b0d-8b23-a923807fd423", "value": "6144:Ez98sGWUOJA90ycLOVFhYyeOjdR8cFmAbagEwLWhrXuN9vJE:Ez98xWd+yycwFiOpu32aaicN/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709720010, "uuid": "a82eb18c-b8cb-419a-9c54-5e0bc2052205", "value": 332531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709720010, "uuid": "be1e12c5-70d9-4fbf-8572-d89a17ca8048", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720010, "uuid": "9756e877-4fcd-4547-98bf-7e99d4f46720", "value": "nInvoice.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06e5feb-dbc2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1709733945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733945, "uuid": "32c32017-6fa1-409f-b50c-9bc6e598240e", "comment": "Malware payload (XWorm)", "value": "7a1c9d6ad296441c62b10f3d2a4a812e", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733945, "uuid": "25cc1505-3b0f-4ca4-8a86-86911223e841", "comment": "Malware payload (XWorm)", "value": "7756fdfd06c7996ce4a0d57550523d109c13640836880d91be0e83e6b87d3d5c", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733945, "uuid": "ea2312f1-8c46-4a38-a5c3-14c958b7e962", "comment": "Malware payload (XWorm)", "value": "182d4e03dc7b315f7f3ff55b0e14db7c4496f022", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733945, "uuid": "2ecaa7b3-66b8-4d82-bfa1-b83e9b975dce", "comment": "Malware payload (XWorm)", "value": "d35d8a73ffececa81a531d332108d100f27350679ceffdbc246d4c17c1e921a54c4b143b705dd76a15efe5ebab7069a0", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733945, "uuid": "cabb4c44-873c-47df-ab9d-60718af70b74", "value": "T17D45086117D80D62F6E4273442B52728DA73FE62E576810EFA6D0B4C4F93FC40D64BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733945, "uuid": "123a1b38-cd65-4ca5-93c7-4ca7f18222ae", "value": "48:5AFOheJhhNheueXUGCYc1s3P+/qRlrT+x2qHaljlj9g9xiljHmjZPGKVLx4uVWRT:5AFOgbhNAVUQc16P//+QqLHY40mS8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709733945, "uuid": "3db94345-8397-4c7c-a58b-3baa8b7c84dc", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709733945, "uuid": "e3dcb115-0634-48fe-8f75-4e3415c9bc6b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733945, "uuid": "b1565b61-7ea1-481b-9e7d-82b00ddf586e", "value": "4675673688.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65984b4-dbac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709724560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724560, "uuid": "5ca3796d-10c3-4835-9b08-7451e6424032", "comment": "Malware payload (Mirai)", "value": "1641530ba0af98102a5f949c78a3b218", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724560, "uuid": "f27e432f-6aa9-4f4c-90e5-823a0d9246b2", "comment": "Malware payload (Mirai)", "value": "77b95242bb490d792c80c85ac2e867b33439f77c8cee2a056ddcf7fbd6c3c55b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724560, "uuid": "694d079b-7afa-4f24-864c-60f00940db9e", "comment": "Malware payload (Mirai)", "value": "513616158878cdeac35be2a5a1d35677b0e02ca2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724560, "uuid": "8528133d-573e-41a8-a43c-07b1757ebfbb", "comment": "Malware payload (Mirai)", "value": "a6a7446e91ce526588c80d204a663e88ed9205e4b8f4b35e43c8d2dfc035f5f95877dd9fecea84b78856e083f3bf592c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724560, "uuid": "584ac3ce-a3ae-45ea-8f46-a28daad30a63", "value": "T112C31A45F8515B13C6C612BBFB5E428D3B2A17A8D3EE72039D216F21378B95B0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724560, "uuid": "f7684796-4de6-4e4e-aab0-21d84534fdfd", "value": "1536:Jh7JW6nG5k8wfaaFAkFY1LAthi4VvtnTV+HfIo+JSjpChrDObl/Cwyw8FAUk46CN:n7JHg4FbC1Lh4XnR+HfIhMpCho3j6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709724560, "uuid": "cb433dcf-836b-4e0e-a28a-686e35d078d3", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709724560, "uuid": "cbc82310-9cd5-42bd-8e45-ae97f4df9e64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724560, "uuid": "820a2950-9407-4ad5-9095-4a4c52f41fd3", "value": "vlxx.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fe31b6-dc08-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1709763825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763825, "uuid": "a2c78b22-a0e8-4759-b297-b2be70348357", "comment": "Malware payload (Rhadamanthys)", "value": "e6736aec016eec75551f9f06a29cbf4b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763825, "uuid": "ded2fcfb-f908-40e7-b548-12db8865099e", "comment": "Malware payload (Rhadamanthys)", "value": "77d4df8d32255d67d3778b8606c34f566173080753fa3637ad38c2a16c3b77c9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763825, "uuid": "88755533-0ede-444f-9d83-793107f30c2c", "comment": "Malware payload (Rhadamanthys)", "value": "3688e043b5a6bfbf99b9efb76b23f679c58ff3c0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763825, "uuid": "ec52d605-4915-4603-9d52-7d02995ad655", "comment": "Malware payload (Rhadamanthys)", "value": "50c5e9ceaadff90165907c4e964ae8e3f46c8d61ae2ac985782613321846a384f3e165826383f676a0ccedad283e8030", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709763825, "uuid": "4029c41e-8fe1-4e86-afd5-0a96810a8c9f", "value": "T1BF7422A374350B79AAAD8F4920BE1E7E32154F04C769F18A53EEEDCAD21590ED40371D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709763825, "uuid": "b02980b4-514c-4149-a842-c1ad82b55546", "value": "6144:GaG/W1aZlSGkwGCWhGAeNCcbdX3JxR6qLlhkmNfrGqAYzpJo8AdY:Gle1aZtjWIAendHjp/D48AdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709763825, "uuid": "aff729e3-074b-4d5d-a415-b309959b415f", "value": 353881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709763825, "uuid": "67282c44-edb9-4157-942a-a993a2742d7e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709763825, "uuid": "3c0f7d4c-eb56-462e-acc3-5eb5497a6470", "value": "rohas.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90640486-db70-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709698700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709698700, "uuid": "ac0acda1-a8e3-4e88-9e7a-ab89396f8d12", "comment": "Malware payload", "value": "4a9dcda3a53efb003f464b44cea2e344", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709698700, "uuid": "ac3a026d-ddfc-4b51-99b7-d52379793e19", "comment": "Malware payload", "value": "77f6505a0b0c22bf9ba14fdf1871af6128a6e5b1a4df37f3a323addf992283bb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709698700, "uuid": "0a96eb7f-c990-4c9e-a0ca-bffc4e87dbca", "comment": "Malware payload", "value": "bcbf08b925172f90ffdd76ecabda9ef1e1295329", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709698700, "uuid": "12c6f90d-08f7-4755-8578-32d85dc0a788", "comment": "Malware payload", "value": "3f8dfe57399e17d6a951e1b03f9728e7399f7efd720c3b2709ca4601ae35b3d28120ac1540a30f05318d39f8e87ff2b8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709698700, "uuid": "2e4a41d3-4f8a-42ee-aa80-bd723235893c", "value": "T12563F32AE70F0965DF55E6BB434A4B4A09FCF33D728540A179BC97343BAD81E462287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709698700, "uuid": "3ff2fb7e-e84d-4864-98aa-48e683d9dd0a", "value": "1536:VKv44d2rBEYrBYuSY4vzgDHClKVvaDLwvgzlBfeVVCzI8b8TLo:V54duBYut4v8HOKVyDLwvKlBfeVVCznP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709698700, "uuid": "d2d46e7d-9911-462c-aa2a-e9c9d14bd67f", "value": 69986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709698700, "uuid": "a304c1be-f0f4-44c2-86cb-42eb8a7961ae", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709698700, "uuid": "49c50222-5da0-4f24-a04c-a907c6a9ffc6", "value": "4a9dcda3a53efb003f464b44cea2e344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f81d47c-dbc2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709733944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733944, "uuid": "5fb57a94-a37e-4e9e-9578-45c6a70be0a8", "comment": "Malware payload", "value": "4cbc9e696747861274eff8256816baa8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733944, "uuid": "41dcc7c3-52b3-44bb-b40e-a8b40eb1ad58", "comment": "Malware payload", "value": "79d75755abbfa8d1232c06e08a4dc4535a9629bb256699f7a1e1a307feaa17da", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733944, "uuid": "6a435d64-b83a-4b2d-b554-1c15176cd3ec", "comment": "Malware payload", "value": "bc5df826a20a27fca0ee8d002539a722b44ce1fe", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733944, "uuid": "164f0a4a-eaef-4cf5-b11a-8f469933f06f", "comment": "Malware payload", "value": "9f5c63a7a088c419e5086c28eb8998c06db3203b1701312386b2e440c0f9c68aff6cd940f1247e8aefda6f1d1026b4b5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733944, "uuid": "b6332836-8476-4314-aa97-6615d7b5f69b", "value": "T160A2D1178390DD9B9A58568AF0BC8249AB23DD2797B11377CE461217834EF5C20E7867", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733944, "uuid": "797243c0-e2b9-49b2-9666-6bb3f815930b", "value": "384:pJDlI/R1shKazglyrTzHpaqHDIaZ9LR4uvkRStrx2bmyuou+UIvy:dI0tglYYEjL6ywqou+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709733944, "uuid": "aa795bf9-01e2-41e7-b04f-f35f65be36b9", "value": 21922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709733944, "uuid": "ef03c6d0-2acc-4b1a-a906-17aabbeaf567", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733944, "uuid": "ecbfd3e0-c6ee-4570-a184-12461c294248", "value": "11068-1106811068-11068.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a49f0f-dbc4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709734677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734677, "uuid": "3b6c42bf-d0e1-46ee-a9b8-9c05da098197", "comment": "Malware payload", "value": "4c389eabe2e0a111a7d758ba38efc51a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734677, "uuid": "4198434d-2f1c-4057-b0b3-f1e29b238a3d", "comment": "Malware payload", "value": "7b0f02dbef5bda825b359fb078c8a156d36f66389716f46e99e8b0043e0c2d11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734677, "uuid": "90aace96-ed1c-4222-be3e-00caafdc1666", "comment": "Malware payload", "value": "cd3fc9abfa84fd98ed999c5635ed96662d4ed94d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734677, "uuid": "1089fb0c-5fc9-4ac6-b8ca-05848b80c917", "comment": "Malware payload", "value": "84bb0a40a737dd143959145f008f88a0fdd0d2e257306b2282153ffed69c8e63669543e7f82f7ea8d18dea9ad0a462d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734677, "uuid": "63462535-986c-4edf-bf7a-1be02ff57b78", "value": "T1B1036D14A7DD823BE9BF1379A96212520774D68332A3D79E9F88809D69477C403A37F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734677, "uuid": "4eabbc51-2bb0-4364-a7e4-dead4b5c53ad", "value": "768:eqKMnuaNqZ5WWH8i96FpoLhhRGNLjmOv5L7:eahqZgWHn964LhALjmOvZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734677, "uuid": "aa69b4fe-ee04-40bf-a4b4-5c32ac8642a1", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734677, "uuid": "24d7d5bd-c3c3-45a3-af84-78e5000e9bc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734677, "uuid": "91815229-aa36-4780-89ac-90f998561e78", "value": "7b0f02dbef5bda825b359fb078c8a156d36f66389716f46e99e8b0043e0c2d11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da570970-dbde-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709746068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709746068, "uuid": "6cfe18d5-2ade-4e10-ae98-ac31d3573b06", "comment": "Malware payload (AgentTesla)", "value": "2b578c0a73abc237814bdf0dcf080663", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709746068, "uuid": "477c986d-14d2-461f-9f23-bfa9bea2c54d", "comment": "Malware payload (AgentTesla)", "value": "7c4cd03c4541288c1a325c5b34f38b800fc991ea96d1681f037efc1f5f7e6cef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709746068, "uuid": "ead6d52f-c0d0-49c5-84df-a9a2a24f30bb", "comment": "Malware payload (AgentTesla)", "value": "4b35c0b021d9db211fcbce84a6bde2a63b3d184e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709746068, "uuid": "df49ed95-cf3b-4f51-94dc-747421a7e3d6", "comment": "Malware payload (AgentTesla)", "value": "f578857d157ec37b6fda2f95758377b8397190f9099b67584f90607f43ee376a65ece651bada475f8555f2ca9319dfdf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709746068, "uuid": "58fda8bd-b820-4723-b7d8-2c044f0a298d", "value": "T18AF40145B3F95B26D5BE87F6542411050BF2B46ABAE6E30C0EC170CA79B1F014EA6F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709746068, "uuid": "78335115-83cd-40c4-b97e-153dff7770f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709746068, "uuid": "b1aab34f-9148-4ec1-814a-9863c6f78dcd", "value": "12288:lBtKZ/jr6S7JH4ydz8AZdGidwLdzepVZifNDeMV2KNH9Qkecyb6nOSt:AZ/jnVbTldwtgEDZv7eHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709746068, "uuid": "839cd2fe-9471-4cb7-b8b8-1b13dc897aac", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709746068, "uuid": "6b609ddc-0e35-4920-b990-4653e0ecf8cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709746068, "uuid": "08f1a917-0b0e-4f1e-85aa-91d06dde8c2c", "value": "SecuriteInfo.com.Trojan.PackedNET.2735.29595.3122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a62a8d-dbe1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1709747319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709747319, "uuid": "d233e3c8-cb59-4484-82ec-b9842832c73f", "comment": "Malware payload (IRATA)", "value": "4f007c674721466ff8af2d6b8b0e6040", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709747319, "uuid": "1cab82b7-d1ce-49f8-91ae-90b3f64ce310", "comment": "Malware payload (IRATA)", "value": "7fa3d58a0056e8492a84894a6fd3b3d0d87ff1f9656f5e54b10580b9a4a4fd6a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709747319, "uuid": "9aaf90ac-1999-470d-9dd0-60d3bd93e3e0", "comment": "Malware payload (IRATA)", "value": "0694c99741258c9609771c544a647f6641caa138", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709747319, "uuid": "19ccfa70-f7ce-4d18-8574-126e39d1891d", "comment": "Malware payload (IRATA)", "value": "ee39f4b7d7d47ff23717bb9f65516895cf3ec7d784ee998e5f2a2d801d1daf1bb36141aecf62c5a8df10424c2ac5b7d6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spain", "colour": "#DDFED2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709747319, "uuid": "3c99540a-2c6b-4bd1-89fe-5064161102ff", "value": "T1452633E1F1A3C297E67B9473D423560ACF3A194BBFA0089674F7672181DB9D9431A8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709747319, "uuid": "e1e7713b-dc39-4344-9936-c389dacaabc0", "value": "98304:L9hinlhin6Vhinahinx1hin6hinshinUhinWUlbqT0+L1ePKRMpxYw7:LbCzC6DC8CxjCcCyCKCWhwA1wKRa2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709747319, "uuid": "91197edb-0fcd-4e55-b3c5-cecdc9df453f", "value": 4735158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709747319, "uuid": "1a4695a9-ac19-4ef7-b2a2-b68458e62a11", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709747319, "uuid": "fe627732-760b-4cd2-b4d7-51d095d43714", "value": "CaixaSignProtect.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbed3d1-dbef-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709753213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753213, "uuid": "7cc2e1fe-fdf5-430d-8f41-010aa0f2185d", "comment": "Malware payload (Formbook)", "value": "bfbea0df30227e63176f8d5172587198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753213, "uuid": "960b3eb1-95ca-4b2c-bc9f-4813d22867b1", "comment": "Malware payload (Formbook)", "value": "81af3372de9de0b722517247542598548c0c6745448d247f3a99da73e4d635c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753213, "uuid": "9c4ee848-f650-43fb-8fd9-e61f8878cfea", "comment": "Malware payload (Formbook)", "value": "d0622d072c4d29d38fd2176e4544ca0ee2859446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753213, "uuid": "0530dc97-f5fd-4a87-9c81-c1c70689b058", "comment": "Malware payload (Formbook)", "value": "ff5f12788a347d5265e9c9be2251bebde88b7f9944a56e5bffb39966534b8255a2345a528be7f4b27be5d062b4c80cc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753213, "uuid": "d373e185-6ee8-4be3-aa92-31b751587bb2", "value": "T103F4CE4EA3A00797F0682BB5D57D2E180370287DB5D1E7C8BE9576DBADE1B92083311B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753213, "uuid": "54602bbf-8a8e-471a-8880-64afa6c530e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753213, "uuid": "a9f63644-ff9e-4e49-bfab-2ab94f2a37d0", "value": "12288:QBtgYN/jZEPy141ldYZcqgv1WLAC+37GGrGu4ogAopFzrPDrJ:BS/jZE7YFgvU7+37GjogHDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709753213, "uuid": "4d961446-d57d-41a6-9ff5-7dd82c3b56b3", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709753213, "uuid": "6a7d53bf-315b-4bd2-85ef-11e8b6b630b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753213, "uuid": "f1ec364c-a2b9-490e-8f57-545815f111ab", "value": "SecuriteInfo.com.Trojan.PackedNET.2735.17838.31459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f58a17-dbc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1709735939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735939, "uuid": "42fa9d2f-bb99-4ea7-8ab1-481fe4522b22", "comment": "Malware payload (QuasarRAT)", "value": "fed87b42561dafe8a9ee8c5ffa2e434e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735939, "uuid": "76548889-a380-41ea-9c07-98676cf8c145", "comment": "Malware payload (QuasarRAT)", "value": "83d1e736a793ba5d14b51f8ef8310bf13a2591fc40ad34d1fa3e74acf5d40c70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735939, "uuid": "38467882-abb0-4bcf-a691-d5a598a35fc1", "comment": "Malware payload (QuasarRAT)", "value": "18b0e41e2835c92572d599e6e4e0db63e396cf7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735939, "uuid": "e76efab6-0c7a-4cfa-a2c3-63551f3814b1", "comment": "Malware payload (QuasarRAT)", "value": "ab4aeaef8b14d6ae53dad142a0ec07b53543dee0ed22681e4fef30d459f826c7fb51cdadfa3854e3e3069cde52ce764f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735939, "uuid": "c82ae2cc-be27-4ec8-b074-441b39ef46d6", "value": "T115E56B143BF85F27E1BBE27795B0041267F0FC1AB3A3EB0B6181677A1C53B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735939, "uuid": "512335cf-90d5-4710-8708-103e54a4d9ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735939, "uuid": "8430f90d-3a93-4d63-a4ee-ec4142c55d31", "value": "49152:KvbI22SsaNYfdPBldt698dBcjHFyknbRNLoGdwNoTHHB72eh2NT:Kvk22SsaNYfdPBldt6+dBcjHFykvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709735939, "uuid": "198a933c-efd8-4e4c-9e28-b40a2abbc20b", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709735939, "uuid": "2bbcbba9-32a5-4c74-8fa7-c4674887ab64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735939, "uuid": "a485ce29-ef0b-4d86-ab63-c295f18fcd20", "value": "fed87b42561dafe8a9ee8c5ffa2e434e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56acfde2-dba2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1709720078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720078, "uuid": "08784943-6852-4ad1-b663-67f6d7d34433", "comment": "Malware payload (SnakeKeylogger)", "value": "2e0d9618e1b70b2e0d4d7fd38ca2b056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720078, "uuid": "b898aaf1-c005-4f2e-86a1-f1ed565c0ef3", "comment": "Malware payload (SnakeKeylogger)", "value": "875a00af88e95f034c99ef011c771492c104850557e7c742ac71d76a92a86fb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720078, "uuid": "6dc31796-16cf-4edb-a629-5fb1b14b1207", "comment": "Malware payload (SnakeKeylogger)", "value": "f559715a1338f8ad547043b79081fc214d0505ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709720078, "uuid": "382d45bc-b928-4d89-be19-284495ce3e4f", "comment": "Malware payload (SnakeKeylogger)", "value": "bcc084d84bf337e88bb98496d99ed17798942723a4181fcd47db89a7872a6037e8f829cd69ac1f4a2d86e1d88e7dc67c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720078, "uuid": "37acf587-2419-4cf9-aa5b-207d9312702f", "value": "T16AD4F14177FA5B29E6BE5BF9502051100BB2706FB9E6E30C4EC560CE2E75F009E96B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720078, "uuid": "0cc68a95-fac3-463e-b55d-787b66a250b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720078, "uuid": "e5850698-56ec-4e33-a2ce-dc27c1dfe834", "value": "12288:YBtMAo/jbiH2m5mWQoGVVk5O+U2xHNI9qI0oh10QbsQQKGC:Bn/jbABaV+vU2jMq8j011BC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709720078, "uuid": "dcec1547-0a52-4a06-9112-a408f80eda0a", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709720078, "uuid": "ab0a35c9-800b-4118-bfb2-8193b6f65a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709720078, "uuid": "e41f07eb-c93e-4065-b037-a94b09499837", "value": "rTheRequestedReceipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1531911-dbac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709724632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724632, "uuid": "c679ef27-0f02-424f-818e-9ec097eb1025", "comment": "Malware payload (Mirai)", "value": "4487422de2509818b8fced96ef7c1fb1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724632, "uuid": "154c1241-e678-4274-862b-b8dd93d91cad", "comment": "Malware payload (Mirai)", "value": "877092bbf73dd385b3f910b3539a8cd61a6e020ad7db42e39e8803e7c3a606da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724632, "uuid": "30e6c1b4-b5be-4b16-b163-1c185bb3c25f", "comment": "Malware payload (Mirai)", "value": "41d9343321685b1e5a8e5ef4d5d876cb65ada6da", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709724632, "uuid": "545b6f06-b8e7-4b55-8c73-1140784b809d", "comment": "Malware payload (Mirai)", "value": "c42c144d3b66500940ee3a51444134d8c6177aae1c4e70344078e3890d2e8ac5da484f335603a2f73c498e1e840555cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724632, "uuid": "4a01e22c-a92d-497a-9b84-9f83ee1f9a47", "value": "T1D4D33B1BB4C180FDC4DAC5B44F9AF53ADD32B1A81238B16B27D4AB225E8DE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724632, "uuid": "08e149ee-f690-4d08-b4e1-6e0258e6cadb", "value": "3072:DX+wXNsuOXWYmqnQYk11TosPipRlOaogXk72IElN7Ccy3w9ymPd:DX+wXNsuOXWYmCoPuk7ur9ymPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709724632, "uuid": "04ee45b7-5eed-41da-9e2d-a782acb83214", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709724632, "uuid": "846811e8-6734-4255-8629-d8d103e4325a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709724632, "uuid": "a009d2cc-61e9-405e-9c83-66a73cd26c2f", "value": "vlxx.