{ "Event": { "published": true, "date": "2023-09-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-29", "timestamp": 1696032181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "120cddbc-5799-4cab-9f5d-7b1f04bcf6f5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0822d4a4-5e96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695970896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970896, "uuid": "abfe44da-16b2-4308-add9-1ebc164206d7", "comment": "Malware payload (AgentTesla)", "value": "b39ec591ea3f21e13dca84768df5baef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970896, "uuid": "2ce0ddd0-61ea-47c8-b0e8-e3c8569fb518", "comment": "Malware payload (AgentTesla)", "value": "003569fddd9c4c72cfd68b3188ffc2700138a90212a85aedbf040e1f68f9acdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970896, "uuid": "85711388-722a-4c93-910d-c1f44afb62f3", "comment": "Malware payload (AgentTesla)", "value": "f7f3a0ba5d4376c468e21620b9c98964966268a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970896, "uuid": "cbd9511f-08c9-4882-8b15-1ae18c925b25", "comment": "Malware payload (AgentTesla)", "value": "3f9a3af44e2548fdd1bbede5778169a20863239a5a398466703fa872a34b47e880a058638c6e974da4fa4b47b5e9b32c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970896, "uuid": "eeb2ca9e-fbff-4c70-beb6-6036074a07f7", "value": "T12BE4C33C21E96A88F365D6BCF3744EFF57D5796F81ABB8B7AC4CA19305A97C04502220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970896, "uuid": "961efa39-c87e-459e-b0e4-c60e553ed975", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970896, "uuid": "af0a093d-4e87-44bc-96a3-5a2c5121f37d", "value": "12288:1G6B/wP5kypE1vc7C+A1le2iRRATPZ9Om+bMNOO/aV1yJ7v:1GY/SiypE1mYPiRcPfsfVwJ7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695970896, "uuid": "2dae4afe-909c-4ca6-9eb2-6876d430408c", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695970896, "uuid": "7d08e94e-90f3-4952-aed4-fbd8a4b1dfaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970896, "uuid": "5c7d41aa-4a05-45ee-a383-52873d82e84c", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe698592-5eb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695985483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695985483, "uuid": "ee8f0d68-c44b-4ed4-8a8a-03ccb5df4fa4", "comment": "Malware payload (RedLineStealer)", "value": "a980bdb5b5e023fe9bb2d879eb2d255b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695985483, "uuid": "67a5620d-e249-4c0d-b0a2-3d730d5d400b", "comment": "Malware payload (RedLineStealer)", "value": "005360f36d6b7bf31717fb5ba88f844bdf5455dfbd9f84894a8c1e53f7f5ef51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695985483, "uuid": "845d958d-16d9-4284-a0cb-2b1f9e4e6855", "comment": "Malware payload (RedLineStealer)", "value": "eea83c8b6819ec7e4b8b10fd51904befb8337263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695985483, "uuid": "94fc0987-3db2-4c38-9b5e-50dec9b0b49f", "comment": "Malware payload (RedLineStealer)", "value": "52e7a0d757028b6db61fd602f9bf145a53c35f0d8fb6d5acd456a6fd7e0d487f2a4f7b7ba8609c0ecbcba9205728e686", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695985483, "uuid": "094cfa6b-14c9-432a-ae12-a30716be5866", "value": "T1A2C69D21981BCAFFF84B2F77D266F774C619F418FF9021EAA14D99391D22F99860500E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695985483, "uuid": "2f217d12-b708-4e96-b1f6-b7f78abd526f", "value": "9a27b05ceaf94172ed30a41e9748fab9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695985483, "uuid": "dbdd5cc5-a4f0-4ced-aaea-043ff0aea057", "value": "3072:dveHSwh+d9yWklYTRobHJeIiSs9k6Mj4f4lJ/NVwzgypopOaQ:QHwDTRAHJJs9ktj7J/fyDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695985483, "uuid": "6d97f669-5dc4-433b-9a4f-824b56431bad", "value": 11534336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695985483, "uuid": "e560fd19-5cef-408d-841f-a7f60373d12a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695985483, "uuid": "b1704725-0899-42b7-97d3-c74613012884", "value": "NightwareCS2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbd65ef-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015845, "uuid": "36897043-b269-