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636e46af-dbb5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709728259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728259, "uuid": "744c0ab2-d06f-4c35-af6d-88aa24bf3d32", "comment": "Malware payload", "value": "81959aa15f618e7f878587c3fbee558f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728259, "uuid": "f05be4cf-76f6-4640-a99e-3e2a791c0915", "comment": "Malware payload", "value": "884107422df524c5d7584f267910c4d738fa09187a6f835374038ed27c2a4fc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728259, "uuid": "578f7467-ecec-4623-b1ea-c65b5e04ca64", "comment": "Malware payload", "value": "63f4ff2f4e073f771f3360a97a91d83cb7f397a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728259, "uuid": "39a0992a-29d5-47f7-a7bf-029d1e91c8af", "comment": "Malware payload", "value": "0c329d1c3f3d4bbd5619ca332339eeecf0b524a930818de800de36d552806a2f78842ebb02e244b0122f02362875b2ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728259, "uuid": "648e00d5-58ef-40ec-98da-94bf71c06c99", "value": "T16FD2F1B0BE9C053ADB82C27F02EFB5A63413E61ECD4E5DC982F14C5F90585D94D2AA46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728259, "uuid": "13444f8b-637d-4d28-a141-bfd2c455fcd9", "value": "768:Z0TF6I/0OdgyoCJSqeYCU7hWdj8qFCT5FL9GI0:ZwH8O67CCg7YdAMCTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709728259, "uuid": "5bd06f86-f1ed-4921-ae78-b4919819e019", "value": 28792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709728259, "uuid": "3b26c9d0-fd9f-40cc-a87b-44554c2fc96f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728259, "uuid": "436b517a-28cc-4372-bbbe-5f6d9818083e", "value": "SecuriteInfo.com.Possible_SMMODUPXA.16390.11100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12c209d-dbc3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1709734483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734483, "uuid": "50b33d72-b2e3-474c-8fdf-86ee654e1e49", "comment": "Malware payload (DiscordTokenStealer)", "value": "1cd42088f6f408986bf657d5beb50f61", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734483, "uuid": "d53d8a47-a1a5-4c9c-b29f-cda23691153f", "comment": "Malware payload (DiscordTokenStealer)", "value": "8851adcfe1aea93461dec645a4d15180ae75fd7719797be0cc443e0f59fb164a", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734483, "uuid": "b86a3064-49dd-4d48-a2f2-8251b49dd32a", "comment": "Malware payload (DiscordTokenStealer)", "value": "b0f8a12ffbefb73afbf7e7e54849d5d3d2f53f6b", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734483, "uuid": "89cd16b1-66f6-451a-a817-7bd4aba7268f", "comment": "Malware payload (DiscordTokenStealer)", "value": "1be3e10548d9354a6de62feacba08fc67686dd0feed9748be1d68c050cd41402ead3de1fc01b679c1771a200d1bbf150", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734483, "uuid": "6689b6b6-a7dd-462c-8656-be265d6525ac", "value": "T192475B02FB819ADEC664913689EA43913771FC141F2B9BD36A44B37C2C767C96DA83C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734483, "uuid": "a4227d45-2445-4ca4-86b7-8e099e18f075", "value": "f2dec354dafd3d7e669b500e1f959937", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734483, "uuid": "a1210541-2cee-495c-acf9-dd3f7fb251bb", "value": "196608:1uoLqQg80KxqH/yxusZFBHm7Y6z78vcwdhpu3OAqFMHU:YtQjxqfgBHm7T36cwLpu3/qFMHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734483, "uuid": "105e5bb3-43fc-4681-873c-cbd584325ace", "value": 26682311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734483, "uuid": "5d97155b-152d-4ebb-8fe8-0f6c93039f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734483, "uuid": "ea0273c7-9154-4806-a6bc-54409e2cf5c0", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2134127-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718969, "uuid": "f973aaf5-99dd-4499-9f7b-09f8447a580f", "comment": "Malware payload (Mirai)", "value": "a1435b7cde042f372018e14f9bb68ce0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718969, "uuid": "ddeca87d-7380-41e6-abf9-680237400bbc", "comment": "Malware payload (Mirai)", "value": "889508bfce106feeda0b5d60405661ce87190c457a8e04b12018f1da6906f50b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718969, "uuid": "54bb754f-39a7-466b-b043-10417f62359f", "comment": "Malware payload (Mirai)", "value": "de240279d35dfe8faf82911e1ebe723608dca9bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718969, "uuid": "7809ef35-6422-4fe3-8f80-7dfad4c287e5", "comment": "Malware payload (Mirai)", "value": "5fcafb60b1fa400a6e26addab1171b314e8434ff0dd15f0c0bfb1bbaaa244182935a90adfe2ad24ed82cd6eab53d2b7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718969, "uuid": "aec89a30-2b63-45f0-813a-9459e3c6e046", "value": "T102B34A73C8296FA8C259D5B4B0B09F792F53A58182472FBE54A6C3B64083DCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718969, "uuid": "9b89eb41-da7b-47e4-9058-1207a2569934", "value": "1536:2aVTHW/qIAmSqkIHFGEWCRPKBKFnLblvCifzQVW9kXxeUwr/zP:2qWLHkIlDWMSBOlvC2sWqXxQrbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718969, "uuid": "cb07f8ef-2886-4812-97e0-ef0241b30e42", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718969, "uuid": "c9d0eca4-104e-42cb-935e-b00894162630", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718969, "uuid": "d9b92bca-2f81-44a8-b39a-91c117a2709e", "value": "a1435b7cde042f372018e14f9bb68ce0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f135e670-dbbd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DUCKTAIL)", "timestamp": 1709731933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709731933, "uuid": "9deb881a-56f2-44a6-af79-264189ead159", "comment": "Malware payload (DUCKTAIL)", "value": "729ff7ca99e67494e63c4c171da9cc33", "object_relation": "md5", "Tag": [ { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709731933, "uuid": "e856e7d2-4fca-4fea-a750-7a97d1b06bb6", "comment": "Malware payload (DUCKTAIL)", "value": "88d5731f3f7fadddbfc1b58079796092c28489993955a5b43e9ee775ee5fe690", "object_relation": "sha256", "Tag": [ { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709731933, "uuid": "12d95dc8-cfcf-4acf-9fc5-60296fa972b2", "comment": "Malware payload (DUCKTAIL)", "value": "1cd7f884654744052d9ae575fe67dee98cf58749", "object_relation": "sha1", "Tag": [ { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709731933, "uuid": "3dbaa712-d54e-44a6-89aa-fa6b22c2cce5", "comment": "Malware payload (DUCKTAIL)", "value": "8f6bb6e45e76cdc9081b09c795774d51bfad55b11fc9af1c96c923674e777e66e6f8fd1f515ae6501041fbf574a1d3c7", "object_relation": "sha3-384", "Tag": [ { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709731933, "uuid": "551a730f-9100-4414-b2a3-fe80840f3507", "value": "T1BEF7AE11E3E80A16E56FC2BDC5638513D6F1F4972322D7CF0454E6992F63BD2AA36223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709731933, "uuid": "395c4836-2164-4497-bcfe-50712bc7c7be", "value": "698fa83da166edb916866ef085b426d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709731933, "uuid": "97dacae9-e21b-4af5-95b2-2da62d38caa3", "value": "786432:x7Ug5CerF/P1Q6nEL/t2zT/Ly/V5jiVaSWn:FrVRtQ6EL/t2zTQ5pSWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709731933, "uuid": "eb75a185-1d77-4694-996f-49fded20fdb9", "value": 70819745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709731933, "uuid": "a503981b-bcd9-4e3f-b3af-a292951ac37c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709731933, "uuid": "f5c0a970-6684-4746-abca-a8772a521f77", "value": "SecuriteInfo.com.Gen.Variant.MSILHeracles.129445.14345.23460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fc7c14-db60-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1709691916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709691916, "uuid": "6d6ffb58-ef50-4258-8beb-db20a596464e", "comment": "Malware payload (DCRat)", "value": "1d52185b0338ba011da91d69d75ef355", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709691916, "uuid": "ae4fa3d7-4c32-471b-849e-401e14aebb89", "comment": "Malware payload (DCRat)", "value": "89637a214dae43230912cef81e531f60592ccd9102c617a73340f23039b9f3c5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709691916, "uuid": "af41e1d1-31a9-4c69-922d-e877485190f2", "comment": "Malware payload (DCRat)", "value": "cacd79e50323f27b75afc260c4179225c0b0e9b3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709691916, "uuid": "bfced02d-9bfc-4edd-8c10-8d023ddd1e5c", "comment": "Malware payload (DCRat)", "value": "e66ba52f33c9320204370ddc01b2f9edc01b5269342f28298e0821181efe5335e87ea93dc500b337b03e083bb766ef6d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709691916, "uuid": "9b9d199b-5b8d-44d2-bef9-d087e431febe", "value": "T1F7A5AF06A5925E77C1A57F71CCE7442D82B0EF327612EF4F360E21A9AD072618B166F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709691916, "uuid": "af49914f-729c-4433-950a-97b99fc2b744", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709691916, "uuid": "f5eee5ec-9f1d-4334-9e9b-40c1c1a17ffd", "value": "49152:IBJsbi8mTgP+nLpXZ2nuPs/wVocNZr91si7Ec:y2bi8mTgP+1Z2n1/GFTKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709691916, "uuid": "7bd02350-073e-446b-9a04-e186d0ac96dc", "value": 2124532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709691916, "uuid": "092b0a69-74b8-4a58-8363-2c52241174ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709691916, "uuid": "caf68dfb-ec3a-491f-8e7b-6120fe3ad697", "value": "1d52185b0338ba011da91d69d75ef355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b579765a-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718948, "uuid": "d58af1df-af15-4036-985f-e2aa6291dd3f", "comment": "Malware payload (Mirai)", "value": "bf71835ca410eb970a9f3021900968a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718948, "uuid": "720e718b-e3a8-496a-b00f-3526ccdcc9bd", "comment": "Malware payload (Mirai)", "value": "89edf200e92347230590e1f7503d74840365ee9f53422444a021be28e6339c3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718948, "uuid": "1f229139-7978-412b-b075-e5801a90a84e", "comment": "Malware payload (Mirai)", "value": "77de5896724cff48ee0a099997b3769edb63d01c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718948, "uuid": "02b23faf-3869-494e-acb1-e17222c60204", "comment": "Malware payload (Mirai)", "value": "dabb8847397c912b925606594c1f97704d5ba8b4f2238803b4f8a2c17f5f634a2824ec862d30ffb85db0b15a49269b3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718948, "uuid": "b20577e5-6425-43f5-923d-6ecae980ace8", "value": "T11704885E6E228F7DF668873447B78E25975823DA27E1D684E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718948, "uuid": "bad913f9-09dd-48e3-b279-def39aee43b8", "value": "3072:QzvU8YmfZMS+X5jST1y/ryxzQPPk7IbB5W:QzkmfZmjCqyhgPSI95W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718948, "uuid": "5a6b7364-00ef-4e11-a410-2e1b46a2fd8e", "value": 173764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718948, "uuid": "c9dc7a53-69a3-4b93-b97b-3a5941d34370", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718948, "uuid": "90f4ef1a-5e24-440f-b539-75e5981c078a", "value": "bf71835ca410eb970a9f3021900968a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f92e590-dbc3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709734346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734346, "uuid": "c21b18cb-47f4-4798-9706-06f05ee5cad3", "comment": "Malware payload (AgentTesla)", "value": "e40c7cff90417a6d909e4e3a1dd1713d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734346, "uuid": "27586453-4051-40a4-ab3f-b35710ce72da", "comment": "Malware payload (AgentTesla)", "value": "8bfadd01edb5081338d3f5f753fc64b9035e2b0a12bd25193e3267071015df4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734346, "uuid": "fb5a7608-bfa4-4b27-919f-85c50186fee8", "comment": "Malware payload (AgentTesla)", "value": "89556afeb706729ea0f2a8e7612e9bc9980c293a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734346, "uuid": "d74da991-2a05-40f8-8a73-6c022dbd6cc9", "comment": "Malware payload (AgentTesla)", "value": "a8e4b63afc5eb80146cff0700bfa79c1d437514a46909af24779d1916bbfc29b956a0745d1898652d52dcecdf08e14b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734346, "uuid": "7255aaef-b6a0-4cc2-9194-0a9aa8741935", "value": "T188F4232923FC3336E9FD9BB8B5A4810187BAB8756672D71C1DA804EC49527409F60FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734346, "uuid": "28f6db1f-2b46-456b-84d8-e24105f00e9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734346, "uuid": "efa1e999-b103-4c25-ab0a-dce7e290bca6", "value": "12288:QE0vgMvvjpkDaBs/s3WJNeJqup4zcQv1w6AO5tzjd/japR1OTNzSwsNEQCwEiV2E:1MnFTaTsyztZdv1/jahgoNEvwECcW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734346, "uuid": "d93ba2d8-82f9-4c7b-8525-287e00bc78e7", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734346, "uuid": "ceecb83c-d9ea-411d-9692-ce52f6167893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734346, "uuid": "fd00bae7-dc74-48db-83b0-04f6717e1cd1", "value": "8bfadd01edb5081338d3f5f753fc64b9035e2b0a12bd25193e3267071015df4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba951c84-dbc0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709733130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733130, "uuid": "d6c64d0b-56d2-4a89-97d4-d14031dee8c9", "comment": "Malware payload", "value": "bee7f9fbfa5bec77136bf92aa513f417", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733130, "uuid": "61cca477-ef28-4625-a289-33a0e11ed971", "comment": "Malware payload", "value": "8d6c51a73578c227267b591110fc8db1ff1545d9a2de2f2a9cee94bba5cdccf0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733130, "uuid": "38a43229-2428-45f1-bf22-1cf46aa8a0aa", "comment": "Malware payload", "value": "701918988ff1c53f7ac44d32dbfb31695b2309c2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733130, "uuid": "f75856d8-0101-427c-a22a-628bab12fcdd", "comment": "Malware payload", "value": "41b21bd1550a054d986a71a703c140840fef013c1de16d3d2da9136342fa2b8f5152ea10a09aa6aa99bc39be685f22dc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733130, "uuid": "04ce3ed6-3a2c-43d1-97d9-1440c8ee396a", "value": "T1DB0413D63B524713C25F65FD0E2633921C6034EE38F13665B27AA40ED6AC70E257E6A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733130, "uuid": "267595d4-738e-4e5e-b402-c8d4ebc4f81d", "value": "3072:Yrta4CqFgSG1sZjp7jVqvAm6K49bsjfEwGijPSjbrlsMalHIdhA8P6FIO:YBa62ShlcUbs50YofA8yFIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709733130, "uuid": "32cc3be2-172e-4f60-8919-64cbe4e77986", "value": 188593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709733130, "uuid": "aeb2764d-383e-40c7-a9b1-99cb2aa004e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733130, "uuid": "0630f89f-92e9-4b07-8e19-c8423d4639a9", "value": "bee7f9fbfa5bec77136bf92aa513f417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137ad149-dba9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709722971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709722971, "uuid": "baa35954-45ae-40b5-bda9-f309cfae7351", "comment": "Malware payload (Formbook)", "value": "af646cc23394c41b50bbd36c2f33f4f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709722971, "uuid": "3d651745-e0a8-4a9e-8c62-b859a9c64d00", "comment": "Malware payload (Formbook)", "value": "9089cb4cd97e7d6d4166765d90145be9cd333be752b9d80629da87f3843c3b2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709722971, "uuid": "0172fc9a-3e78-4e70-919b-3ea6e40a9fb5", "comment": "Malware payload (Formbook)", "value": "02a42735ba61b1e26d7cc9a5b5bfb753618695ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709722971, "uuid": "dbe21063-72cf-4bf6-9562-10adf95c5f27", "comment": "Malware payload (Formbook)", "value": "565583f7a15b613d31ce8a341df517ed841d11aa51e132fc71143f5b201fb0539ae292ed7814c1eac74d085b332cc410", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709722971, "uuid": "270f3d85-59b3-4738-b75d-720c30f348f2", "value": "T121C423DC23FAA053FAD95AB64162A7B39C379E538F116143AB00BE67BD70742864CC17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709722971, "uuid": "665701f4-590e-4551-bb4d-6e35dabb4d84", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709722971, "uuid": "303fce3b-f3be-4948-a8a3-ac25988b0d15", "value": "12288:ZdV0bCZrYDz6Isv4n37autQE/PfhXGbqvrd9qK2DX34x:v2bYcX6Lv4n3OufnfhRvr3qH7ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709722971, "uuid": "89339e03-9f06-4f30-acf7-0928e7d36ee3", "value": 551008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709722971, "uuid": "134f74b5-3ae0-48ff-92ea-3a5292781158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709722971, "uuid": "e716a825-04c0-4127-b58c-89470e46543c", "value": "r00000632024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c01a9c4-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718905, "uuid": "62c736ee-985d-4d7e-b8d3-ebf7c36760cd", "comment": "Malware payload (Mirai)", "value": "c8c1d2b88cd62637859a62ff5a86e8d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718905, "uuid": "028630a9-69f0-4bb9-808f-f6f0cbd718d1", "comment": "Malware payload (Mirai)", "value": "90cae6dec3ca22b24f22abba8c2e6125ac2d8bfb41be62abb38b6b6a6098f041", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718905, "uuid": "4c9abce2-8aed-4bd2-ac0c-6c27d04053e1", "comment": "Malware payload (Mirai)", "value": "a1480a6b35cf1466ae42d111dc69bea52133cb3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718905, "uuid": "8b18cb1d-5d73-4df4-8135-b8725dd1a223", "comment": "Malware payload (Mirai)", "value": "e50ea87681c4772fad063b02f499c4edaa5236c0cc428608089e32ce46358884db0d186765f5435f36bbb38310b693f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718905, "uuid": "442e2aa3-4ae9-4acf-851c-63bb6c0f1581", "value": "T1DD04885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718905, "uuid": "2321e1dd-1463-4bfe-9eaf-b37330ac2583", "value": "1536:Cl2JvnXPvLNQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/zEt/Y:Cgv/ZcwZsCK9VRhAX+bShFSP0HbbElY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718905, "uuid": "aedb2d73-2462-4baf-bd13-5b8a76f9bf63", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718905, "uuid": "d3c21ea1-ea42-4261-9a24-090fcb4e1b49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718905, "uuid": "bedd2f4b-58fa-4c74-acdf-2c1dbbebb54d", "value": "c8c1d2b88cd62637859a62ff5a86e8d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea5f217-dbf3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1709754961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754961, "uuid": "e3ea17e1-635b-4ca4-87c0-9009d5132552", "comment": "Malware payload (Metasploit)", "value": "cc541f2118e516ecb29c5b67070c8ef7", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754961, "uuid": "75b0bbe4-5be1-4480-ade8-c8c1453998f1", "comment": "Malware payload (Metasploit)", "value": "9119d51da2a9ff70b77834056723b1791f0d2f09a5eee499a683681270eff8e8", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754961, "uuid": "a7edca4c-3f1e-4ab9-93aa-81378695ad18", "comment": "Malware payload (Metasploit)", "value": "0e3d180d3440b4d7bab34d6dcc555fc0bac596f8", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754961, "uuid": "6f88c25f-0487-4bc9-892d-58ffad595194", "comment": "Malware payload (Metasploit)", "value": "e0964ea0709db38af61271c93409faf909a17f0ce9d9e808087c1973580ab9879ae5458d1427a122c84581d93be8dcb7", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754961, "uuid": "ef105dee-86cb-4a39-8a0b-3eb06a9ccd51", "value": "T13961A1932151B8EA418287BF3D4D6AF6807FC224964A6045F78C4F9DF9DDE63398D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754961, "uuid": "a09284c3-f3f5-4a78-a2a7-5dab3643dfcd", "value": "96:05Gt27/fuSgkWvDgQfLhL0H6mAiBrVMmk8:0wiupvkH6mAiBrVHk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709754961, "uuid": "4e91e06c-dde3-4cc9-a61a-b771375f33d8", "value": 3246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709754961, "uuid": "00f808fc-32b8-4aad-a9a1-94a0a8af2948", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754961, "uuid": "ccf2f196-4464-44a8-afe2-0f10ac0567a6", "value": "bVUbmmM2.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c110d9-dbb5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709728243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728243, "uuid": "f0a17e3e-4b0c-4002-bfc9-8083b19ce14d", "comment": "Malware payload", "value": "69e72d1d8b8777a970ad7d30b93b853c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728243, "uuid": "42cad9f9-3af9-4d07-8202-c0c47af3f269", "comment": "Malware payload", "value": "9392237822e19c21243d850c6d95d2c5c2f3b4b9e524f6a47eb849d7a04da133", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728243, "uuid": "1a15f471-2015-45f3-bdeb-e8e569f48d06", "comment": "Malware payload", "value": "01ddd72c14f7954210625a7b1b22ce3d8b60cbae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728243, "uuid": "54e58f30-0562-445a-98bf-a619f1bdf5a1", "comment": "Malware payload", "value": "9140d6da02463b52407e8a865a3d51d62bf658762d4c9b21b46fd29f6435f4579e396c04f2571d02fbf95ec6a4bd4431", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728243, "uuid": "262ca35f-1ec4-48e8-85bd-3b358d222eb5", "value": "T14C23F220AA333DA5E4DACBB765190072412A7B5057DD4323A070EB95CD54F96923DBB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728243, "uuid": "afabc115-5dcb-4f85-8b6f-99d0edfc857c", "value": "768:sieV591XFwi5xz64zEqYrEnwsnJ4dDCGpz5Ui5lJdSyjaY4iIwOj7XRiM:EVki3NEb8nlGpz5U6lJdSSd83RiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709728243, "uuid": "dc67a3bb-5148-4b1a-bbfb-bf79165ce3f0", "value": 45664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709728243, "uuid": "16999be5-6001-4a1a-a410-5e2131fab9a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728243, "uuid": "0228f52c-610e-43f5-a292-5bd6cb35c449", "value": "SecuriteInfo.com.Linux.Siggen.9999.23211.19240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3ff32c-dbbd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709731823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709731823, "uuid": "196a1b2c-63ee-455c-8c9e-2aa22d77f4a9", "comment": "Malware payload (AgentTesla)", "value": "b1de2d19558293238b2af55730651dff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709731823, "uuid": "855866da-aea0-4a49-8efe-37da8d2b4c20", "comment": "Malware payload (AgentTesla)", "value": "96af0fa6fc810ee4ae3aadcebef6bfc1fd1a07b9cdcd42542c2061518a61855a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709731823, "uuid": "9576331b-5943-4ee3-bd5d-6747da4b41b1", "comment": "Malware payload (AgentTesla)", "value": "617865f49125ee0e191094ac5378908e132dfc34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709731823, "uuid": "77a8ef92-d0a3-49ce-b89a-954e96ed2ae4", "comment": "Malware payload (AgentTesla)", "value": "aace33715e31988c1fcf48c4b324757194d47c96a74af4ee692fc9e89c559d97b3cfd704ec800b29b93b9f412a9331ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709731823, "uuid": "d3d121dd-ecd9-4495-8eb0-54f9eddd53d9", "value": "T146F4F10163F90B1AE1B997FA617451041BF275ABBAA1F34C0EC270DE6D71F020A96B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709731823, "uuid": "bf076866-55e0-471f-9d9b-f710210ced61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709731823, "uuid": "10e231fe-40f9-4d34-8094-726509f143d6", "value": "12288:cBt7X1/j4YqBXEkxKTsYyMl10iJKW8RYMpopgdVSceNY/fzioE1PGro:eX1/jRSX3xss3Mj0iJqRn938GL5E1er", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709731823, "uuid": "e80c5090-f62c-4b3a-8cc7-c354d0e931e5", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709731823, "uuid": "d2ee851c-4ec9-4b92-88f5-de35e1b2f8b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709731823, "uuid": "8ca14994-1955-47f0-8867-57c9132e32d3", "value": "SecuriteInfo.com.Win32.PWSX-gen.19918.11804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87948d9-db9b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709717235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717235, "uuid": "fb532095-1387-4d41-b32d-d87a8ca8e6b1", "comment": "Malware payload", "value": "56f541eed394d049d5232f544c192223", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717235, "uuid": "6f875afd-b497-4fb0-8032-176a879e6131", "comment": "Malware payload", "value": "99673ea70d232dc56b5050f3a9be1aa46b8d934a1acb95184843b4234bcaf5fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717235, "uuid": "8f678d2a-a46e-4162-8eba-98463f874384", "comment": "Malware payload", "value": "35868453db0c4b399669fe6b777c8bef1f8e013e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717235, "uuid": "6ecddd6b-6de6-43a9-92eb-b39dc60c399d", "comment": "Malware payload", "value": "33419481591e308c981ce26b89328fad0f875256d9a1e6390f59dac114dba498312ca0b1acae02797109138ace3d0024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717235, "uuid": "161566d3-9887-43fb-b796-3dc6b54a3519", "value": "T1BCE733813854404EDED04070EFE3D1AF1B809D7D5923F49DA9FAF91778EA9D9A21B88C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717235, "uuid": "ca8e0c50-fdb7-4245-9e95-6fbdbe89ac74", "value": "e848d13937c31915302b5df730c37eb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717235, "uuid": "1434cdaf-44f3-4024-8223-ef6e8321da6a", "value": "1572864:QJqI122ZgchlGTamquCm/U49B7mNy41/759T0d8WO6:fI1XgcymAlBH49vTa8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709717235, "uuid": "827f0aac-3e3e-4c09-a671-d3f27708b79f", "value": 69388944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709717235, "uuid": "e689b9b8-5635-4dfd-bca5-7465cffe79b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717235, "uuid": "b2cd66c9-0063-4e48-bd54-0712570108b2", "value": "SecuriteInfo.com.Win64.DropperX-gen.9519.23032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af60d62b-db96-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709715072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715072, "uuid": "e2f6c134-cfe9-484d-9b63-0a2e6e09167c", "comment": "Malware payload (AgentTesla)", "value": "ad1b5eb8ac04a99c743e615b81bbab9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715072, "uuid": "efb0e2e3-1a50-4c35-a93b-afbb55f66e11", "comment": "Malware payload (AgentTesla)", "value": "99a1c20b08ce68a8b787a7234d5421a4c7e1f1607de03c91ee346e93373a4041", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715072, "uuid": "70290845-18af-4217-8e49-608efd8ebed9", "comment": "Malware payload (AgentTesla)", "value": "9b28273832a99430c0a6ce222ab0b70405db326c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715072, "uuid": "53124478-9f2d-4770-9dd2-82ac6af58486", "comment": "Malware payload (AgentTesla)", "value": "1cc4b26c8c66b46deb46bce178a40e9aa97900e4c8c613a8e62e9769d51cd238a75ef35bb203d50b018caf5a26edc8a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715072, "uuid": "cad24b5e-9408-4022-b7d2-03c76202aed4", "value": "T17E051245A6E81798F7FE4BBA2AF1E4245BF376769A60C35C0DD8A0CD1C23BD4045A633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715072, "uuid": "334e24ae-c526-4070-bf44-b6af1de030ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715072, "uuid": "75b64ebc-d2dc-4cee-84b8-f271fc608756", "value": "12288:fnq02iNsuS+EFLbTqwQOVCJPZZ1PmajfbCD0TRHmRlImR4yBW5ljvKeJcMfUKkkR:fnz1E7q9VNZZphjY0TRHqRSySl1qMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709715072, "uuid": "c86be393-eb12-4b1c-9b42-2e2fb68b86aa", "value": 817672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709715072, "uuid": "248d7359-96e1-4c21-a75e-e2a4b8faa595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715072, "uuid": "6e6cf5bd-f664-4ace-8646-fa6e890e187f", "value": "URGENT REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0fba1f-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718929, "uuid": "be6c70fd-4731-4afb-8f1a-923eca47dc22", "comment": "Malware payload (Mirai)", "value": "7e9b2636522877a67d088da1f9bd283a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718929, "uuid": "fc7322c6-1fd7-41e4-a77c-23fa4a96ff59", "comment": "Malware payload (Mirai)", "value": "9bdd42f0bbf15492dc0136bc1ebb9fa9e487a2f5c82feba031b3d4b1c8470eeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718929, "uuid": "880301b6-a898-48b8-bf83-6ac0e9c697f7", "comment": "Malware payload (Mirai)", "value": "9be5a1a26df5cb6020c7957e18b5538499239dab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718929, "uuid": "6ca86148-1493-4884-8b26-58e47db9703f", "comment": "Malware payload (Mirai)", "value": "d76f8e2da92ebf1cfe0a22b72b35139a9c8c0a07885bdbfc64d477306a44eaf3fc0f80f1d9a3f9563db6cc779cdcf05f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718929, "uuid": "d47f33aa-100e-42dc-9d86-61552a0e6057", "value": "T1BAE30A56F8819B12D5C111BAFE1E124E37131B7CE2DE7202AD246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718929, "uuid": "fcf50585-cd7f-45a3-99cd-01664f86ed75", "value": "3072:ZUIK7uNUPMNrbAXx0Kfw0aHI5yjwDCO32ZRpU:ZUrMUuAX2KfFa8nH32ZRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718929, "uuid": "bb56754c-4749-4d51-ac26-b74e192af2df", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718929, "uuid": "3004c2f0-c2bd-4486-b1fd-7d96d07ee7b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718929, "uuid": "09a8286c-d225-43cd-abd2-6a692047337e", "value": "7e9b2636522877a67d088da1f9bd283a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f388509-db85-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709707717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707717, "uuid": "5095ed94-f458-4840-a7d5-a508abf62be3", "comment": "Malware payload (Mirai)", "value": "d5763f78919b69ea4d85aa6df97f1317", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707717, "uuid": "fbaea266-5b58-4d0f-83db-11e94b5f7b30", "comment": "Malware payload (Mirai)", "value": "9bfaa0e3eaacd1150bc6e9a94cac8ca66bae60a84fb6c5c83328ad24a1a9f1f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707717, "uuid": "fcb37c3d-8a1b-4240-946e-0df4f819998a", "comment": "Malware payload (Mirai)", "value": "45b632e18fec2d278f8e25b3c0596a615a4fb17a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707717, "uuid": "033e52b9-260e-4288-9e1c-e49f8ad33a58", "comment": "Malware payload (Mirai)", "value": "c182754f49b74bdda3bf7b37a267acc1fe10cde4821e95e8e92c2d01deb5a22d7f9b8b5663ffea8d4ed048d01fba1906", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707717, "uuid": "b63d3158-865b-43b8-af84-50b6dd460dbf", "value": "T197D31A45FC518F13C6D612BBFB5E428D3B2A17A8D3EE720399251F64378A85B0E3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707717, "uuid": "7d8c7423-4b65-40bc-9d83-a23f047a7e1c", "value": "3072:uxjU8vohtAojySV1l/47WgjExKB8Apm4s4cL:uxjgQub/477jExzAprs4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709707717, "uuid": "7cb2b0ce-c2ff-4fca-a7b5-44bf709eacb2", "value": 136512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709707717, "uuid": "dd5cc513-0251-43e5-9d39-442845d1fd32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707717, "uuid": "f388344e-a113-457d-acf1-2e50bafab9fc", "value": "d5763f78919b69ea4d85aa6df97f1317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667d4e90-dbc0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709732989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732989, "uuid": "e0c07015-62b7-451b-bdc1-c851130fc917", "comment": "Malware payload (AgentTesla)", "value": "405f865a4d87f4f8c910f5f3f31a7067", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732989, "uuid": "564a922c-7d71-4f82-beb7-b5b9cd1c2491", "comment": "Malware payload (AgentTesla)", "value": "9d2d06f9adad149710d34c3a37f6e4e7c0542f0982b36e1dc339a63a9c2365e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732989, "uuid": "e3b407a9-1d89-430f-b8ed-4a566783177d", "comment": "Malware payload (AgentTesla)", "value": "1542fa33eb384e623bc88dca3e6a78c242238395", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732989, "uuid": "416825d6-f6fb-42fd-803a-261fedf72215", "comment": "Malware payload (AgentTesla)", "value": "8a8f943b432ea0f83c6b3e4948d79b79e191eb102f172723891556a0d12c5d42568241c6037413d287952fc282907aed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732989, "uuid": "7c0a1c87-2443-4215-9ee5-768779d9944b", "value": "T1F7F4024937E94B18D1BF63B9A074950143BAB66F7A62F30E8EC0B4D96D773404B01B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732989, "uuid": "ddf34bc1-ecea-4fa2-9276-52899bcf9241", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732989, "uuid": "dc7973c8-bb8b-4e7e-a0bb-bdfacee28b79", "value": "12288:v6FO1l6nQx9/joio3ejEPX72mLO/B8QUHC/BSEOI/9DUT5YM52dcMP3uR:E+/joJf72mLOPSC/QEzRUlX5Hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709732989, "uuid": "e736aa17-064b-49df-ad5c-aa0adb5ef2aa", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709732989, "uuid": "489407a2-0fc0-4e03-a4da-e6698f2056a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732989, "uuid": "ee06f76d-453c-45a2-bd67-798b22507bd9", "value": "New POs# ST-2312180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efa64f7-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718910, "uuid": "1b744174-d42a-4bc5-b7af-7c1a35de3200", "comment": "Malware payload (Mirai)", "value": "5212329deea6fc119e04c305416b0dc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718910, "uuid": "ef43d546-2644-4ae7-869d-a189c20c5c33", "comment": "Malware payload (Mirai)", "value": "9db6fd2ef1f45be5674c4a4bbde05c87fb702572a6cf50b148d60ce0fb53eec9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718910, "uuid": "556999ba-c717-4133-84a3-9c8df4aaada8", "comment": "Malware payload (Mirai)", "value": "20f94f20a63c05376cfa8803d241c94f5e769749", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718910, "uuid": "586887cf-e59f-427a-a271-3203b28dae87", "comment": "Malware payload (Mirai)", "value": "bce170fffa0fbbd64b9219d011c40defbeb2aff2eebcace7839e8bc4d3af3b136b803dd762905cbf56dec5dac1eed7b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718910, "uuid": "9cac8e9e-c58d-4bda-8516-6a63526af993", "value": "T1D5042A46EA404B13C0D627B5F6DF42453333ABA497EB73069628ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718910, "uuid": "b5897620-cd88-429e-ab99-0b0ece596a9f", "value": "3072:HK/lc7NbBLbcBCkoajwdyqkk4/T/6EBpNu/hJjogM/RHWT+M:HK/gBLbEloajwdybkwRBTu/XMgM/RHWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718910, "uuid": "23c7d5eb-2887-40f5-a4d0-0e73376236a6", "value": 179805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718910, "uuid": "6ccabde2-97a0-45e0-8fce-173f2d216952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718910, "uuid": "5983c874-2a8e-4b1a-aad7-573f2595644e", "value": "5212329deea6fc119e04c305416b0dc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15602d88-dbc6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1709735430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735430, "uuid": "7887d4e9-8745-4430-8b6f-7af0ea3e6eb7", "comment": "Malware payload (Metasploit)", "value": "5485359ac4238d5954efe0905be1b666", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735430, "uuid": "d5b43ba0-a945-4ce9-bf8f-936c1074db90", "comment": "Malware payload (Metasploit)", "value": "9e6c00d495107c977eda44aee56a8a54225cc0e6f15fa084161ffe8cde6ab622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735430, "uuid": "74fb88d9-36a0-480d-a5ce-e516dc1e79c8", "comment": "Malware payload (Metasploit)", "value": "adf8028922e6cff8bb53341135d71537f72740ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709735430, "uuid": "353645e7-c25d-4876-af69-59a35b466065", "comment": "Malware payload (Metasploit)", "value": "27d0607f3b5d16fe9bab313362a8388572fda6a4abdae59d5a9966a746e2204801065e3adbf84df3930a1b39cff3c4cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735430, "uuid": "92f623f8-1908-45ce-87f6-5b88a0897e27", "value": "T12972F7812DDF60CAE3734FB013E879BF0556F9B11A2A71F87482598547A4D89C8B2FB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735430, "uuid": "fc958ba0-977d-440f-9bd2-87825bb2c80e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735430, "uuid": "d9570171-b113-4deb-a589-ea09a1947d29", "value": "384:zEEoLO56ayzcMj+u+XvueaWwjuYgSwDpwmc6MnfTtHF0:gE8O56lcVu+X0aYgSwDrcZfTNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709735430, "uuid": "e830e5dd-bac5-4b4f-b3c0-3093d4318da1", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709735430, "uuid": "dab30b80-bc29-4991-8536-bd1d764529ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709735430, "uuid": "d89aceb7-9f52-458c-a9b7-895739904ad9", "value": "9e6c00d495107c977eda44aee56a8a54225cc0e6f15fa084161ffe8cde6ab622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931a8cdf-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718890, "uuid": "7234031f-d0a6-46d9-abac-3dfe615efa7e", "comment": "Malware payload (Mirai)", "value": "fb519dc6f971545f9b0e2ff96a957f26", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718890, "uuid": "d73cc3c6-f162-4ac8-8155-d3180ff16a16", "comment": "Malware payload (Mirai)", "value": "9f12b65b0e5923aef1ac2dfb182e60fcd1cf80026290eafea7d017b418649a03", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718890, "uuid": "347e627f-eb19-4f92-92b7-e5cf9c3608f9", "comment": "Malware payload (Mirai)", "value": "c57b95cea5e56349c645984d7f2019b848f15e9d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718890, "uuid": "d716cfea-5967-45e3-ab48-104e3e1b1b9c", "comment": "Malware payload (Mirai)", "value": "167637aa089a9a4bb3342c5cd28ef58ae37b21fc664169758ec65954c3874f1f7fedccad76bdf1895ccb9ce00d8bac87", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718890, "uuid": "bbfc34d0-e6ff-4a9e-ad74-b481627037bd", "value": "T106D33A1BB4C180FDC4DAC1B44F9EF93ADD72B1A91238B16B27D4AB221E59E315F1DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718890, "uuid": "1477b35a-15f2-4550-a9cb-fb2ad910978a", "value": "3072:KmhXw3d2a+lFTa1S1ET9ojALsROaogf12SBVsGCGzxAvYPd:KmhXw3d2a+lFTbDfbLCvYPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718890, "uuid": "702858ce-bbe6-45b6-a5ae-b12c7bf1a807", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718890, "uuid": "de5e3e75-898c-4c48-8e81-8ed8e6be8a92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718890, "uuid": "5438be6c-d7ce-48ed-a99b-26ae75b19087", "value": "fb519dc6f971545f9b0e2ff96a957f26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89903853-db85-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709707708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707708, "uuid": "5aaf9532-2b46-4143-a581-cff8e015ffc8", "comment": "Malware payload (Mirai)", "value": "7192ec5fd2f63845287a03dfa0d8c2d3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707708, "uuid": "121ddfbb-c1d8-48f9-ba99-7214a6295dda", "comment": "Malware payload (Mirai)", "value": "9fce0fc42c6fd7f924f5635e733c26d63bc66c20944a2cd718b9fa6af81e4835", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707708, "uuid": "4258a320-e569-486c-b0fd-6c3079fcf942", "comment": "Malware payload (Mirai)", "value": "6ece621518f8a47416244c11d01c27c07806b703", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707708, "uuid": "c027eb2f-16df-4f79-a696-029120c65b4e", "comment": "Malware payload (Mirai)", "value": "3616ce43ee73c02c2dd6809cfa80064ad14ee485c036f6e722287b7261e834c30485ce25778785fb2b505ec41c7becff", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707708, "uuid": "b20f0ae1-9376-4a80-aef5-de0698c16959", "value": "T179E35B0BB4C184FDC4DAC1B44F9EF53ADD32B49D1238B16B27C8AA262D5DE215F6DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707708, "uuid": "41f4f86a-3b96-48e7-9e36-06e1280e8472", "value": "3072:g/ibE7gOi5x7ctslSS6tHchxHt0Y8f9ny0mr700KQFElQqwNad6NNRZaNdNNNNNv:g/ibE7ghb70m14TwiJQqwNad6NNRZaN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709707708, "uuid": "bdbf7b4a-fe06-4e46-a0a3-a609aa8b35f0", "value": 147768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709707708, "uuid": "00bdbea2-651d-4779-b106-43420e163e5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707708, "uuid": "722e520a-a50e-4f3a-876f-b6a45088de77", "value": "7192ec5fd2f63845287a03dfa0d8c2d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7c6458-dbc3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1709734157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734157, "uuid": "34c25174-6c6d-4fa5-9b7c-e1fa4189be37", "comment": "Malware payload (AsyncRAT)", "value": "0f708fb7f77ebb50f2046b514b258f5d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734157, "uuid": "cbb8bb16-2795-4e3c-b4e8-8c33978f47d5", "comment": "Malware payload (AsyncRAT)", "value": "a45544cab70546c66647e325a56b45a5c32c91ff987b23675de70fb040d2c79d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734157, "uuid": "00e2c2f4-8bcb-4fc6-a556-26299e4c5224", "comment": "Malware payload (AsyncRAT)", "value": "7377a71d2b02775ca133952369744fd70eb2ee0a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734157, "uuid": "e8eaf0a7-50e1-435d-8547-ece87e330ab0", "comment": "Malware payload (AsyncRAT)", "value": "83bdeb3ac447a795d1a171049f6f3b81ceb037a621e6e5c36dfb3b5ba299a1c3e67221f3c3818fd5d879f3a0155caf81", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734157, "uuid": "c99c69e2-40a3-464c-bb79-91d7a79dba05", "value": "T1C84412E0A7548457D1F2363C643D3B28996A46E270E19B0BC7136F6D7E2E782E927343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734157, "uuid": "529c175c-c607-4321-99a5-0510edc7ee49", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734157, "uuid": "3d8ea10e-4a18-4422-b403-a723c54dd58c", "value": "6144:ffL+oqMXHIucr/GI+bsaRKTYuEYqWw8cfw55Cpwk0X0J/DUvPUKfJ0XfA:ffLDXoucqlVgTYubqD8dnCp50X0JLk/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734157, "uuid": "e36e96c0-238c-41c6-a2ed-fcf3756af1d3", "value": 263633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734157, "uuid": "a202fea7-6a7f-42c9-bbab-d700856f69a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734157, "uuid": "ca06d015-7e74-4edb-9855-48bf09345f06", "value": "a45544cab70546c66647e325a56b45a5c32c91ff987b23675de70fb040d2c79d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b644d5-db85-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709707703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707703, "uuid": "de653e24-5180-4fcd-acb1-b329e1c36348", "comment": "Malware payload (Mirai)", "value": "00f8b49d7e4bf294d652870a5cb32ffb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707703, "uuid": "62351c8c-95ec-479b-8e3a-ee4b76dce9be", "comment": "Malware payload (Mirai)", "value": "a5701adfe214127a181fad706c176b9fda36ac19d3e3f494bcc9b263a51662ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707703, "uuid": "ffb43845-4395-4e4a-809c-26fee74403ee", "comment": "Malware payload (Mirai)", "value": "d1463e61d757bec2f5e87ccc16ed325403ab8c76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707703, "uuid": "73af9c75-e92c-495a-bf0d-8247c93beadd", "comment": "Malware payload (Mirai)", "value": "29d245ed2d2771725f8c2e31728805bbc5762badfccab3446143ea2d5220b841d60565e089da1ba4b5c43afeb6e69179", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707703, "uuid": "99aad49d-10d1-4377-b28e-6de1b30e120d", "value": "T19604971E6E228F7DF668873447B78E25976823D627E1D684E1ACC1105F6038E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707703, "uuid": "4ad8eb94-4747-4980-abf4-c57d6e96ca35", "value": "3072:tz1faMjOoRiWAJKTsTOh3MAYgd7EKTvZIc4s:tz1iMLsE843WgSKFIbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709707703, "uuid": "20ac58d0-4efa-4ddf-b368-20de8e7f9b5f", "value": 186140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709707703, "uuid": "d5c588a6-824b-4a6d-a497-d0dbf358567e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707703, "uuid": "6464ff96-e291-484b-b248-8f2fc1bc68f3", "value": "00f8b49d7e4bf294d652870a5cb32ffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67988a7e-dbc8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709736427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709736427, "uuid": "3981e2fd-bb2f-4653-b29c-aaec46f039c6", "comment": "Malware payload (AgentTesla)", "value": "0e1667b99c63fe9538224c067cc27e14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709736427, "uuid": "ed9e1e67-b1ef-456b-bb73-4b61aa05fed0", "comment": "Malware payload (AgentTesla)", "value": "aa0bb57cc545a3e7e234ef691f84ea8f2fc90f4e024a3addcc23d2f20a0e63e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709736427, "uuid": "d51b0353-cd1b-49ec-8dd0-fefa3c4c1fd8", "comment": "Malware payload (AgentTesla)", "value": "63222f5bc43dbc5b8bcf5eaba253ab2db3601b0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709736427, "uuid": "b67c416c-e166-4ec5-9ce4-5c741a60a2b8", "comment": "Malware payload (AgentTesla)", "value": "1038cb24ef88c8d4dfdb23c830c31445fb16a0154722af75e89f5767ee303ae791fb60a20684dac294e0c728fb2274de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709736427, "uuid": "fb9634fd-9f01-43e9-892f-ba52809f45e6", "value": "T1F8F4F003B2FD1B1DE5B94BF1217441100BB27D6BBAA5E35C3DC574CE28B1B018A96AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709736427, "uuid": "66dcd15b-d730-47eb-a35e-645f058eeb73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709736427, "uuid": "f0564238-d71e-42c4-8f8a-d746b64dc129", "value": "12288:sBtg6Z/jRu90UkSmo8ZgcfNI5LX+39uE0krgTT+bZQK3EP9dgNkR:JQ/jE9wojcfNIgNZEvE8ldJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709736427, "uuid": "57f7acf9-0c6d-4ab7-bf61-7d920f207fc3", "value": 760840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709736427, "uuid": "fbfeed22-58ed-478f-af11-afc011d1268a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709736427, "uuid": "00946894-8278-4631-b8d7-0efc0a1f4800", "value": "EKSTRE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbe0b7c-dc12-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709768109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709768109, "uuid": "53c6bfb4-7e24-4283-a4c6-25290c6e00cb", "comment": "Malware payload (RiseProStealer)", "value": "2ad24bae91136e33454a0901ed8c578b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709768109, "uuid": "0b73c84a-7a0d-4457-8233-56f537d4a355", "comment": "Malware payload (RiseProStealer)", "value": "aa764a761fd512c5f6240c23abfaf3f96249053e98f6d2c0d6a0753ea73abcb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709768109, "uuid": "fcce94be-1d4e-403e-9beb-b6892990902b", "comment": "Malware payload (RiseProStealer)", "value": "f338310f690a788ba056c89b8399f44f9b648826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709768109, "uuid": "15118433-693b-4450-9fa9-34f607f4363e", "comment": "Malware payload (RiseProStealer)", "value": "3af10529c6d42f6773147e7cdc80bebc6853ea95e8d8185d867c2ce56c64c2d522fdfd9fa98e54fb750c6325e4dd21bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709768109, "uuid": "02e83e85-e245-4d42-9423-123b6694ab21", "value": "T1D266334AE2871BB8C4F651B80B46FF7D34F12AB145A14EAE510866DEEDE3739B832105", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709768109, "uuid": "98a994dd-6da0-4573-a4c7-6b8b4a3e941e", "value": "5fca035c1d9772fed59e3f04779695b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709768109, "uuid": "57cd93d8-80b3-40f1-b692-cb19da6ec020", "value": "196608:Ex9HgOZVfjyr9RApQnzZswNgGothGOfawK1SgAP:wKOZIRhzawNgTVywK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709768109, "uuid": "67a52e42-05fb-46f4-8ea0-20452c256e3f", "value": 6784000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709768109, "uuid": "f7c66962-1c0f-4031-b945-095caabd3b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709768109, "uuid": "81ebdf38-da8c-4d44-9a90-d11a64a3562f", "value": "SecuriteInfo.com.Win32.PWSX-gen.9534.16812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8369ba55-db85-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709707697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707697, "uuid": "37898369-d035-40e5-8252-b6dbb3872d81", "comment": "Malware payload (Mirai)", "value": "42ed1f26243c247aac0ceaeba01f9b50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707697, "uuid": "6803e28f-38d0-44f5-b3fb-d6566b2eb595", "comment": "Malware payload (Mirai)", "value": "ab745ee77f81af4f9e6bee146e80cee355c507ad5ed12e65a6af87b54f00ab3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707697, "uuid": "0354d76d-ac8f-440b-9d02-a3e23f3ae1b3", "comment": "Malware payload (Mirai)", "value": "0ed2a88616d167d1563cf5cb3fa5eacd0c030cb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707697, "uuid": "aad67ab6-c4fa-4c04-93da-e32f0020eecd", "comment": "Malware payload (Mirai)", "value": "5469139748a3dc203ff912d1dbd647e94c085a54f40a7fe511febefb3a72de2ed039d54e5f7e5e9aae9d1b1f394bdf22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707697, "uuid": "96051684-6055-4423-b486-2e7a6f5837c2", "value": "T1B2E30A56F8819B12D5C111BAFE1E124E37131BBCE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707697, "uuid": "06ffe668-7285-47f0-b6ca-9b120854757b", "value": "3072:2LQ88gNXcU0GUpJXRs1LwKav/v7KHzJ7C/HtUMGU:2Lxsn9JXG1LPaHvu5+HtUM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709707697, "uuid": "3a518bb4-7a6d-4df4-aee6-19678334dd65", "value": 151292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709707697, "uuid": "3941b032-71b7-4886-9f37-f78a735c8f18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707697, "uuid": "3194f8de-8134-4aea-8d4b-c28b11c6ab29", "value": "42ed1f26243c247aac0ceaeba01f9b50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441b65d4-dbb5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709728207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728207, "uuid": "59afd704-3dc7-4911-8360-fbe8fbe20995", "comment": "Malware payload", "value": "4e0a17518a7efa9fa58f8edfdfe7d89a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728207, "uuid": "2d4a6517-9a76-4a88-8dfd-7341ff87762e", "comment": "Malware payload", "value": "abb2fee06c8e79b4690d3435a2ab0944ccaf887ce1a65cb48dec3244ec609a80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728207, "uuid": "20b4bde8-cc93-4cfc-929a-8791383a7c21", "comment": "Malware payload", "value": "c586f30fc0ef4b1439a133c4cf3a3c809b8f0038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728207, "uuid": "eeb99e1c-0746-4829-b378-4c1a2204f13d", "comment": "Malware payload", "value": "5c0482870485cc6cb0ba73f323aea263e4090f564bf56d0e778f15ea718351b164b4e53fba07fd96dac052232e5f1993", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728207, "uuid": "b6dbb724-dc8e-4769-8c43-c40ca5938bbc", "value": "T18803F133CB0AD651D3CADD7B793A50E96EE6B1792E67133ED33917200E0AD0051E8D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728207, "uuid": "036740fc-76c4-4ef6-957c-341c8c25eff5", "value": "768:3NvBFvwdtplcNrq7g+T0TLwVviY3IeP0HkjHYQDncs/Nv3oaohcqB7XRJU:9vXwdBPI/rY3INEj4ns/93opf9Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709728207, "uuid": "8b2b28a9-6fa8-47f7-a9cc-dad0821b3d52", "value": 39192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709728207, "uuid": "74cf2eef-9882-419c-a243-1d0c1f7528e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728207, "uuid": "8d42535a-11cc-412d-a15c-3fe9cd33f8d6", "value": "SecuriteInfo.com.Linux.Siggen.9999.4202.7440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32a1403-db71-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709699214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709699214, "uuid": "16602730-182c-4c93-acd3-3dd2c71b6e59", "comment": "Malware payload (RiseProStealer)", "value": "28b9c05785324654d47f1cabaf519a70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709699214, "uuid": "5092fe16-67da-4166-b334-c4aec807da30", "comment": "Malware payload (RiseProStealer)", "value": "ac5165befeaa1287f894fd81169cfcbddb5c9621eb81944c1dea806a1001f6ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709699214, "uuid": "9426067d-d667-4892-80a0-1798a6b4433b", "comment": "Malware payload (RiseProStealer)", "value": "b4e77d769fc31d0248f9fc1c7a7dce557a037425", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709699214, "uuid": "233ea786-ae73-48b1-8b88-f7bab6364013", "comment": "Malware payload (RiseProStealer)", "value": "cdef8b096940d1346299fc65b1a7dbd99c396796875c5ecfbec5b5a32e0286ee718e3d20ab509595e5e5d19e96490eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709699214, "uuid": "0af4163f-16e9-4b42-8503-0f8f8b446153", "value": "T143B53343A4735A8AD7574EF3C7E6473FCA83ADFAADD3293C7C1432A40593265E94810A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709699214, "uuid": "c6328236-2b52-47e2-8a00-41eb575ca72c", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709699214, "uuid": "a514a646-6f32-4384-bdc7-f29d72cf3a2b", "value": "49152:NNlds0pfSI9nGPbFZs2hsHs5DozeMqiz7:3s0pqI9nMFy2hsEozIiz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709699214, "uuid": "a9fb9ac4-0b8b-4b56-b44f-3ff88e88b908", "value": 2304000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709699214, "uuid": "33d669f0-dfa7-4cd3-b997-0ee9f5355508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709699214, "uuid": "6efc0edf-d684-49db-9e23-1ac28e109cc0", "value": "SecuriteInfo.com.Win32.TrojanX-gen.14823.15079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021467c6-db93-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1709713493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713493, "uuid": "c38c566a-3c0b-4b8a-a9d6-ab38077c92c1", "comment": "Malware payload (SnakeKeylogger)", "value": "fa362050ade8f6690f2d1f0508085959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713493, "uuid": "9b64adaa-12c3-4f1b-81d4-acaa4706c0c1", "comment": "Malware payload (SnakeKeylogger)", "value": "acdd9a5fd5b1468e50ec891a62d22de6fb8bcb2732791831b9d9c8162dd7c46f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713493, "uuid": "8b394525-84ff-42e0-9686-8f0aee9f6a08", "comment": "Malware payload (SnakeKeylogger)", "value": "ee14664d9b73ff5c77cfeb4d6f304f40da2a6033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713493, "uuid": "33ea6dbb-71cc-41c1-99d1-deffc46b1980", "comment": "Malware payload (SnakeKeylogger)", "value": "cb34f1cd207fcfb95328cee702a03b6a8969c2ebd0dabd78d6be8aab6124e356195be849b56e7b8a81d8525844e7bc08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713493, "uuid": "fce79bdd-ec0f-4066-bb95-73f59f0f3260", "value": "T183A4BF983A6559F5C4670BFBC86A9A4C3A30A55621D0E87524CF0E4CFCD8B4389F91BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713493, "uuid": "8988f9ae-841c-4d82-906a-3ef9f71f5129", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713493, "uuid": "22ba5c61-c77e-47cf-942f-70663085c56d", "value": "12288:nCXkC4ls7DIZ9JaylhYYEw6aQsiWiESk4Mq:nqB4l0DIZ9JaylhWFlWiEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709713493, "uuid": "ea8a7048-0d3d-4371-818a-2f3bcb77b64b", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709713493, "uuid": "ae12a639-1646-4d54-9c87-32597df4ed21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713493, "uuid": "14634f71-76fe-4970-9b86-1fd606c930de", "value": "SecuriteInfo.com.Trojan.PackedNET.2725.27231.18654", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f720be4-dbb5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709728226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728226, "uuid": "ff87fecb-1c9f-4bbb-a68d-07f8c4b7b2c6", "comment": "Malware payload", "value": "0a3bd056464c8c9660490f47ed40c8b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728226, "uuid": "68a89a66-d20f-47af-93ca-d545903807ca", "comment": "Malware payload", "value": "aed025fedee4f60ef8fba1ed6071eed700987a64d71c081025727a18f02fb14b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728226, "uuid": "73c420e9-4b09-4d57-ae41-895cdfbd8deb", "comment": "Malware payload", "value": "e04fed59da1bf75546ba6d3bbca8cab2b6f5b4ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709728226, "uuid": "5481ad8c-59aa-48de-aa8e-ef20076ca4fa", "comment": "Malware payload", "value": "e2df1111c105bc665c89be4a9f78a03600eb1a06159998381df70f50d04f5604f0e82037e7cdaa6596edc4520af81fba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728226, "uuid": "ed783727-6bc2-41fe-9098-3370ac304f39", "value": "T13F863309F27A549ACD744EB2342A359D4C4EFDBA157489AC436AB813F6FFB04272B01D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728226, "uuid": "b4b70e83-0637-4209-9eb6-3c6e8fb450b9", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728226, "uuid": "f4d2d302-a9e3-49c1-a35e-f1acb93e0350", "value": "196608:3MLxHl+cFfB4DUTveeIKGp8LdMXpsEw9yCl6nw:3gFVFZ4YTvhwp8mXpsvyCMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709728226, "uuid": "6cdcb43f-0049-4f99-a48b-ede9d700c613", "value": 7880000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709728226, "uuid": "4907d22a-4514-4818-b3a4-1a77f814d609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709728226, "uuid": "f1924fcc-afbf-4cd4-8ea4-a761538e6891", "value": "SecuriteInfo.com.W32.ABRisk.IKPK-4969.12618.11433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3b0a2e-db77-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1709701785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709701785, "uuid": "e6eba74d-4059-4f30-8369-938b3cd162e2", "comment": "Malware payload (Smoke Loader)", "value": "e4a74d720855df39ed266ae55f3fb750", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709701785, "uuid": "5831fe28-4e54-4e3e-ac60-faa6d24fbe7b", "comment": "Malware payload (Smoke Loader)", "value": "b1f57f9e13e75717674eeca314a042ac3e0816f17e7743c361e0be7f45bf9897", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709701785, "uuid": "e86afc6f-6947-4b1f-b93d-91c3d90e0dc1", "comment": "Malware payload (Smoke Loader)", "value": "99842e71aa29b91fd58b6517f1b44a5dfbb1d962", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709701785, "uuid": "f5c21875-5452-4d71-a9c7-645c8b4d9464", "comment": "Malware payload (Smoke Loader)", "value": "918ed27a55a2d63fd6eed442ca4c619546bcb61269edb2389afe58e404ce568eb8e2433b83efccbc47c92f45c6ef33a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709701785, "uuid": "7cc040f1-1107-4627-bfdf-d961abb8dfa8", "value": "T1BB44CF3235E0C0F1D56759358CB9CAA06BFBB871A7A0824B67981B6F6E317D0532E347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709701785, "uuid": "312cd816-a1f2-4cbd-bf97-8418e7d200ca", "value": "09d0411b4f65505d70685766dbc9fb8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709701785, "uuid": "b6d2e747-f387-4fec-b01e-d6c60517a980", "value": "3072:Y0kTM967fnimVIqJ4ahug4aGGHZ19oO6ygh5JZ31:V2frVIqJ9huVOZ1Ap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709701785, "uuid": "ea2b67d6-4eb0-4c24-b0a1-23971c6cc53e", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709701785, "uuid": "16d10a3a-f0c4-4865-8124-5c1b53d91141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709701785, "uuid": "2581c1bd-cf8d-4eb6-9741-88ada7f73e79", "value": "e4a74d720855df39ed266ae55f3fb750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7796a42-db4f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1709684645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709684645, "uuid": "11d81f80-45a0-4975-8e07-8df31b13ba5f", "comment": "Malware payload (BlankGrabber)", "value": "72fcadf5196585dce72e2982da60fae6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709684645, "uuid": "d3a5c6d8-acbc-4682-80d8-e939db8d8c27", "comment": "Malware payload (BlankGrabber)", "value": "b3df220dc7edc143d630cd47300a4f5aa5c6d0ec4940209204084bf4880fa373", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709684645, "uuid": "fc9a3be7-8cff-4d59-b966-139a3afe6367", "comment": "Malware payload (BlankGrabber)", "value": "d4c6406f3de0eb0a98ef7d33440f7a920b6e9fca", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709684645, "uuid": "4a513f87-af1d-4372-a718-3253da8d7a88", "comment": "Malware payload (BlankGrabber)", "value": "883822539783341109c460f035ceb9f2702ca9dfe6ea77d4c8f99a78f21392811063ea86561a69436eae7067fb0ab9cd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709684645, "uuid": "c190e588-db00-452c-a50f-d1ff4fba43c4", "value": "T1DC66338EA60E16F3F9CF863BC8FA06661450B02E51C117D69EF8A6748F0BF978747644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709684645, "uuid": "73ee800b-2bb4-444e-99a9-281af2f9c105", "value": "196608:YFAzFI0lsRlaQVM4vtsV5iyihCKqEkQt:oAI0mFVMG4EhTqEtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709684645, "uuid": "680b7bc6-2d12-42f2-a8b8-4f7d8de9017b", "value": 6931456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709684645, "uuid": "ee1f0a71-1435-43d2-ab30-6f121fd029a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709684645, "uuid": "31c93fae-fe0e-4b5d-a07e-6f425a7c510e", "value": "72fcadf5196585dce72e2982da60fae6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65704ad-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718923, "uuid": "49341c86-dbb1-4d0c-851b-10324aa653f6", "comment": "Malware payload (Mirai)", "value": "341fafbb89e7ad8b9ad7f5a6c2b69eac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718923, "uuid": "eeac2bc3-33b0-4b59-9e56-067560b8f366", "comment": "Malware payload (Mirai)", "value": "bcbb54b9ba08a3f3260458d3de2cd21211aa5ee5f5fbfe55526b60ad29c0500d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718923, "uuid": "f3774698-efdd-43fc-a9a4-b2ccb35d2cfd", "comment": "Malware payload (Mirai)", "value": "ab43396e6f3cbf5b06310abcd4bfaa3106deeb42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718923, "uuid": "a1891556-5b99-4d5b-9df7-2b42ac3df26b", "comment": "Malware payload (Mirai)", "value": "1df301447c231d156fa6816a7a6b5c122e917d260e313d690b64a275e610aeca2c2adc54ff3d15953282a147e135412e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718923, "uuid": "98feb56f-29d6-451b-b34b-4a0698bcbd3f", "value": "T1F3D32A06B30C0A47D2632EF43A3F67D093EF9AC121E4F640356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718923, "uuid": "28611a41-2c40-405d-9e33-1de2173f7a43", "value": "1536:a0nwryWv6n/qZIRhSH98z+xpnvTnNoIRF9Ugg97PMXgvAtId0DD2h/qvI8kpd/z1:BWv6/hy8z+x57ndngpPMVtUpdbNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718923, "uuid": "620b4493-38d8-497d-91ff-b66b840d6b21", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718923, "uuid": "444efa34-065e-46af-85bf-ac8665620caa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718923, "uuid": "e5899083-5166-43f4-9b78-86b8f68a095f", "value": "341fafbb89e7ad8b9ad7f5a6c2b69eac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2100b1e-db71-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709699212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709699212, "uuid": "38a79193-f7c9-46ea-87ed-a24136552a48", "comment": "Malware payload (AgentTesla)", "value": "9efa7303abaff6254a75606d751fa123", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709699212, "uuid": "01a65ada-497a-4a9b-8c5c-8c622df8fe17", "comment": "Malware payload (AgentTesla)", "value": "bebb26a32c9db65ecd6e60f671873d09d5bc0e2321d3bac4651ec8c40c704058", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709699212, "uuid": "5adea3d5-df47-4ff6-b0b1-0757c70df8bb", "comment": "Malware payload (AgentTesla)", "value": "2c817150fd4731e54d69876babbd72ce2acea8b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709699212, "uuid": "c1035fef-9f67-424c-99bc-7215b9c0d002", "comment": "Malware payload (AgentTesla)", "value": "d38bdfca0097289368bf34e3034e52ef3ac55b19e5e6482927f3f0248d14491b10b42c9fc02d0c72aac487a0afe9782d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709699212, "uuid": "0516836e-5149-4b3a-a9be-f7f2549626ac", "value": "T113F402692AF91A1FDABE1AF9C025514187B4C2717582F3DD8EC022FF49923DE4B8351B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709699212, "uuid": "fe0d0de8-af5b-43a3-b4f2-0537317ebd4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709699212, "uuid": "6d113a41-35a8-4438-a02d-fe343f35776c", "value": "12288:Bc9/jvXf6CTgD8uxP0wxeqKzhiQE8KxBARDHR9WP63hIARbB:4/jfy+Y0cCiQXKxBUHzk6zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709699212, "uuid": "fb531032-a342-4c0c-ba3a-4c71f2097fd9", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709699212, "uuid": "a2c66430-20ed-41d9-9af7-8837aafb5c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709699212, "uuid": "4731fdbb-918a-4c97-a362-42ad927b4528", "value": "SecuriteInfo.com.Trojan.DownLoader45.1747.11099.17830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a74af7-dbd4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Quakbot)", "timestamp": 1709741556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709741556, "uuid": "ea577a0e-0600-4ceb-98f9-b116175787d8", "comment": "Malware payload (Quakbot)", "value": "75ea2aa8c2a3503ed39fd807de9fe0a3", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709741556, "uuid": "d4faf1df-369d-4ca0-950f-5ee5ff41cfc8", "comment": "Malware payload (Quakbot)", "value": "c2071407cf960fa166ac47d86f4a92b64873cd8c37a4ea416e80488c5f327c8f", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709741556, "uuid": "24830958-a9b3-461a-99d4-dbcf1f9fb02b", "comment": "Malware payload (Quakbot)", "value": "09554bdd6197cb848ce2bb69cd353c1d34bafc2c", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709741556, "uuid": "9448fc15-ca94-4329-b849-b6339b2c5a83", "comment": "Malware payload (Quakbot)", "value": "7c856f6723a74849afd2b42c581046d2e40edfdf664f17cfbfe003922726ad6d8f9e619320979019ee6abbea8af28559", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709741556, "uuid": "d457f8ec-25ee-4684-be84-b72ac7ac0fb5", "value": "T129F3E685AB83EDE3D929073489FE43153336FA80179247133A2C65352F67BD0AE97786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709741556, "uuid": "b7fea9e8-64ab-4392-ae46-ef00c8d729f4", "value": "1536:ebnS9bCgj6dJEkgOzOk3+oLGzFjO8n2dtkosu31M:9EDzPJL2mX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709741556, "uuid": "82eb1087-3f3e-4639-895a-6684518832c7", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709741556, "uuid": "dfdfa012-38e9-4130-9d76-6e1d007d9e61", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709741556, "uuid": "8113eb2a-01f6-4167-9ebf-a83c95824a2f", "value": "PERSPICIATISM.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477b0459-dbc0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709732937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732937, "uuid": "ed76257d-b9c8-4a5b-8f02-7106ad57e920", "comment": "Malware payload (AgentTesla)", "value": "8eb8223bb9aaee82947706824da95d3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732937, "uuid": "837b22f8-1836-4af8-9613-bd78bc84d54e", "comment": "Malware payload (AgentTesla)", "value": "c2d0cc385181b9e1685ce28e76d5bd1865843e67eb97796a6529bfaa34774816", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732937, "uuid": "63154b97-8a37-403e-bb5e-706a5ec58444", "comment": "Malware payload (AgentTesla)", "value": "6ad6dcad0d6955ab1cc310a1ec11dceecadef3a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732937, "uuid": "36058924-639a-4c50-957b-809a9742a722", "comment": "Malware payload (AgentTesla)", "value": "09375de6d16e0e1a5cedf74f863c56b912edb2ada5f5682cd563dc52fdd1136bd51a725ad68dcde6f9fc724b58515600", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732937, "uuid": "9133cd41-6961-4e7b-bf06-ba44af9ef3d6", "value": "T163F4024463E94758E9BB97B4917089110376FF2BBE61E30E4DC0B0DA2DB37814B25B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732937, "uuid": "fcce6fbd-e062-4db8-9afa-eee3f6adfa80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732937, "uuid": "8c739838-90d3-4465-a3e1-090b3d59f195", "value": "12288:66FO1lsajo9/j789tmEPGxIsXHjNuBT7fKaqL5qaxzgAyqoDvF5jAXmHzUKkR:nf/jEmEPGBXxgT7twVx/oDvnzUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709732937, "uuid": "5fc14745-0ab5-48a4-aabc-d21003784ce4", "value": 758792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709732937, "uuid": "8a6b6ee9-575d-452c-a858-c0f10b612713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732937, "uuid": "48ee70f8-56b0-4a15-9779-655d882204c7", "value": "ZiraatEkstre_202402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922cc5bb-db85-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709707722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707722, "uuid": "fb23a726-c59a-4d21-828c-8a1ef947bd75", "comment": "Malware payload (Mirai)", "value": "f115939c888ce7f90f9df2ee982dd28f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707722, "uuid": "9ff1e7a0-32ce-4139-a9f9-f2f675d13f35", "comment": "Malware payload (Mirai)", "value": "c3bc9c4c809a31d79bd5f0960c2a687dbddf56606b11c2004ef463229b59c7dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707722, "uuid": "bf7c8681-cbe0-46d9-a408-c8f22c839e03", "comment": "Malware payload (Mirai)", "value": "10d0a58ad66ab9e0584544814df2b4634352896a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709707722, "uuid": "8406aa05-a687-4e5a-bba1-2118305deb95", "comment": "Malware payload (Mirai)", "value": "a8bf70a2987dad528240446324f5eb121118e2c82dcb2f79796b933d5dba547911aabc2aa7eb8d878c20d65cdbff2081", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707722, "uuid": "6021a245-299b-444e-b198-2b5930b7f440", "value": "T1DDD31845F8919F23C6C212BBFB5E428D3B2617A8D2EE72039D255F64378A85B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707722, "uuid": "bd35a0ac-79dc-4850-ac1c-43eb4273974a", "value": "1536:nBKL6pK83WEFaB5ZM5lFsn5xaYXNFTA8xZ4VdPhnTgKwfeA4tlex+d8lAGwywNFB:nBCCU2WnzaY9FTX4TN0KwfeIIRuTDcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709707722, "uuid": "0829c064-2978-4742-b7f4-9080430bc371", "value": 139584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709707722, "uuid": "5f7616a6-4b5c-49e5-9890-ce2de2d4957c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709707722, "uuid": "589f4c5c-dcb6-4c8c-92f0-8556aad5d8da", "value": "f115939c888ce7f90f9df2ee982dd28f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb398d57-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718985, "uuid": "1c64c2b2-49b1-4b8e-934a-1aebd7be1065", "comment": "Malware payload (Mirai)", "value": "2ffcb5d1e0be4b636405123e167e04b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718985, "uuid": "3f19033c-d6d9-48aa-a29c-ddd8873fac05", "comment": "Malware payload (Mirai)", "value": "c4b2efeaeaf6adcae0e78140fdb88207e2bb475c191e1d500830ee6fc6ad1f5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718985, "uuid": "d3c6d02b-04c6-4e19-a17e-1036c241e84e", "comment": "Malware payload (Mirai)", "value": "6b1c44105f2e305dd545c6c600f1e673907aec2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718985, "uuid": "63c2f0cd-7878-4cf0-9a2d-e0b0d882fb91", "comment": "Malware payload (Mirai)", "value": "ab5d8d3f676dc6c64fc9e4993f9a89e34e5a168a4210cdf8dabe418f667c63781a72d78ca1e9e876662aeccbbbec0338", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718985, "uuid": "e2385517-631f-4a20-8141-9ff982ba7c65", "value": "T180B34A77C8296FA8C259D5B4B0B09F792B63A58182471FBE54B2C3B64083DCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718985, "uuid": "dfcb6423-8d76-4093-928f-593baf884095", "value": "1536:2aVTHW/qIAmPq9OHFGEWCRPKBKFnLblvCifzQVW9kXxeUwr/zW:2qWLS9OlDWMSBOlvC2sWqXxQrbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718985, "uuid": "345ae4db-ea9c-499e-b377-e990cef56ca3", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718985, "uuid": "2c8fdb71-9f14-434a-8544-4d6df726c39a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718985, "uuid": "2c940a0e-8285-47d8-9444-00d7b34dbda0", "value": "2ffcb5d1e0be4b636405123e167e04b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12adb3db-db61-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709692046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709692046, "uuid": "9b818dc5-eab8-4e08-a370-7a20dafd1344", "comment": "Malware payload", "value": "cd760bd52b9fad43eb153f2e4ad8ed05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709692046, "uuid": "56f2cecc-b9c9-4987-aa40-5c0ce625adf9", "comment": "Malware payload", "value": "c4dfbb8347ada9f44f967a3e33c420bd43c2dc184894fd08997792b5dc9d5027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709692046, "uuid": "1c1ebc70-6b18-4089-a77c-32a4e44bb062", "comment": "Malware payload", "value": "39e8b437f70636caa161de8d499278f008ca6ee0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709692046, "uuid": "a958c1dc-48d4-4c15-a363-40a10313b929", "comment": "Malware payload", "value": "2cdfc4fe04baa083cd6fd2d349ea4b9d701b06fd1ac898087cea940fe74a66538136d2f999963e6f7133590d9622d7de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709692046, "uuid": "37f23c57-7da8-483b-8e76-8510767d663c", "value": "T11477333FA269663FD4AA173209B39350987FA725B41F8C4E17F0080DDF679610E3B65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709692046, "uuid": "93a9fa66-1f35-4a09-9da8-2705b3a95e40", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709692046, "uuid": "0956292b-b297-4a30-84ac-e0e7a43c5437", "value": "786432:EsdKOzRHl3/TxVFNSqqczwtBNjTl8W6b1:lNFH5/PFp0zNn/6b1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709692046, "uuid": "63fc2388-f5a9-4463-8703-4163b659bf9a", "value": 33899042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709692046, "uuid": "9a276c8c-8765-4f11-ac7a-04fe80531413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709692046, "uuid": "332e9113-0455-46c3-9b14-c472d4611af6", "value": "SecuriteInfo.com.PUA.Tool.Nssm.6.23133.21743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21e70d8-dbc2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709733948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733948, "uuid": "0b0c42fa-6f99-42c3-8c9d-4bed7ede29bd", "comment": "Malware payload", "value": "1bbaa6a331817a368f267e084d1c09be", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733948, "uuid": "7b910c04-b6a0-4592-b16d-a01ab33b8b83", "comment": "Malware payload", "value": "c55753639af9025da5a4ad8440dbb81857565f1f3ebab241f34f07564ffe6b15", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733948, "uuid": "54b9633c-0afb-4ad5-920c-e4d36b063f37", "comment": "Malware payload", "value": "f75bcaa2c9a1f10ea613a3a7e5fb0069540dd836", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733948, "uuid": "18ba4352-17fa-4b11-b47f-11b0ae4d2e50", "comment": "Malware payload", "value": "41eb65c1653440468096f3d8019644fdef24d40789d3c82cd22618a0e2ee8a2b5fa04dca360acdb3e9a01d35eae9a32a", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733948, "uuid": "bda439d4-758f-49e3-a971-10cbdb5bf92d", "value": "T1AC45F0229B840457F269533606E56311F3F0FD1A33F3878B7A2C53296F9AAE51EB4498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733948, "uuid": "75e6f2e3-98ba-4103-98c3-f20f71139498", "value": "48:50B471Y4btfULpJleSvzoDXXePKpVZrBeTDuSH/qWgGMEckWt:50Bi1LtfUtJleSvE/QTiSmGME4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709733948, "uuid": "193c07d7-d1fe-48a7-81e5-edaaab929fb3", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709733948, "uuid": "b1fb3087-1ee0-45eb-ac02-ea6d83c2a955", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733948, "uuid": "d05d5cc2-3a48-4b59-baab-b4a95f4045f1", "value": "doc20240603070611_100.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83a2533-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718980, "uuid": "446823b9-a5e3-4394-ac25-08486a46383e", "comment": "Malware payload (Mirai)", "value": "11473b0cb210bca911229dead29bf4c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718980, "uuid": "71a8f077-767f-491b-a2bc-c5a423d0aa68", "comment": "Malware payload (Mirai)", "value": "c58cfa2e3215d17a6c4c6fe6d2ecd24528fbdb1b55a0c2a78e08bdda18b00fdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718980, "uuid": "3bfaa6f4-faad-41aa-b7e5-521a58fdbad6", "comment": "Malware payload (Mirai)", "value": "15644453785fd368f35972a8bcf84e40eb264a51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718980, "uuid": "7f00ad09-a502-4f82-ba95-0fe400b81dc7", "comment": "Malware payload (Mirai)", "value": "7cacef04fabefd37704d00fd9426309486c4e7878af8556c6e8b202ef6dc434582d1b4dc6970c9dd4417211694414e61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718980, "uuid": "a16ecacb-a43f-4740-b9e4-4aa8f150a555", "value": "T1FE04D81AAB510FBBDCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718980, "uuid": "e00ac750-b4cf-45a4-ae25-ee63233e6405", "value": "3072:+eEksFcOnrMilq07AXIMf4qAdoStcJ0G9Eh3Kqbtwy:+eEn+Onr1lz8XIMf4qA6SKJRChp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718980, "uuid": "2ce2f0a5-23de-4cba-ae4d-7261d131cb1d", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718980, "uuid": "ca47ccde-4405-4da3-83f4-7d31f8955834", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718980, "uuid": "d66749d5-ded2-46f6-aefc-1f98f4e6b7c0", "value": "11473b0cb210bca911229dead29bf4c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d533a0-dbbd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709731857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709731857, "uuid": "cf7d9d6d-6e2d-4f66-9b97-5734a22af4bd", "comment": "Malware payload", "value": "12fd033987cb7cac08566e90a72ecaed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709731857, "uuid": "ae409a4f-4db2-4eda-88f3-14b3e02b9fc8", "comment": "Malware payload", "value": "c5a8d44b28390e58d60592eba34ce9d59e3756d31545e9e45617cb806779c1f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709731857, "uuid": "68e8322f-65ab-4098-9ba9-fd1a46710364", "comment": "Malware payload", "value": "a4c6f1b43cc316776cacd2444d2a1c9425b83797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709731857, "uuid": "baa9a0b9-4498-434f-8b67-0e0badbb6bba", "comment": "Malware payload", "value": "736516e22c63be1b44a8aa1e3479b30b55d8c65c015724f517093c1fc7e6e534438e11d865ab0ce073f1e27a4f020a9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709731857, "uuid": "f058228d-bc21-4339-9ab3-bc8ef1569f22", "value": "T19BC55A16B288713ED4FB0B37893386505937BA61BA73CD5B5BF03A0C8F355902E3A656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709731857, "uuid": "cf0d428f-2cb4-4997-8f7c-8abed63fe99d", "value": "16c8c7a62c852018ed02e453e144c998", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709731857, "uuid": "09938048-a0bd-45a3-98ea-7e3eab55bd5e", "value": "49152:PR/KpmZubPf2S8W2ILeWl+C1p9jWy5Snd0eigXN4:Z/jtYLP1Sy5E0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709731857, "uuid": "58c0304a-34bc-4bfb-a981-c7b138987b5a", "value": 2691072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709731857, "uuid": "c4932f05-1ca4-46bb-ab1b-30bc6af9de26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709731857, "uuid": "b92e31f6-71ec-40a6-acd5-be51e93ac7d2", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agentb.mv.28184.24660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c16311a-dbc2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709733857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733857, "uuid": "74ce3461-8fd5-41f8-8aa8-55b40e8b4898", "comment": "Malware payload (AgentTesla)", "value": "cd17538cac8c968cbed3f362f4b6fb29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733857, "uuid": "aff87ef3-40a5-4dd9-9e9f-127ce251da7f", "comment": "Malware payload (AgentTesla)", "value": "c86d70c38ed45d01bda3c502f7d77601369e469e4088b092f0a7bd3a844619e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733857, "uuid": "c7d86305-d93e-4bc5-92c3-89d0eb02b5ea", "comment": "Malware payload (AgentTesla)", "value": "3a3a2adfa80407d495fceab888bb5746493422fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733857, "uuid": "dfef6370-229c-4553-a3b2-16dcd0bf06c2", "comment": "Malware payload (AgentTesla)", "value": "692cf879bd594024fda36191443b8927c7ab5298ceaeee893534e666d5907b8d75ee89d3cab4f77ddf9a3f82613783be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733857, "uuid": "94f3e202-7f39-42cf-ac3a-e96f31794cb2", "value": "T121C4D0D82A6499B6C4630BF7D866990C3B31A56121D0E87520CF0E5DFCD8B8385F967F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733857, "uuid": "e4019170-f201-455e-b693-7e87a9bd1675", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733857, "uuid": "27773bd1-bff4-4a31-95c7-5797a7712a3f", "value": "12288:gCXYC5aNoZmJxexfm6pUClbbob7fxV2G4S:gqMxx0fpblPoqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709733857, "uuid": "c58b9ad8-de08-404f-9278-5b21d793991e", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709733857, "uuid": "5dab2384-1abc-4408-8a8d-d03ec339183a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733857, "uuid": "4ce607a5-46eb-487d-894e-b7482dcec145", "value": "ionzx.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123d66fb-dbc3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709734136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734136, "uuid": "7ef0a155-8258-474a-b6b3-f583dd813b85", "comment": "Malware payload", "value": "83cd397476e0db446e82d6556fbe87be", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734136, "uuid": "7aceeb90-5410-4f2d-b6c1-8345d810b1a5", "comment": "Malware payload", "value": "c88381d0f008192a629adb16156db047290d3a144e6f260287dae32b7cd325e3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734136, "uuid": "aee01909-4657-46e4-a26e-469276b95d01", "comment": "Malware payload", "value": "5c5a043c83f66b2f05d45d841c89c7d3c20b8867", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734136, "uuid": "a82d2caa-0ddf-4901-bde1-a0a67c6a9d93", "comment": "Malware payload", "value": "26f93d86dc7696878bf33654914d27e569e496262d88a933f65238f5e7b1339b029f968a938b98b4007b78d184037daf", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734136, "uuid": "2c929138-b28e-4044-a9d8-c813ad7f1c37", "value": "T15411E121E4CD900321AFE16324C78704F3F58F5A03D3EBCE9E20D964F49AE7959B8090", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734136, "uuid": "4d232459-70ec-4332-b557-4584d0ccc197", "value": "24:wNV8BiPH9upEeQuSjjXvq6qrCgIfMgvZckW+:rBeTDuSH/qWgGMEckW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734136, "uuid": "b4092bf2-4325-4390-8fc4-0a02f4afff58", "value": 976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734136, "uuid": "b4e143b5-a338-4bde-a9dc-5d6af262b93d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734136, "uuid": "0c4a6876-095b-4b51-916e-782cda09d2d3", "value": "doc20240603070611.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7e8f05-dba2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709719980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709719980, "uuid": "125a2944-4fdd-498f-9fab-b444d8df8a8a", "comment": "Malware payload (Formbook)", "value": "073832f4ca6f42af0d8a758c23a35838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709719980, "uuid": "7ccbbd36-bb8a-477f-bcc2-4ccd10218b1a", "comment": "Malware payload (Formbook)", "value": "c962220f649ced285cce63d4fc3e9fddd5e7aca54526d4099533a558cdb6ae93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709719980, "uuid": "e6c59117-2e6b-49f2-9983-327e6438f0a3", "comment": "Malware payload (Formbook)", "value": "2378bfb9522dc93651cd5480355996b06498c78e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709719980, "uuid": "ea008596-8e0d-4537-a4cf-33c691bc28e4", "comment": "Malware payload (Formbook)", "value": "8c861ead93346b992433b81967a0d2767549ef0a21fb38160267f413c79705d361413700be9f4689fd89d7e9a7ca7510", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709719980, "uuid": "d8f37c68-5b69-4337-99c5-c3794d44ca9b", "value": "T1AC034B26AA6C4237C9BF5274C9E211D27A31E34337D2EE6B049651068D43BC27AB1D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709719980, "uuid": "4a033339-735c-4096-84bf-8520e7a6b507", "value": "768:rItf0QdRVIvD7N5KZ55PegyAOjXLiqtwQLE3++bYjLoXd2IEFiRy:rItf0QJovNWGvAOaeF6woAIeiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709719980, "uuid": "a8899da3-c3d1-4bef-bf78-129ab8cb0593", "value": 40672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709719980, "uuid": "fa37e239-e780-4860-af52-8c390c0477da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709719980, "uuid": "945f6a78-4699-4ee5-a311-e55bc29da04d", "value": "reimainternatio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a45aa75-dbc0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709733022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733022, "uuid": "fc7a1bf7-652d-421b-85ed-3f08f085cf24", "comment": "Malware payload (AgentTesla)", "value": "8700cc5884c50cc4beb338d302b19d38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733022, "uuid": "60ea2240-8540-4a3d-8f12-2761dc5b0ec5", "comment": "Malware payload (AgentTesla)", "value": "c9c09d6c428e195827e779c5cb58b5fd32fd42ff581b34c2a66b325e4d04d674", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733022, "uuid": "7cef41ab-2d52-4e3d-985c-9ebde22131f5", "comment": "Malware payload (AgentTesla)", "value": "e86280a55b25942737dcb66a400251a1abfabe7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733022, "uuid": "16899342-7baa-4b5a-b236-aaf2d26067e2", "comment": "Malware payload (AgentTesla)", "value": "e299a4b9adab0138ad4e731f240c68f6959395bbd774501c16eed148ffbe0d66f48be733337c336dad3081f9d6cfd618", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733022, "uuid": "3e48f80c-5d48-4c15-bcea-d088b1951e41", "value": "T1FAF4CF5D23114862CB6AA735D973D31A1A16DEBB8583920753C6923E322B7FF2FE1701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733022, "uuid": "d32b30bb-449a-485f-871f-c01adfda942c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733022, "uuid": "085efda5-4a86-46e0-8af1-5438893843e5", "value": "12288:ZrcUg+DA28oxaWyF95HY66HuUSzjApbhtWNvKecIN8dh+yiRBiwR2n+R:ZrcU7Afoxy/5Tfv4IN8dnwG+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709733022, "uuid": "7b32ef71-b4da-4273-bec5-8028f8dbd762", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709733022, "uuid": "8acaa3b4-46fa-4501-a589-2d9804abdf2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733022, "uuid": "a22fd542-7105-4ce2-8d1b-041698895cbe", "value": "Ammsjehiorr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b922fc5f-db9b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709717236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717236, "uuid": "4287f1e2-2bc3-4754-add5-322e38ba4724", "comment": "Malware payload (Formbook)", "value": "95ba23aebb996309b34a377794fa825d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717236, "uuid": "8f296479-299a-4313-8450-99d59c4f08d8", "comment": "Malware payload (Formbook)", "value": "ca89378a6eaf68fe66b2277c6541f913de0937987228a8686a3d876e7f9fa637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717236, "uuid": "870ca88d-7144-40ab-95aa-2e9e765aff83", "comment": "Malware payload (Formbook)", "value": "038f46f80340296e856a7182242248e6825358f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717236, "uuid": "03881980-33f8-4d88-943e-c2c162253d0f", "comment": "Malware payload (Formbook)", "value": "bc4cd9df41ff7d5288a0406da620120efcbc24a01f937be8fd47223f375ad3a09802c7517b9470d6995e2f9b98bd22ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717236, "uuid": "9761b981-73f1-41c8-b3a4-34a5f2cc0bd0", "value": "T120F40101B2FD5F2AE5B98BF6146401550BF670ABBAE5E30C4EC564CA3D71F014BA6B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717236, "uuid": "1eb97ed7-9b73-44fd-a054-bdd568b6151b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717236, "uuid": "01ad2909-406d-43cd-ac03-c874cf114d8c", "value": "12288:EBtYw/jhtQJEiJP59BdRpxBmCuKXLAjN1S0Yv9Y+iC2U95c5bOsWKlmL2tyB:Bw/jhSKiX9RpxBJiN1q1f3WzWKlJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709717236, "uuid": "9b6817a8-d734-47fe-a618-6789216a021e", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709717236, "uuid": "24b00d45-ee29-4753-ba99-f58f9c133353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717236, "uuid": "1fbb52ea-e600-40ff-aee3-1766c25de3aa", "value": "SecuriteInfo.com.Win32.PWSX-gen.28382.13404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc54990-dbe7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709749643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749643, "uuid": "fd2eb47b-375f-4cbf-96c9-93741226c8f3", "comment": "Malware payload", "value": "ee27646b11ea5a3a6423ff98775831e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749643, "uuid": "62b932de-de82-47dd-8a5c-7ee605c46d64", "comment": "Malware payload", "value": "cc209c28e4d78068b131d1c4c278be88cbdf7d5cf1c5363ebfea28e523112111", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749643, "uuid": "71874ba1-5e76-41ff-892f-241e74bfdd35", "comment": "Malware payload", "value": "ae272f6dc8e2ddd2350db152c65e1cd747cad780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749643, "uuid": "0ed70c6c-750d-444d-9b1d-4a0bb20877cd", "comment": "Malware payload", "value": "4961f7d59de12f67e9fc262b9d3fd55794ef0158bd74c7dd64ea552b6df5f908197d8d587a167b9c405150c8f0991be7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749643, "uuid": "57b55d52-b5f8-487d-b209-eeac3c5df069", "value": "T13D229514FFD4433CD5AB0A3A69565A324639FF579837DB4E68C5238EAC227000973BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749643, "uuid": "d59cb7c8-74b7-4c38-b771-cc41810bcd5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749643, "uuid": "27415d47-968e-4119-a0f2-0c193d03cb9e", "value": "192:c2+tUAUg0/4pIKjOt2wUehEr964QmbRu47iH:c2oM4pIKjO79hS64Qci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709749643, "uuid": "cf1b12d6-4d6b-4fed-a679-c7ff5a04d24d", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709749643, "uuid": "6cc9c9a2-0844-48a0-b3c1-0e2edaaf3802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749643, "uuid": "139d52f2-0ce5-4f02-a472-fb4b9a7fddce", "value": "SecuriteInfo.com.Win32.DropperX-gen.22837.6834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc876a6-dbab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1709723824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709723824, "uuid": "817b54df-4d52-47cc-8d05-f459d1da0f69", "comment": "Malware payload (CoinMiner)", "value": "6b08812a6837ef81f21ddd7dc04aadcb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709723824, "uuid": "6abf2da2-86e4-4e42-b69a-f5f71c7de39c", "comment": "Malware payload (CoinMiner)", "value": "cc28d7f2d6934af40e9f5ca9acc40179cd2688271ec778556aabfd2638a943e6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709723824, "uuid": "29a7e5e2-0b0f-4d4d-b4e6-6e723de3d4d7", "comment": "Malware payload (CoinMiner)", "value": "ef9acb2bd522fd21e7ee1bdfd1c6ac6522ee5952", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709723824, "uuid": "f200f908-2bf5-44c1-99c6-3357a401eecf", "comment": "Malware payload (CoinMiner)", "value": "633444b9b7febd65782f865dffb2ebd19539d09d5284d54e05caa9b6cefb06c2796832c52428af1a4b5a1ee5bede1cb5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709723824, "uuid": "a2fdce7b-0e4c-465c-978c-1ca38f6f160b", "value": "T1CDF3BF1076E1D0B2E6A3293049B4C3B11F3FB9B29E7586C73786623E1E722D14A75367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709723824, "uuid": "f6c9ccde-78cb-421d-a67d-da813af064c1", "value": "efddc832809352fa5626b950f8ce5fce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709723824, "uuid": "76de8414-7bf6-4eee-a691-789797e9c782", "value": "3072:6iZpyDaHgA6pqu3oHS8rys0iCXlRTmmXR8su4:6qpyMMpWyKpURf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709723824, "uuid": "8cb57fa8-d575-441a-990c-433c585553e3", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709723824, "uuid": "1c1e800f-2eba-4e73-9243-74adf4bfbd72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709723824, "uuid": "6ece095e-558b-4254-9272-ee201b443c68", "value": "6b08812a6837ef81f21ddd7dc04aadcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c983a16-dbbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709732221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732221, "uuid": "b392e658-4c8d-43a4-91e8-4bd2e9d46712", "comment": "Malware payload", "value": "9c87113fd09d6f77d5b0922e59f8db79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732221, "uuid": "b6552b15-4dd8-4010-a31c-ee20a2172f65", "comment": "Malware payload", "value": "cdbf7b4c4ff081fc453f084ad7487c75adcc35a0052f5c197dbadbe22f055cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732221, "uuid": "f96729a9-465a-4d51-90ea-f4934fccc1aa", "comment": "Malware payload", "value": "43b2803ecb7a5d7b68b00e64396a711dab0ac583", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732221, "uuid": "ff1ac4bc-b000-4c38-9844-c93bd17c0d0c", "comment": "Malware payload", "value": "16eb7a8ad828ffaf91699c7d1aefc3f05ddfaebef17b61430cef46d8ef3163ab8db65e271ad8455cb9831f4665107e6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732221, "uuid": "5fbacbed-316a-4a43-ae74-83c76fa0d76c", "value": "T1DFE54A17F788723ED06B5A32473386D89837B66169128C17A7FC384C8F356942A3E776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732221, "uuid": "44d2e6b7-68ea-4d87-9bb9-53f0ad0d6c49", "value": "9825b4c9a35eb9a5c5e347cb9ca988ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732221, "uuid": "fe3ad3da-0092-49fd-afb7-bf8693a5e049", "value": "49152:OEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVjHX3338w:O92bz2Eb6pd7B6bAGx7F33333", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709732221, "uuid": "d491812b-51dc-42a8-b211-042a34922afc", "value": 3187768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709732221, "uuid": "d71429ea-7168-4727-8d3d-64b90ad25571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732221, "uuid": "fbb3c646-1f21-4388-82b9-990a154c57c3", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agentb.mw.5923.20471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e11abb3-db80-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709705407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709705407, "uuid": "657bd189-a717-4b29-ae02-23801063c30f", "comment": "Malware payload (RiseProStealer)", "value": "bc1d715110d34c705944635aa9d31ea7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709705407, "uuid": "c04bb83f-beea-49e9-8d96-88ea9cdd13ca", "comment": "Malware payload (RiseProStealer)", "value": "ce46c89555525a74ecc82cd2291e6f93427558887c18923eaca699be08a090de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709705407, "uuid": "64c677e9-597d-4c1d-b5cb-793ff86f8c69", "comment": "Malware payload (RiseProStealer)", "value": "61fe5b0107489bd36600dae217c3ef6863bfde23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709705407, "uuid": "a610ba64-f31d-4019-80e6-357515fe28f5", "comment": "Malware payload (RiseProStealer)", "value": "6a5151b193aefdc647511ffc28b74137ffe71050ef443cf0ed2fa961d9f4441b30bc783ad3913c099ac0572e3e8b5f0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709705407, "uuid": "c5053b67-269c-4008-acec-61b5cb756e66", "value": "T16EF3AD1072E1C876E2A656314AB486F1EB3E7D725AB481BB334D3A7E2F712C10935727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709705407, "uuid": "f655efa3-1770-4816-9476-39323d416a7f", "value": "c6d19c8fbbcd0c83570e7dbd10119e65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709705407, "uuid": "b69ef446-ff63-4ba3-af39-4da576ce646a", "value": "3072:QiZUCzGvz/JqhqOeM3JohWsGZ1bRCXfS:Q6UCy/JdgpDZd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709705407, "uuid": "c5de842c-7f0e-4b17-be50-2c1ddbdc1244", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709705407, "uuid": "923caff2-6200-4223-8dfc-0baf40f305d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709705407, "uuid": "a5d66446-0838-4bfc-8686-0e59df0ddc56", "value": "bc1d715110d34c705944635aa9d31ea7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69dc1b1-dbde-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709746116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709746116, "uuid": "fdb8cf45-9e3d-40e4-8191-1afb40115768", "comment": "Malware payload", "value": "470797a25a6b21d0a46f82968fd6a184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709746116, "uuid": "ef87c56a-e4f2-4ecc-b9c6-99aaf3387812", "comment": "Malware payload", "value": "ce80b839411b1541d09b0ede82f1477b516da0c60760079f46ba4443e1a6f419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709746116, "uuid": "5ead8fd8-8063-48a9-adda-322ee46f957f", "comment": "Malware payload", "value": "dac7867ee642a65262e153147552befb0b45b036", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709746116, "uuid": "64e15aea-3c25-4989-ac39-1487c2f27235", "comment": "Malware payload", "value": "e62fe44214506a2baa923ca657b49049fc313352181b0769dd969ddcff2f8bfa68a6ffe076cef86ee3d872f6050c571f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709746116, "uuid": "ec281419-633f-4b5b-83f4-db6105d8554d", "value": "T13D132A37F22548FED017C678AAE25871A4F4BC610A71A07D739589773F39E785BB8240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709746116, "uuid": "d1eebfbe-a3c8-4c98-a5a5-584b9991e798", "value": "cdc279a12c6a556c25ba7b0510c2b96e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709746116, "uuid": "5a0c5d2c-3d80-4803-881f-c8e40c2a7ef2", "value": "768:3m6nuSdGE6vpOG7/RaPWViEK44gn15BSF4sKbABRSzmG0bCqVDBtOckKYIo/V:9ucX6vpOcGIiJg1XyhnSzm3BVhklIot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709746116, "uuid": "af70cf1f-0eee-4a92-a9f9-3dd9f5653fd3", "value": 43696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709746116, "uuid": "01e9849d-d747-4ce7-a137-20d30432cca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709746116, "uuid": "c444bf6d-4fe6-42d8-b260-c9e8b531ad57", "value": "SecuriteInfo.com.Application.NetTool.D.12304.24286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ab1aaa-dbe7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709749973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749973, "uuid": "b75595c8-eb7b-451e-aead-732e7fdd7306", "comment": "Malware payload", "value": "cce95c40eb1fbf2d8f3b3bb88dca4da9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749973, "uuid": "51090a1f-34f0-47ce-bc13-fbbfb75da749", "comment": "Malware payload", "value": "cebc21fabf271b3af797a6e828d0c61c1a58a129c22c87996c6be3af44bc8f49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749973, "uuid": "c566d9c0-8e49-40f6-92f6-718be65dab09", "comment": "Malware payload", "value": "3ef76753817da4e72dac8dec1a880a7963ae529c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749973, "uuid": "989993e5-7622-48a2-9825-8850d92584d7", "comment": "Malware payload", "value": "854ab3892646955597e0e5d3fcc77ffeaab05d5bc48d626f396af26796cb31709c56c9a08024c6447507fd6bc9557fa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749973, "uuid": "619e9946-a06f-4248-ad76-c6e03bdd0d3d", "value": "T1DBE3C0066EE655B3E98252B91F469F14DE244ECD326B5F7662073E90D434CE3FCA0AC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749973, "uuid": "f39af6eb-30a6-40b9-afd5-33afc0294e25", "value": "ba072a972fe6c47c8cf7a0347bb0af7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749973, "uuid": "838d2f9c-ff2b-4e68-add0-689d3eb39959", "value": "768:p+/unhi1zOzZ+/unhi1zOzslpY4YQGp0AteHEejGqn07Gpww/Z7Z4Htt0nGy+GtT:pti5OzZti5OzJti5Ozati5Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709749973, "uuid": "f05e93e7-6c59-4d39-bd14-db1c2d7ce946", "value": 144646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709749973, "uuid": "3d87a791-f8e9-4419-87a4-a84f181a913f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749973, "uuid": "fff83f3c-5d17-4e6a-9e72-104bb49ecb8e", "value": "MidjourneyInstaller", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9b9129-db9b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709717242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717242, "uuid": "03ca7ff7-82fe-4405-9946-8089d77e8951", "comment": "Malware payload", "value": "26bc45b7edadc11281b6acb58d1e1d03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717242, "uuid": "9751be9e-898e-4225-bbab-baf70d28e412", "comment": "Malware payload", "value": "d10f367e9f06ade8a710e20b00d1b4eecb456e1923369725a276eee871841417", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717242, "uuid": "5ff6a1fb-8f73-4e2d-af18-34ad9121e174", "comment": "Malware payload", "value": "f184f4c70928bdc55ab3d5faf42c359d6232d9ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717242, "uuid": "6452896a-53c5-4f8b-81ff-8818487ae539", "comment": "Malware payload", "value": "c0db18b531b4b351f6dd383ba51b7ad76eb9f15b3f0e5be8b67738ad3fd73333aa9eb8a2d9cbfeb6ff26edf709e30b5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717242, "uuid": "c86133d1-70c8-489f-bdb8-ebaa32b1db24", "value": "T194573360B784D06BE9760AB1787C9B2A10387E750B3594CBA3CC0E2D29B59D26F35F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717242, "uuid": "cb001191-d6f9-4b42-b0f9-22e5d23829ab", "value": "fe90288146088001e05eea562e0510f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717242, "uuid": "550aa3a2-b5a6-4c35-ab8a-a010c037c528", "value": "786432:UcOn706SJyrfjJTKFFRB9pkUJEGh85X0/3OBB4aZRSf2B:UN0Jyr2FRB/JEj0WB4nf2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709717242, "uuid": "68b08fa8-9c27-428f-968c-fba4481d13b4", "value": 27140272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709717242, "uuid": "5b7f05be-f8b2-492d-91f7-7e887036de44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717242, "uuid": "d9aea89c-7417-4d6f-99f0-f70b383cae68", "value": "SecuriteInfo.com.BScope.Trojan.Penguish.27127.17245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a697b2e-dbf3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1709754980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754980, "uuid": "1b70c0ac-3506-484c-a535-a52e8757862b", "comment": "Malware payload (Metasploit)", "value": "707a231033726bbdad945111af97510a", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754980, "uuid": "6d02428a-9a49-4bb8-a6ae-f9d7c4d4fb09", "comment": "Malware payload (Metasploit)", "value": "d1df44a5213dda2704c92779cbea83964d5aa8686e03884cd722201ea3ce33cb", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754980, "uuid": "c57a5e68-881e-4a34-9419-1af734f450b6", "comment": "Malware payload (Metasploit)", "value": "722ce669abcb2281225f008d410b0b2793258edb", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754980, "uuid": "4bac4a9b-b275-4091-84ae-1accfb02efab", "comment": "Malware payload (Metasploit)", "value": "ca06dad22ba312875d25ba6801ccdb536b97d88d4eb27f47a6510cb62e91848879b1e47471317ef405e2ef6351ebedfc", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754980, "uuid": "f78dfefb-2439-46f8-9c79-5cc2ee173951", "value": "T14C61BF932191B8EA415283BF3E5D66FA807FC224914A6044FB8C4F9DF9DDE63398D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754980, "uuid": "6774342d-3452-4eca-9078-5a2357bd8447", "value": "96:GGt+6fyFafuSnW1jgCfBZL0HOmAiBrVMs9vpKvM:5pfyFpxKHOmAiBrVR9vpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709754980, "uuid": "f60d40d6-a67f-497b-b522-70ea197d2cd7", "value": 3219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709754980, "uuid": "363f2ec2-10b4-4442-bff3-c8d250cc5953", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754980, "uuid": "1d4e4de1-3d07-4f28-859e-66196c3c61af", "value": "j6MF8D5v.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e465ebf2-dbde-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1709746085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709746085, "uuid": "edef272e-688b-4826-88a0-e88ee996881f", "comment": "Malware payload (SnakeKeylogger)", "value": "1f7ac06f56077381b5097cde5c4cab87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709746085, "uuid": "b1473c85-f80c-4f6f-a2c5-9c93b5f7c6c5", "comment": "Malware payload (SnakeKeylogger)", "value": "d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709746085, "uuid": "37f34002-1974-41dc-819f-7b2033266a00", "comment": "Malware payload (SnakeKeylogger)", "value": "5738220c5460de988a1b30a3a9532fd226d9d3b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709746085, "uuid": "d7fa79b6-e34c-4f1c-bc7c-7e21af94d85f", "comment": "Malware payload (SnakeKeylogger)", "value": "332bef6fe321a3b8fdac96b95bfef1f99b0f7497127be100be225f1cd79176d53d81f90450a429790ee3ecd19a6d7ac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709746085, "uuid": "7556c77c-00b8-4ac1-9b50-2cd7aebaec6f", "value": "T108A4BFD82A649EB6C4634AF7DC66990C3A30A96561D0E87424CF0E4CFCD8B8345F967F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709746085, "uuid": "f5d6bc0f-2960-4ccb-b158-72dafe6ce95f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709746085, "uuid": "0616930b-decd-425a-a6f5-86ac8ce18aa7", "value": "12288:vCXFQTAajA6n1tiGSZ4EidlIw8mfcMAAAAAAAAAAMA5AAAAAAAAAAAAAAAAAAAAP:vqFQTAajA4fo4EiIw8ccMAAAAAAAAAAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709746085, "uuid": "a2f2e782-5bfd-406f-9f0f-fe5577fc772c", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709746085, "uuid": "de94a635-f4e6-412b-9b0d-f39b41d8a018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709746085, "uuid": "2b669285-f55f-4d39-802f-a35f2255909e", "value": "SecuriteInfo.com.Trojan.PackedNET.2725.8730.30889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7429c539-db8b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709710249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709710249, "uuid": "0741fc9d-b7bf-4f93-8411-d40ef7da0e94", "comment": "Malware payload (RiseProStealer)", "value": "52af8f312d4667b7de3bc02aee96e033", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709710249, "uuid": "606773da-4e75-40da-9b5b-8ab2f9a5b6f3", "comment": "Malware payload (RiseProStealer)", "value": "d3dc74a3bca3cc38943b90bd7b33dffd683d0bcf20bd507404185e595909d11f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709710249, "uuid": "a75dab41-d417-4091-b8ec-3837bc0fe646", "comment": "Malware payload (RiseProStealer)", "value": "2e54c340a223baf95b975d03c93c18c00f71a7b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709710249, "uuid": "036bb831-e275-461e-bae5-22b88968add3", "comment": "Malware payload (RiseProStealer)", "value": "da96e2520324200a7dac9a97de307e4cc696e29c1746cc4455df7ea8fb88c7f192523f07cc3c976cacc4383bfca49945", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709710249, "uuid": "c4adb13f-21f3-4cdb-a192-7fc93cafa740", "value": "T148F3AEF032F0C076E067257459B882B25E3BB8736AB4819BF69A1F7E1E7D1C04965723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709710249, "uuid": "5e903174-7f5f-47e0-b63c-eecbf754cd9f", "value": "c6d19c8fbbcd0c83570e7dbd10119e65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709710249, "uuid": "6271520b-d0c5-477c-af94-25654c774861", "value": "1536:7Yc5gZdDecFo+b3K//ErpPgyB1ahVfhdF8JpfbiQlpkgPF2vW8CPBRYCIVvlqgWi:TiZUCzr/aBdF8J5+Ql9QvoP4CIOse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709710249, "uuid": "9155e8dc-ad6d-4455-844c-28f27ac4174a", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709710249, "uuid": "44153426-79ec-4b21-8dff-f851d5820520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709710249, "uuid": "ac6c4ba7-d6fa-4d0f-af6c-72eefa11a5dc", "value": "52af8f312d4667b7de3bc02aee96e033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f12619-dbef-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709753230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753230, "uuid": "ff9fd1d7-096a-4a7c-ab03-d3bf65e99b55", "comment": "Malware payload", "value": "74271c6112292c2dc12112adddffa655", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753230, "uuid": "cd3981fb-6ab5-4b14-abdd-4766b432d8ac", "comment": "Malware payload", "value": "d45aca9ee44e1e510e951033f7ac72c137fc90129a7d5cd383296b6bd1e3ddb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753230, "uuid": "1edc2fcb-5ace-4cc4-bfbe-2fd2966293e8", "comment": "Malware payload", "value": "3bc62756b41f8545b65cac3ba6f3112cfae4bf37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709753230, "uuid": "12289b97-86b3-45d9-92cc-de937060ba11", "comment": "Malware payload", "value": "136519706fb7dd5127abbb48ed28197567f44f53198593efbd86e875c9fcd4e479c0da4d705215778e03c3b5d0f34995", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753230, "uuid": "200df20b-568b-48dd-b602-cfbe5c5616fb", "value": "T159768F43FC9508EAC5FFE13087A56712BA7174A98733B7D36F90465A1A25BE8ED2D300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753230, "uuid": "e3c0c59a-32c5-40d7-b966-3d573f3a66db", "value": "98304:Pyz+vvIerFhoMIyX000Nu3JoPgN/izM6rt4F7EcGHYrmIzv:Pyz+vQerFSMIyX0NNu3kM6Bo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709753230, "uuid": "adbbb42f-4826-4014-84f1-aab5c8fb12a5", "value": 7753402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709753230, "uuid": "fb2d6a10-bf52-4be7-b0fb-58e128f0d6c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709753230, "uuid": "ba364f30-2fa3-441d-a281-bb9a8079c361", "value": "SecuriteInfo.com.Trojan.Linux.Sshscan.14321.32478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a28fd6-dbcf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709739482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739482, "uuid": "771838e1-54b9-447a-8622-69d2b4cf58a5", "comment": "Malware payload", "value": "1cfef1e15b57357629b5557c98880e31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739482, "uuid": "e8f1c34a-1872-4190-8366-e38f47abf711", "comment": "Malware payload", "value": "d4e7c642cf2bc761c78bf0862fd86cd0e6332bab99181129d0a50ccdff3a3439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739482, "uuid": "e2c8f483-355c-4d61-bebc-ee3f095c84fb", "comment": "Malware payload", "value": "a38a7a46d5020fe36b5642e6ffd7b98e339f0fe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709739482, "uuid": "7950f512-21b7-4457-b7eb-8feebdaa8a04", "comment": "Malware payload", "value": "841c8288d8abed22d164cef79122de01ab2454f5f83152c8a2353b27ae66db09f900352c2fbdd5430bf8050824e3a952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739482, "uuid": "d5a7763c-8cb2-4e61-9476-ccda7b4faa9e", "value": "T152055B52B3C7D1B2EFA225F2D6B493761939BC35133C89CB7390382DE9A06C16A35395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739482, "uuid": "a0ddf7a4-4676-4fa1-a4a6-d75fe3ffd685", "value": "c6226f6a092dcec547d41454113dfb56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739482, "uuid": "2e6a379a-635b-4ad1-9360-a79569b3547f", "value": "12288:7+ldKhooajkd8OqC1YYs6SePwPNRqJYyUNptUAqnjtB3eL:7qdKhov5OfYYs6SNxptUF73eL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709739482, "uuid": "77182481-e839-4fd8-8041-009b90911bf8", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709739482, "uuid": "20d67542-8f4c-430f-b11c-efd64aaa6725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709739482, "uuid": "2a4fe690-412a-40c2-bfc7-725e14bbd641", "value": "SecuriteInfo.com.Trojan.Wacatac.31808.23996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cf82a3-db9b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709717237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717237, "uuid": "2ad4eebc-fb28-4ae2-b57f-eb1a092b7c7e", "comment": "Malware payload (AgentTesla)", "value": "7d55c09a5365a21bd13858e52d2621d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717237, "uuid": "5e711f03-c0fd-4440-a761-7d144578ebc5", "comment": "Malware payload (AgentTesla)", "value": "d94605dc9ae015762fc63c3ffc0adb88c67ad5173e3ea737d2e298217da8e611", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717237, "uuid": "bc3b0695-ee49-4812-b31b-c906b3725085", "comment": "Malware payload (AgentTesla)", "value": "21aba65f85965b13a9a791cacbf3febd351779ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709717237, "uuid": "00cf34ff-cea4-43ee-9506-fd463f0964bc", "comment": "Malware payload (AgentTesla)", "value": "a989b2951d663bb4130e5bd358cf3ec92d110870029db7a808b9b83828f955f2b2751dff9c10040ea1014877c3b0e588", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717237, "uuid": "24408545-4b0e-4bcd-bc8f-ad38214871a4", "value": "T1B7357CAD321075DFC85BC972D9A81C68EA212C7B830BD107A02735AD9A3D697EF144F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717237, "uuid": "7f77820b-845e-4f46-b93c-b88c4f86c38c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717237, "uuid": "18c3fe74-b6c3-4dcb-84e6-9f9d4defe72c", "value": "24576:kfw8End/j2AZxsHxh0OPpGQfVXjy6cJRl2q:o3Ed/6bj9pDhyTRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709717237, "uuid": "9444272c-22e9-4daa-9e79-bbb3cd4fda97", "value": 1162248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709717237, "uuid": "02ca837c-703f-46da-a7a3-4308a4047f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709717237, "uuid": "579aa9a5-ee6a-4387-9eb9-3595f13e6806", "value": "SecuriteInfo.com.Variant.Lazy.490347.28942.18465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61a2595-db95-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709714654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709714654, "uuid": "3fba6f4e-8e3f-4620-8099-b5ba36deb5e3", "comment": "Malware payload (AgentTesla)", "value": "6a6ee1c6ff2420cb4503e4544539251e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709714654, "uuid": "e788471c-fa82-4a02-8e37-ca08ef0dca90", "comment": "Malware payload (AgentTesla)", "value": "d9b82a32e0118a28cd379ebbeb52faea3e033687c7a88503d701b62d9b5f008a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709714654, "uuid": "2ae8e5d6-4a5a-41aa-9396-9dec14084bae", "comment": "Malware payload (AgentTesla)", "value": "0823eb7643ab7607f8c77a0e46a6fa87b894f720", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709714654, "uuid": "ec2a4a3f-4d70-4380-a207-8a3e2b159973", "comment": "Malware payload (AgentTesla)", "value": "aab682a97fc542de75381254d4c86f605d8aeb6634d51fa5f9a94c08efa54c5306618bfd353dc03aef92b79af7da8a18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709714654, "uuid": "ed138a7d-b859-469e-9d4b-9cb475ea8482", "value": "T1ACF4F14173F86B25E6B98BF564B451401FB27DAFB9E5E30C1DC674CA3A71B400A92B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709714654, "uuid": "c30e3954-f7bb-409f-98f1-fd172e649ff0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709714654, "uuid": "e2a9c50f-37ec-453f-867b-54cdeaf7b592", "value": "12288:wBtbV/j3518BmvQSEYH65tSz3AKPH2QW9i+MkbGo64CS6xnwSkR:yV/jkBmvbEYH65AAtQWs8KACfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709714654, "uuid": "c62b51b2-0b5e-4b02-96a8-d5ef0122fda3", "value": 747016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709714654, "uuid": "f6352aa6-0227-4b66-bf02-14617be4edd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709714654, "uuid": "45465338-30fa-487f-a3e2-67eebd670cb9", "value": "PO20240306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caaab55c-dc00-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709760645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709760645, "uuid": "955fd165-c4f8-4f76-9a36-34f0c5a6a518", "comment": "Malware payload (AgentTesla)", "value": "e0bc364904005b4b71bdb5a9a74088ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709760645, "uuid": "c4ad33f0-79bf-4052-bec8-7840d12fcabe", "comment": "Malware payload (AgentTesla)", "value": "d9e3a591c7151aeefe18a1d1c36ca895c7e91979ff491bfd7b629d4e5f4d1c89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709760645, "uuid": "a42d6350-f254-4d3a-840d-556182dfc477", "comment": "Malware payload (AgentTesla)", "value": "8c322c12f7661e77b382a6d53ceafd3dce8c16c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709760645, "uuid": "478cbca9-8db3-4dea-a727-bfbcd9a30724", "comment": "Malware payload (AgentTesla)", "value": "60b4d76c510ca3c9e38512096269c36e7dfc33deb0d063822fc457e5984455963e215751a749f4e7e040a79b387be4d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709760645, "uuid": "f87d9763-c580-4b58-bae2-821e36ad705b", "value": "T1FE53172EE34F0954DF59D6BB434A4B4A05FCB33E728140A179BC97343B6D81E46629BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709760645, "uuid": "faff473c-1125-47cb-9428-c712a742e33c", "value": "768:9kb1zDeZmWJHEZZMMJbqU5PY704JS+Nvrz9cF9ky0B5:9kb1F6s5bqUdEdS+Nv/9Mn65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709760645, "uuid": "312215ab-f1c5-47b1-9331-06e303cc771f", "value": 64042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709760645, "uuid": "affe09b4-f4bf-4be4-897a-3320b769bead", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709760645, "uuid": "5994c87a-ef38-4f42-9d22-2f968ec7117b", "value": "SecuriteInfo.com.Exploit.ShellCode.69.23621.18229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04017055-dba9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709722945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709722945, "uuid": "efa5d070-6c90-46cf-84fa-6fc40e1be232", "comment": "Malware payload (Formbook)", "value": "b3d9709ffa25c3e6251701cf7888fd6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709722945, "uuid": "98609ae8-64ff-4636-971e-4f0ab0c7e352", "comment": "Malware payload (Formbook)", "value": "da0f43d72dff3d7f03614de4816e169d4d8aefc2785d15e26a086bc695af9800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709722945, "uuid": "0c73d002-ace8-40a1-b05f-95eb6b4dba55", "comment": "Malware payload (Formbook)", "value": "f135fbe2f86f8fdc1823df00bb566b3ccd1c89fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709722945, "uuid": "5f6699a2-15ab-4122-9c2e-fae203655672", "comment": "Malware payload (Formbook)", "value": "9fadb75dda02d7159f4c99dee76be0b7d8350c49fd4ca068fdd2a1d4e0149f026e29ee557adad71bc1b31c5a356be7bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709722945, "uuid": "88d34bc6-9a45-43da-a5dc-69e8bc6cc3db", "value": "T198D42214B7EAD56BE4934BB201F23FF8B3B6A60158564A0307341EAFBA0AB45571E50F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709722945, "uuid": "507f4a6a-6d2e-4b53-b9be-e01ff7d3da3c", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709722945, "uuid": "4f0d9fae-43e2-4507-99d4-d4fd3d79f43c", "value": "12288:1lR/O5ngMXT7UDcN2R+e8gY193PuMhwelKq5ANbCY+84K:lKga7VEhB6RPujeXANmA4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709722945, "uuid": "8edb2a60-ff35-44d8-affa-21c065f95bb2", "value": 640032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709722945, "uuid": "875480df-4796-4533-b427-6ac29dab7f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709722945, "uuid": "bde6c7e8-948e-4086-b021-670beafd6cc3", "value": "Transferencia 4334300002017359pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e88f78d-dbc2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1709733942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733942, "uuid": "8d5f1106-d553-43da-a0f6-1abdeff3fc20", "comment": "Malware payload (NetSupport)", "value": "9a4435a3b04ec90721a401d4db1fd5a3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733942, "uuid": "514532b3-c945-48b3-965e-4e14abd75026", "comment": "Malware payload (NetSupport)", "value": "da926fb52411d384b2308f03401bfc776ab20720477a7ca27964a11e3c3c73ff", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733942, "uuid": "7f5b335d-6e90-4639-b09d-fee7ce8ed0cb", "comment": "Malware payload (NetSupport)", "value": "6df13aec39d7bc1177748ea2bcc32a04c8e8e8b0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733942, "uuid": "d94fb2c8-35f4-4343-ab1d-05c8f628ba21", "comment": "Malware payload (NetSupport)", "value": "c2910b44f2a9aa375e137e08f8203f747f5d8f454950b32bcd7bf2a68d6d66806f378704e598156e1e3068e73c82d741", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733942, "uuid": "650d4ab8-6ef0-41f8-9bb9-747f6130888d", "value": "T151A2D0259BE414CDFB734FB0DBDAE4A188F76C59EE66D73B000D60B4A110A876850D57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733942, "uuid": "1242dff6-a821-47a6-932d-f187b51a4555", "value": "384:w5Dfbc9wtpZ+8ZMdRQQWftQmJQRXduS9UMjWlhiB7YzAiPuFug9EA9DDh10:ifbcKpZ+4MdmQWemJQ9duYUOS9ADFusO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709733942, "uuid": "deb78221-a0c4-4cf4-9142-dfe3a1a8b455", "value": 23234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709733942, "uuid": "87085f08-597a-457a-bbee-dae83c93819f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733942, "uuid": "f328bfd7-e0a4-4b69-9815-667034f0200e", "value": "11068-1106811068-11068.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d2f6b2-dbc3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1709734384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734384, "uuid": "32659150-feae-44ea-95c6-3a451dbca4c8", "comment": "Malware payload (Pikabot)", "value": "bcc53210e13294cbd6a8172558d99295", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "yourunitedlaws-com", "colour": "#7D258A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734384, "uuid": "50e5d71b-e94b-410b-8db2-3bbd1d241302", "comment": "Malware payload (Pikabot)", "value": "dd2b6e3aa75de8460730862f2dc739537734a7dfc9e673b6a23ee58430348ddf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "yourunitedlaws-com", "colour": "#7D258A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734384, "uuid": "18b924d0-3805-446b-a136-4f1fcff722e1", "comment": "Malware payload (Pikabot)", "value": "02f78e1449ce844dc2807d850aab397d34ec35aa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "yourunitedlaws-com", "colour": "#7D258A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734384, "uuid": "b9bc64b4-342e-45ba-8faa-6035ff108b27", "comment": "Malware payload (Pikabot)", "value": "8c342bca1b6b871131286ce6cf77ed0814177e30e810eb6422e80ec6f78bf3d740c51ae9eaa7865f363a674e09674cb6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "yourunitedlaws-com", "colour": "#7D258A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734384, "uuid": "c0a8ecd5-5227-4698-9a35-b4587632d6e2", "value": "T16905B02138C2C072E67E213B85A9F77519AEE8310F3097EF5BD8067A6F346C15A35627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734384, "uuid": "f63fa70d-1321-413a-93f3-fb82acadac15", "value": "55f1ba0b782341fa929d61651ef47f0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734384, "uuid": "37fa4b0b-d825-4d66-b4e0-d3cb25abfbff", "value": "24576:2e9nfmpSVmL+Cf72yb1SFEtEfPmY4uRD7HpUMhOw8ghE:lBmpSVmLfCDfPJ4cDFPhmghE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734384, "uuid": "51bc4392-4997-46e8-aa84-81741ece94b8", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734384, "uuid": "d89b5a8b-3b64-4457-b0ef-e507293276fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734384, "uuid": "84bed157-7185-4b52-91dc-5eee40365fd0", "value": "7668.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f6e95f-dbc2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709733924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733924, "uuid": "ca2f98be-e2ed-42b8-a319-264e8de943dd", "comment": "Malware payload (Formbook)", "value": "ab6efa89da33771cc27798e705a2043a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733924, "uuid": "6c5836be-e7e3-40a5-9f4b-1cb16f2be880", "comment": "Malware payload (Formbook)", "value": "df09e53e0571765247faf08a316fd75c13e84be01f4db61b294e0ec95aaf1b5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733924, "uuid": "bf03351c-6c43-4618-bc59-92af7e44241f", "comment": "Malware payload (Formbook)", "value": "3a3c00f5016e82599a3a2dbe1991d277374c5da2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709733924, "uuid": "aeb3b981-90a2-4df4-832f-ae41ac8d4a9a", "comment": "Malware payload (Formbook)", "value": "671c5292b4a13b9ac7d19b5e713573e626d618e565643d0a3f923a0cfb6c6af172fd79ce5581e3bd64da6bff922f72e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733924, "uuid": "770d7b31-c2c4-454b-8977-0b8087088ebe", "value": "T10005AE984E2F8D55D6985D30DAE7F4B94FA74CF3ACE909E43C64EC115A52A000CEDAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733924, "uuid": "9073e76d-d10b-4287-b5e0-48de6220855a", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733924, "uuid": "46aace7d-1ee1-4966-8f47-f61ff24f3973", "value": "12288:dgOiqjFk7BcQw4oxyCQYBLfoKI564aQiCyCtcgmicuiu8wgB:dgYFSBcQw4gyCQGcpakRRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709733924, "uuid": "fd330b67-2da5-4c7d-b8b5-9489d76e0be3", "value": 836432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709733924, "uuid": "761c5764-a007-4e3f-b280-7feccbcacb5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709733924, "uuid": "91e2df17-a5af-4420-8aa9-848a75f02dae", "value": "factura-022853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606258de-dbc3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709734267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734267, "uuid": "ed85e397-a106-4456-b65c-6d248ae3de8d", "comment": "Malware payload", "value": "e362465a702dd04dae440eb5ce8ec597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734267, "uuid": "0e326008-b486-4b2b-b312-943285377471", "comment": "Malware payload", "value": "e0500b8c5ade867734f7778f2861592bbed74a12cf1445d4457a3fedb705be17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734267, "uuid": "8e3e9be8-d15e-43d5-b994-e9b79bdef0ae", "comment": "Malware payload", "value": "12b166775e3ee4e591c5a4803181f8f383fdc562", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734267, "uuid": "daf6812a-9e37-4ee4-b3b2-6453708a1f00", "comment": "Malware payload", "value": "9516c0f0d7e8ed4bf3738ca713b54fa0a9a9ee8f9f4dae26f71b72149bb3eb8c8b42b92950446b802f3ed9058b871f9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734267, "uuid": "9723dc94-d6ed-4248-96de-e3b014ea42de", "value": "T1D9037C10B7DC9A3BCCBF537D98721051473093A2A257E79EAE9890DE59877C40362BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734267, "uuid": "011820f4-45f7-40ca-bc08-7f95fc26667d", "value": "768:kumZga4UfP00oR4fvDHdJSfHdeZRa6fUMMCp5Z:kToRwzifHdARa6XPpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734267, "uuid": "b92cc7ba-7964-4a31-a2b8-02bfe421cd8f", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734267, "uuid": "1b3bf99a-d77b-49fb-98d0-0120490c8e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734267, "uuid": "c0002ef0-fc40-43da-887d-7e7a82731c2d", "value": "e0500b8c5ade867734f7778f2861592bbed74a12cf1445d4457a3fedb705be17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152afa08-dbd9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709743590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709743590, "uuid": "349c8ac7-f99e-469d-8be8-6073753932bd", "comment": "Malware payload", "value": "67e2f09b14b3520e11fa35e933a4496b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709743590, "uuid": "85efea5d-7e15-463b-9cfa-c315c0643cd8", "comment": "Malware payload", "value": "e0da8778f07976499c543e9a4c359034d098de7aefd58121942a637f790bd565", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709743590, "uuid": "a3e42a1d-7888-442d-bf96-23695f15c066", "comment": "Malware payload", "value": "f9fe7759cffa71c356ba0715ea08772410868563", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709743590, "uuid": "ad64b82d-8c4c-4bbb-956e-7268ff242e36", "comment": "Malware payload", "value": "f1a7f4fd06e944f4167dd8e8c59052461f34ab3797de8554163c9b296d520d3ac61c1c69f36f8e37949ae58bfa283f61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709743590, "uuid": "5f5194b9-f3fe-4b36-b2a8-0c9d8fe48381", "value": "T102735A42F63A84ABFBD1A1713197FB2B1E7FE9295170195BCFBDAB8245612203C2435C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709743590, "uuid": "c8b31c51-a716-4546-9960-184eaa2047ef", "value": "1536:/bdbcDvPksflPF+YA7pxprlngtT+Q/tGMwK7tYuK2pMi8:zdZsf3opxT+/tscii8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709743590, "uuid": "55ce15ec-8d2e-4c1d-9e1f-2d65e5694d16", "value": 77872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709743590, "uuid": "452e108a-552a-4725-b5d8-bcace80e88c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709743590, "uuid": "e3b1ea7c-60c6-4e7f-b82c-6d54c10e9b71", "value": "SecuriteInfo.com.Malware-Cryptor.General.3.17127.19903", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340dbc03-dbc3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1709734193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734193, "uuid": "23519f46-5a65-4206-abe6-e8d78be807bd", "comment": "Malware payload (GCleaner)", "value": "78e80157125615157484c1d2de5cb80f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734193, "uuid": "8acb1993-86c8-4b23-ad6f-176ed7997f6f", "comment": "Malware payload (GCleaner)", "value": "e110fab1f34f83e0707006a7c7d4e37682294de5e8034144ebb6bfe7ef56609c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734193, "uuid": "04c092a1-c847-4cdc-b36d-4b4a0f18984c", "comment": "Malware payload (GCleaner)", "value": "dd4956d586fbc28c699293359d516505a6df5c0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734193, "uuid": "f3e973d7-1cb6-4253-8605-a7f41f4f3057", "comment": "Malware payload (GCleaner)", "value": "a61f1e6ddaa542d280e0580a97a7f56a38440289473aa9f466bad6f6d5ddbe7bc71987bc81c5fa96f612b921eaa1fc9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734193, "uuid": "7bf8cd9c-2696-46d4-9bb9-a09106831529", "value": "T18654D0113AA3C872D95B4134C821DAF42EFBBC72756181BB33A71F6FED302905616B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734193, "uuid": "55211fe4-be31-4e33-aa37-49d4664d7844", "value": "5dda066d95c830fd85c7c3534c3f1b8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734193, "uuid": "a8d6d8d7-c64f-4476-abbd-79b900622247", "value": "3072:9oAMVs2JLx07t5Ii0DL67rMJBxJWTLgiiSzxihtrMhXM/5LsA3BCXTz:APU4i0X67g1JW3gi4IF25BCXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734193, "uuid": "26bce036-d716-4a6d-b786-0529e5c27254", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734193, "uuid": "ae94c448-affb-40b0-b6bf-cf8685173b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734193, "uuid": "789ac72e-da9c-4422-af97-787a752c0daf", "value": "e110fab1f34f83e0707006a7c7d4e37682294de5e8034144ebb6bfe7ef56609c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a560984b-dbf3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1709754999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754999, "uuid": "74d0ee6b-33cb-4d44-9ede-ef8bf2fbad5e", "comment": "Malware payload (Metasploit)", "value": "929b3da70951ffd6a12f30d263f67e8c", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754999, "uuid": "4874d96c-7315-4c6a-9232-dc155cfdb14e", "comment": "Malware payload (Metasploit)", "value": "e1f0d4706f5c9aae0902b278c423f3cb135180ecd69f43d47111a06f1e647e91", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754999, "uuid": "8208b47b-80df-450e-a0b7-46d2456ec25b", "comment": "Malware payload (Metasploit)", "value": "2c39827f8a2f6501a84c69d0f66cbed55b971e84", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709754999, "uuid": "eed96809-bb2e-4a4a-94f0-f73d2b0d3f95", "comment": "Malware payload (Metasploit)", "value": "89f38af75727962007f221bcb8bd66c97386a09b4190f39b0cd90db5abbc69f2ad9b4dec7841607adf7ce74f8f39fc57", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754999, "uuid": "30d318c3-a107-4f84-8e80-70f3049676e7", "value": "T1DF61BF932151B8A9414283BB3D4D6BFAC07FC264964A6044FB8C4F99F9DDE63398D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754999, "uuid": "bd76da67-e641-42ee-8946-d3efd5c63b55", "value": "96:HGtFDgaHuSnWvD+CfBZL0HbmAiBrVMHcjUA:KFshvAHbmAiBrVdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709754999, "uuid": "8bf3ccc6-e648-4b7b-a495-39e0d967cc30", "value": 3234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709754999, "uuid": "b0167e7a-34df-4d94-911e-4d581de29391", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709754999, "uuid": "df514bba-7b5a-4dac-8bba-3f7b958fb6ce", "value": "b6dFu9ER.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf33f2e5-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718964, "uuid": "832e6bd3-b247-4a92-b70a-d288bc323782", "comment": "Malware payload (Mirai)", "value": "fb1884a4abb79d176a8903aec077ec97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718964, "uuid": "00d6333f-017a-4192-a6e0-4ea4dbfb875c", "comment": "Malware payload (Mirai)", "value": "e289c9d7d7ab2df6df46bf135c821bb474120ac265ca5d0e9bf4075fdc980c06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718964, "uuid": "ec336bd1-18da-41af-8fb4-0e86f8dfeb50", "comment": "Malware payload (Mirai)", "value": "9a0e756a146c51612c6350691fb0c7511a6e7287", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718964, "uuid": "3c800501-afe6-4769-8ce9-8aef8baf6389", "comment": "Malware payload (Mirai)", "value": "fc87d8aa43b04f059ecc90852ddede3394fbd496a02c01737f246441663ea65e8d63421ca37ff8334632c0e050682932", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718964, "uuid": "6b4c8169-7b37-4330-b7c6-15cf5ead60ba", "value": "T1E3E329DBFC00DDFAF80AE33748530806B530B7E245925A372257797BED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718964, "uuid": "9b8fa32c-e2a4-4c28-8bab-2b86c45df9c2", "value": "3072:U1/rHYD7Sbv7KX9DAMooReHVrjbitLjeVSryWWFhE:C/LmXxAIReQLjeayW4hE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718964, "uuid": "372fca3b-2238-4940-aa44-ab10a8e8a94a", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718964, "uuid": "cb1fda9e-23fc-4716-aa18-eb75e9e8b90a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718964, "uuid": "662cd6f5-0dd6-4fab-abbb-ef3735c35c92", "value": "fb1884a4abb79d176a8903aec077ec97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9284c3cc-db98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1709715883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715883, "uuid": "4d669b4d-0ca2-4dcf-af0d-bf9a3263b8a2", "comment": "Malware payload (Smoke Loader)", "value": "6d06917a4f1ce19595f45d652cc3f5f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715883, "uuid": "830386ff-a625-42b7-aab6-3cb985b859df", "comment": "Malware payload (Smoke Loader)", "value": "e2ee33a7a4d96b608f35b98c659f1e65642f4036353140ac2fd0ff5152eb4964", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715883, "uuid": "ecbb439f-601d-46e2-ab5b-0d3ee9a6a6a5", "comment": "Malware payload (Smoke Loader)", "value": "f12921fead53f540793ae3ceec9ddd9d2cbf576b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709715883, "uuid": "e778b1c5-ad03-4ba2-b059-852b4a0a4991", "comment": "Malware payload (Smoke Loader)", "value": "33a6001c1a992f7886d16b619f303d69b8b382cab9c7925e6f78e2a65b30d4fec4eb4e8f26157178628c5c7afd8ed6b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715883, "uuid": "48482c43-2665-4c6b-8136-223d0a21233d", "value": "T1E4F3AE0072E2C075F362E53459B4C3B34A3ABE725B7785BB2795263E0E72EF04965362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715883, "uuid": "0962fd38-a69a-449d-a892-5704756362d8", "value": "c6d19c8fbbcd0c83570e7dbd10119e65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715883, "uuid": "c28db38c-318e-4d89-8bcd-90323f68328a", "value": "3072:diZUCzlE+mKEYsBqbVj0Mx96KuuW58v7gyCXLO2Vf:d6UCz3SWVP96KM5CIO2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709715883, "uuid": "2464e107-8268-4790-8b91-23ec72a69636", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709715883, "uuid": "fa5d2360-fac3-4b56-8624-5dda745858e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709715883, "uuid": "9589de58-8b40-4586-941b-e813efa3aefd", "value": "6d06917a4f1ce19595f45d652cc3f5f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5343edba-dbba-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709730380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709730380, "uuid": "8d6ba4be-3982-41f2-ae97-9d7961a8cd40", "comment": "Malware payload", "value": "0fdb81272844c7f706b24b4b7a8b0ba0", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709730380, "uuid": "dec4fe40-ed66-4f39-be6e-306336b0da52", "comment": "Malware payload", "value": "e5828bf002d9e017c137b7697b826a6de902e2dce7fcb1b521b881aa3bacf468", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709730380, "uuid": "b1154bc7-ef29-4712-8774-ceefe8e867e1", "comment": "Malware payload", "value": "f19b6b9eef0798d100f662914ea75dd2dc94df2e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709730380, "uuid": "dc6e7077-c048-4d27-8893-b26d65dc231f", "comment": "Malware payload", "value": "7940d36c295338a73000768cd4ffe6bce360f8c8ada7a61d52c44639207e1701609b8286249b673739709dd6ad5e50e5", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709730380, "uuid": "fbfd3fd8-b882-451a-8789-b5c7c5231d5c", "value": "T198273392234938ACA441CA70A096F3A533767C45ED65C9A17ECAFD4B7FE683470483BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709730380, "uuid": "474129b1-7e14-44a4-969d-b269595aabd3", "value": "393216:83FakuLG0KlH4eiks4pkwSQko+aixAEkRJsidxxUrS1MKwvSpjGzOav:83QLG0EHex4pFSQYamPkw0xYSiupjGiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709730380, "uuid": "d2a1562b-15ba-4902-b14b-910c3f853bd9", "value": 20409008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709730380, "uuid": "34b00f0d-1ae5-475b-8dd7-55e17f0b876f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709730380, "uuid": "81d3ebdf-3f2a-4b73-b3b1-cca01641d98c", "value": "Pandanero.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f990a8-dbfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709758303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709758303, "uuid": "b372a13e-8da5-4599-ae9b-f8aba10903cb", "comment": "Malware payload", "value": "e7e7529f25f203684cc5ae294700238a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709758303, "uuid": "040fea6c-a9db-4564-bc1d-664c8257da93", "comment": "Malware payload", "value": "e6c7d398b61a33e180face41bbef7e6930eab1e94ce14adaf41ff866316af25f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709758303, "uuid": "80529009-be01-4383-a7b5-3372bbaf1684", "comment": "Malware payload", "value": "31b176d46610dcca9c6eb8765011b8a457b16ae8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709758303, "uuid": "1fe26d97-6372-448c-9f6d-ebb3f32a12c3", "comment": "Malware payload", "value": "bcdda386c00844392cf243db38e9eb84bd8765ea12ba142b0e00213a0580101cd8a60c0cd3692f878e81e33129cc39fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709758303, "uuid": "46098837-7278-40be-be0a-076a0196d466", "value": "T18E54493A76A40CB8E8A7C23DC9534A56F7F2B8550360E7CF03A0465A5F637E0993EB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709758303, "uuid": "e433f0f0-af05-4d3b-9359-927f0ce34436", "value": "f31a8871429cd935c9a53a18857a05bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709758303, "uuid": "e061cc01-afd9-44a0-9d83-4fcd0765f5c1", "value": "6144:cy8N+zIip48nThzDR1fseXYlh36j1yMkzdRf:cmLp48nT1jrXYL3gyMkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709758303, "uuid": "2917f881-bfbd-4ff3-896a-807de8135768", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709758303, "uuid": "fe4d8f8f-8885-4b91-9ae0-20f5a94cf2ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709758303, "uuid": "09e1bc4c-917d-442c-bbce-7249199f2cb8", "value": "SecuriteInfo.com.Trojan.GenericKD.71833576.32573.37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8588b54f-dbc8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1709736477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709736477, "uuid": "b26fb1ed-6060-43f4-9f5c-d4f05382417e", "comment": "Malware payload (SnakeKeylogger)", "value": "9987897aaaaf01d04b9377723f1fdd1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709736477, "uuid": "0a4fa12b-c1e8-4be4-9222-42f001f12414", "comment": "Malware payload (SnakeKeylogger)", "value": "e8d481924c090333dd7e0c1f9b3eca1711bbc3317796f8b30a5d29dab64aaee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709736477, "uuid": "5c0688b5-0e93-4bba-903d-5f594c5a7dff", "comment": "Malware payload (SnakeKeylogger)", "value": "8cfc69dae7ce0421f183b40573a3060797687bff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709736477, "uuid": "80ab9ff2-9550-468e-96cd-af48804f2eec", "comment": "Malware payload (SnakeKeylogger)", "value": "8ca7324b024da0d3be7cfa269990f7ba3889beeae39286307101400a5241444fa814112db82ed2bf7e484d1a617e1ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709736477, "uuid": "da97ee0d-6283-414c-9d00-9e156420c866", "value": "T1F1A4B0D92A69AEF6C4620AF7D866994C7A30945131D0E87424CF0E4CFCD8B8385F967F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709736477, "uuid": "05b99ddf-065d-4c94-be29-e20cfb0f1ec6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709736477, "uuid": "d5413dd8-c4d0-4b42-893f-f918287bef10", "value": "12288:3CXF+TAHqAZJgp+8uwIeuWtaGAxpmkUt5aCOgRFdXg70WhEDAAAAAAAAAAAAAAAM:3qF+TAHqAopTuBkaLHmkUXPdLgYiEDA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709736477, "uuid": "a993fa42-bcb2-40d3-9bc5-170ec3af964f", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709736477, "uuid": "394b4cbd-3bd3-4d1f-bf93-e84e345f197c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709736477, "uuid": "87aa3d8b-5a19-46c5-b99f-844e862b1d4e", "value": "vessel details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14832694-dbe6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709749172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749172, "uuid": "12696500-77d2-4220-9182-231dce7778e1", "comment": "Malware payload (AgentTesla)", "value": "ed451031e053330622b7499889929f08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749172, "uuid": "906cbf3a-9b99-4c64-9926-68e4dc09a0a2", "comment": "Malware payload (AgentTesla)", "value": "ea84e96cd417f83d7de9471c9f1191ea85a02ee97079a9731bbfc3031151196d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749172, "uuid": "da10959b-e33f-459c-9e17-d3b899b230fc", "comment": "Malware payload (AgentTesla)", "value": "366844de7c9af166aab98af79850260b1568e1bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709749172, "uuid": "0adec1a3-9f3e-47d8-9f9b-8da3415b3dde", "comment": "Malware payload (AgentTesla)", "value": "17decffda9161c0c81a64c471f9755b86850fc2f5be03d979cdeb516edd867670baf4a1040df30c7f9f75fe9f3594dab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749172, "uuid": "03c05c64-5937-4209-aea3-54241b6f1b36", "value": "T1D915F17DE718BE15E53E337E50212DA423F2C1C64A01E32B5DD546E1BED7B9B0E221A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749172, "uuid": "36965ce9-159d-4ec7-bc20-7783b47f02c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749172, "uuid": "dd711884-793f-4610-9ad9-ec1d134a56cf", "value": "12288:hbxfAe/YkCngjvXhXwFjZRCDB0nfCFp4MbuMynVEHGBvpxpPNUYU1+qcR8:hekWgj5XzB0nfCFX6nVAGBvpVtVR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709749172, "uuid": "395fd65e-bc2f-421a-8f2f-3e947bbbc9fc", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709749172, "uuid": "06763d75-5bd7-4105-9f2d-41b53539a2b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709749172, "uuid": "271408f6-7d17-4e4a-a212-b81dcdbda454", "value": "V\u00e1ltson \u00e1t inform\u00e1ci\u00f3s licencszerz\u0151d\u00e9s.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e9b95d-db82-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709706275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709706275, "uuid": "f8a9d96d-a95a-42c9-b643-5139ccc7f42a", "comment": "Malware payload", "value": "fcb1c59d01e645ff76ae81b8890c0ba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709706275, "uuid": "79a9f564-90e0-41a4-833d-522f62e356c1", "comment": "Malware payload", "value": "ef11891f6e9166f0ff4fd7acc7b77d07620a51fdc1d6f5faad0801fc86dba507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709706275, "uuid": "53c90599-af96-4a28-81da-a581fbfc5f54", "comment": "Malware payload", "value": "7c0d1454a9a3ab0d925ea75c00c756ffbb9c62e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709706275, "uuid": "13ba5f7e-6760-4171-8b32-07376dcb4044", "comment": "Malware payload", "value": "3c9fcdf2f205b385045f38e587da7329b79352e11ab8e90b666655990f97e0442be23b7a609fb0f16f7f3458358bb406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709706275, "uuid": "91cbd628-ebb9-492d-9fcc-e221e22b1bf2", "value": "T161953380C71B51F6DCA36DF168801B6F12EE0FDC62AE26627DECF15819760E4D1EA067", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709706275, "uuid": "e5549269-4d69-4a22-b0ac-3b4b066eace5", "value": "49152:Hs5g5b51YTx2RGhtCbCokwZ5SmCMHmqTUgmE27buxm1i:HsSKo0h+Cokwb7dmWUg12WsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709706275, "uuid": "82f1cbd0-cfef-473b-b6d7-793313db25dc", "value": 2002888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709706275, "uuid": "c8261372-1737-4096-9a23-f62f8f2c6f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709706275, "uuid": "d5a7cc54-57f8-4bbb-86d4-75fa091f0e5f", "value": "SecuriteInfo.com.Trojan.Convagent.12597.130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168c825b-dc08-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709763779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763779, "uuid": "bbf05208-69be-4282-b5d3-de9ebebf6381", "comment": "Malware payload", "value": "4b3c4e89c88778545c6546b51ae4e347", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763779, "uuid": "b9e57c71-9b36-4ad9-8367-4d45daeea898", "comment": "Malware payload", "value": "f3955108b84059b1c6d7eb3d147523755cbd63f5260357c9884c4ff2afc46dab", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763779, "uuid": "3574aaf2-a8a5-4129-ac97-e46740b54c1b", "comment": "Malware payload", "value": "537b6dd7f4d0ccc9745264ea3f6a45a29c60b46c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709763779, "uuid": "0016a370-11db-40f9-9636-5a91e6ef3c9d", "comment": "Malware payload", "value": "61be8acd2ee19a7cbb18df2d3ffd84af0c707eac006dec5abd81188db4eb2d36a296f533ada442ebefd440eceb9a86d2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709763779, "uuid": "93feaff5-d58d-4333-b9ce-0412d9b79362", "value": "T16AC423895C384FD2946CB354B0CE1C2583A806E8043BFFC05E66951B65FFFA7696B82D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709763779, "uuid": "bb5c48e3-ac2e-4cb2-a713-27fd7addc1df", "value": "12288:9fQ2DN7kUfEGN8ldcxrlPKEBYQH1Dr/4m+uN+1CZt3El11Al/gjf2793BBe:9oUNEGNJqbQHl/4KGMi1OoLYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709763779, "uuid": "646622cb-aa16-4ddc-a8b0-2e25d2b31d4a", "value": 585511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709763779, "uuid": "d42ac616-be71-4f5c-996f-f980262ee503", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709763779, "uuid": "dc2260d8-c6dc-43dc-8d24-089ab74c12b8", "value": "hvvv.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1e7993-dbc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709734981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734981, "uuid": "4cde312a-11ff-40a9-9593-0b9463b0c365", "comment": "Malware payload", "value": "9d8135e1621d197077163e21faaf3b93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734981, "uuid": "89f02cb6-5451-4ff7-9898-88ca74ac4b32", "comment": "Malware payload", "value": "f4dc76dee85e97b33f665e5770ea245934b9c5d1f871b67b614a1e21e636b197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734981, "uuid": "657f6875-61bb-45be-aae7-c6d95e42b040", "comment": "Malware payload", "value": "cb6d52832e6bba376757d00ba905ef83fbd0aeb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709734981, "uuid": "12fa0c3f-6559-44d7-9ddd-78bb7ada3418", "comment": "Malware payload", "value": "254c4b8adf3c8dbfe52348f43d21c2ee2b4d8245daae944abdaaa80859b5c71c6accdbf9b5837341491255ae50ae70dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734981, "uuid": "79604e4b-3b7f-4326-9e6c-dc2a66798d8a", "value": "T1E1037D51B7DC863FEDBF13B9A87212214371D3436282DB4EAE4850AE69577C40363BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734981, "uuid": "b7003ae0-4f7f-4b04-84a7-1f2c61848d87", "value": "768:ebZn02Y2uerroAAZm80FXQ+2S8NszqClqv5N:UVVuerUUVP2R/PvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709734981, "uuid": "7bf23e7a-6719-4d1c-a5a9-e8e681528f2b", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709734981, "uuid": "c0ab27ba-6f23-45dd-adfa-43e76c6aee7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709734981, "uuid": "3d2a66c7-9d41-49a3-a855-17e91afb5394", "value": "f4dc76dee85e97b33f665e5770ea245934b9c5d1f871b67b614a1e21e636b197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c19b49-db93-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709713494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713494, "uuid": "4fd7fbf3-c4ff-49f9-80b7-95049f0ba8ab", "comment": "Malware payload (Formbook)", "value": "7e2bf47f349c04852ef94827f3448533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713494, "uuid": "56457206-a580-4004-a4ba-c9252a7b9ccd", "comment": "Malware payload (Formbook)", "value": "f4f30e7141908e117623dcac4e9f98cee8287fab750a1d720bdba5350cad19c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713494, "uuid": "f841f2ac-6040-40be-b044-b37f3dbdfe68", "comment": "Malware payload (Formbook)", "value": "bf4b8a268a9e1d2a54aa9f15bb3fb17abd3fa16f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709713494, "uuid": "50001d96-61e0-4825-b3b8-aa09997c39ec", "comment": "Malware payload (Formbook)", "value": "64834f5e9bcf40c14aed9abc1defd85488eb47a12e4145dc65337866e492a39d59d1cc62598b9d19340b23fdfaabb9c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713494, "uuid": "56a6d3ce-2181-4614-99d5-ea6005ef41a4", "value": "T1EDF4CF4D63604397F0582B74C97C7E090330297D75D2E7E8BD95B69BADB2BA2093321B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713494, "uuid": "940da18a-2643-413c-83eb-4cad048045f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713494, "uuid": "71adaa0f-e63c-4a44-a645-c29b81ec179c", "value": "12288:Q6FO1lO94j9/j50Szw2PwGOJSvS/ec8LgZPFT3xPNE72Gu/80Ao:D6/j3z1PwlJSvS/xFT3xPNEKp0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709713494, "uuid": "4416df6f-a223-4339-92b8-dc51139f5ee5", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709713494, "uuid": "b27f09b1-365f-40be-9e86-343d05e90201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709713494, "uuid": "9f5a9041-d471-4c4c-9199-9a9f1aacbac5", "value": "SecuriteInfo.com.Win32.PWSX-gen.24392.9054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec6e110-dbd5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1709741888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709741888, "uuid": "29457795-50bb-4325-93a4-406c25f39eb5", "comment": "Malware payload (XWorm)", "value": "2c07556fe98b7e752912ab47b37a803e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709741888, "uuid": "51c2e0ba-83a8-4d6c-b95e-9bbd7223531d", "comment": "Malware payload (XWorm)", "value": "f6f3fa6288de34a7755a4eef5864e7dafca3e9cb8bedfee1d5f3642aedc3a300", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709741888, "uuid": "b63b39d9-c159-4879-9987-b8cb5602bea5", "comment": "Malware payload (XWorm)", "value": "969c93781b87a027f4f492b46421ce5fd0f713ef", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709741888, "uuid": "5aee168d-b6b7-4e97-b147-1a9a4089ac1e", "comment": "Malware payload (XWorm)", "value": "2901099b0479bc2ec9d58f628f10945f33951033e3846654ddf9c3c2c838684cde9e106406701b5b9332b7a7dd5427d1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709741888, "uuid": "d30acfe3-e7fa-4433-a91c-b137afea7e8f", "value": "T1BC21C49393796540B6F3760068A617BE1793FBC3ECBC83889C507C4D87B05A8456A7EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709741888, "uuid": "cf7fac9a-6031-452f-b915-ed80e75d4878", "value": "24:QKbR30ycOJLWTQwfZfJanIh6gj7+Tef8f191pN:vbB0NOJVwhaWJj7Df8f19h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709741888, "uuid": "3adf6ec1-6e04-4e70-9667-7f21df16b3e1", "value": 1326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709741888, "uuid": "73327b25-f067-49a7-9286-f4f6a168de56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709741888, "uuid": "4f0929f3-d8fe-4245-9765-ab7356680526", "value": "6009287162.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4d336e-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718990, "uuid": "d0a0b0a6-2126-4034-8a61-b8b76e28beaf", "comment": "Malware payload (Mirai)", "value": "f623824ee380982c3c2dd794531fcd49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718990, "uuid": "54642be6-8472-49dd-9c84-e1ef85ccc7f6", "comment": "Malware payload (Mirai)", "value": "f7634e8f9c2ccf1a6404e66db29847a99a5b07d4045accdad2249868f69f0c0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718990, "uuid": "3e4bd757-718c-4818-845d-6c5478c66c67", "comment": "Malware payload (Mirai)", "value": "17bd84da5d68371c9dd56295014458fc506a2815", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718990, "uuid": "1c0f971b-0f31-4ec5-9c45-48ab5d8e25c9", "comment": "Malware payload (Mirai)", "value": "4cf9a19d5ab68d905b7dc6f653a2fcaa881cba4cc547cb04cf9965988677136388fc48f24397de932ee05824a5c202fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718990, "uuid": "788cbeb5-3f5f-40ff-b036-3df47ec8b1e5", "value": "T109D3F845FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718990, "uuid": "3b1245cc-6f1a-4a7e-b8b2-89c2a529dac3", "value": "3072:gHZ+X7AooxFOV48wlP1z0RraPuk8d+Ow9L3sibr:gHZcArAV48MP1zuQ9LsiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718990, "uuid": "b290b4fb-522d-4c72-82c2-eeef773bda7d", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718990, "uuid": "76a17532-5db1-4dbd-a679-1d9c64078888", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718990, "uuid": "d2d8ca5d-1c9c-4a00-9dd9-02002b76a232", "value": "f623824ee380982c3c2dd794531fcd49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c528b710-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718974, "uuid": "371c6481-a7ef-4514-8768-14d6b4084950", "comment": "Malware payload (Mirai)", "value": "368c6b364f47d97a34385e5a50ac990a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718974, "uuid": "8cb3371b-c002-40df-9e2f-108f5e466d94", "comment": "Malware payload (Mirai)", "value": "f93487b29ca41228f1d0ab3dd22b7fa0cf00641d6ac0c6d02c5075c9b25ce447", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718974, "uuid": "bd0dd3c6-b96a-41a4-b96e-32af588a2780", "comment": "Malware payload (Mirai)", "value": "3c29db21ea98a75fa10e15321e87934dea2956e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718974, "uuid": "1f24f3db-6347-4413-adc1-1af801102e29", "comment": "Malware payload (Mirai)", "value": "dc69dae9e70dfbdc0a4ac4d2d4dcd8d936d24681f6ebaf4fa613e82ccc11e4d8fe760b1a636355e28bf1468afd2779ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718974, "uuid": "6ccc445f-59e9-409c-9903-9445c9176a1a", "value": "T1EE936CD5F683D4F5E89304B1213AEB339B33F0B52019EA43D7799932ECA1511EA16B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718974, "uuid": "1990b7b0-30b0-4662-ab09-dbdc4081d4b4", "value": "1536:xpmWc2AcighsZ82fJxfcMHH1mSsM8y6Q+gBQ9TnkISGtAdo0xZ:xpmX2riED2frfzHVmL1Q1Q9kVTo0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718974, "uuid": "86b1ae0b-85ea-404e-83b0-f6628ce83c42", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718974, "uuid": "aab576c8-33ae-4e45-8e18-5fbd8931c433", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718974, "uuid": "f40ffcb8-ec42-4cc4-9476-3f11167f5695", "value": "368c6b364f47d97a34385e5a50ac990a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4013ae7f-dbbe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709732066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732066, "uuid": "41dc900d-925a-4ad4-a1d1-762d11abb0f3", "comment": "Malware payload", "value": "3fffc389ff635756ed57abfe732acf5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732066, "uuid": "9f0ca2b9-8e02-4dba-ac59-a8a783359b5b", "comment": "Malware payload", "value": "fca573998b717a7a4da7c822b67365bcc05605201160e1510adcde66ef8b8a85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732066, "uuid": "3c6c8fbf-a466-4e0c-853e-e34b5bcb1ba2", "comment": "Malware payload", "value": "d3c6ac59d3d5004cbf0424067d31711fb829aff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709732066, "uuid": "93dd4045-8bc9-4b4e-bbe2-c0854f060dac", "comment": "Malware payload", "value": "2bd1550bcc5cf2534a0accf44e30325fdc18372c151ea0b60dcb99e8e545c0ca41068fbf56a3e16c136ef8bbedc00fe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732066, "uuid": "ea2a8d08-3ff6-49b5-a82c-7c0974d41e00", "value": "T1E3F7AE11E3E80A16E56FC2BDC5638513D6F1F4972322D7CF0454E6992F63BD2AA36223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732066, "uuid": "fedc2caa-1a01-4679-b309-80bcb05657f8", "value": "698fa83da166edb916866ef085b426d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732066, "uuid": "2f01369f-7b9f-44e6-989a-168ff0884702", "value": "786432:n7UgcCerF/P1Q6nEL/t2zT/Ly/V5jiVaSW7:7mVRtQ6EL/t2zTQ5pSW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709732066, "uuid": "ce673114-84d2-4db2-b492-c7048a8a8353", "value": 70811553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709732066, "uuid": "ee595462-6f65-482a-b306-579f5f95f88d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709732066, "uuid": "4e5513fd-e4c6-491f-9bd8-32b855e61660", "value": "SecuriteInfo.com.Gen.Variant.MSILHeracles.129445.12272.26690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8543deca-dbf4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1709755374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755374, "uuid": "6e7e557a-ee9c-43b2-aaed-a00ff9bc15d3", "comment": "Malware payload (Metasploit)", "value": "cfe4ec997d9c91c46f8fbcbd4936d593", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755374, "uuid": "b9535c94-7ec6-4bf6-8125-53da93c4c1a5", "comment": "Malware payload (Metasploit)", "value": "fde50d772933f871c8e67d7f2c44981b8740593f9dd5a12ef6fbe52f2f531492", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755374, "uuid": "3f6933df-18d3-4711-a765-d1540b6de735", "comment": "Malware payload (Metasploit)", "value": "bc1dd4885d8ce4f80f16cd64b1bf8472f1e24f0b", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709755374, "uuid": "b665cda2-bda1-42d9-92a4-6e693ad6dfc4", "comment": "Malware payload (Metasploit)", "value": "fd11d7967fc4f2e1bf4371ff16f1e6a8917607e1b32253d47b929204f155a0720068ff4daf8c461d2dcd77857b1b9e8d", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755374, "uuid": "21e73d39-0c90-4b81-8bd5-84448cf35d82", "value": "T193619F932151B8E9415283BB3A4966FBC07FC2249546B444FB8C4F9DF9DDE633A8D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755374, "uuid": "df1f17ce-d538-4f0e-b8a6-a80213b17395", "value": "96:iGt1Z7/fuSfeFNgQfBZL0H2mAiBrVM5Gf+o:1z7kFwH2mAiBrVQGf+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709755374, "uuid": "c9ce4342-71ce-4616-89c1-78ec34f646d5", "value": 3218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709755374, "uuid": "f71165b6-ca1b-4ac5-8ae1-202ce53d5b79", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709755374, "uuid": "8c712481-adb8-4780-92b5-b7fc4532fee0", "value": "QBRTrFHa.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9648b3c2-db9f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709718896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718896, "uuid": "ab47a96c-f77d-4d43-84c5-70a4fccdb0dc", "comment": "Malware payload (Mirai)", "value": "2f58339732d1873bacf40a82c6a83ed0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718896, "uuid": "7179ab33-e2b1-475a-9edb-eb53d606dc06", "comment": "Malware payload (Mirai)", "value": "ff53a4405a6c0836c1b661d180ca17ac552096c429bf2ed72cf24dfd0528d11a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718896, "uuid": "b83f7ec1-9797-4c9f-a42b-382257ebb498", "comment": "Malware payload (Mirai)", "value": "b29368eb1a45abaae3ef456151899d5597869406", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709718896, "uuid": "b6eeeaef-fb21-4990-a5fd-20bf8ada4f5a", "comment": "Malware payload (Mirai)", "value": "3263dc438f9dd2a92b7eb141a1891b3b68e2472206949e0003200ca2530b87841fa4dd5180c670f7a19f7e73c3716177", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718896, "uuid": "75dc7b16-6d7f-4021-b63d-447546bcf301", "value": "T119C31A55FC405B13C6C212B7FB5E428D3B2A17A8D3EE72039D256F61378796B0E36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718896, "uuid": "43d09f82-7e18-4142-a96a-65bf11c8191c", "value": "1536:Jtv+s43G5bUWkwRAuSh71QAFMxK4VIGUT2yR2hO/CoA46n/txlc6wyw1FrR7PVzV:bv+XQjR9g71QNE43UqyR2hOO46/ykbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709718896, "uuid": "13919fee-f009-4287-b68a-538f08aee892", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709718896, "uuid": "abf9a6c9-5b5a-47f5-9562-220bb0c639b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709718896, "uuid": "ae133d60-49a3-4377-9b98-d042fde4107d", "value": "2f58339732d1873bacf40a82c6a83ed0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }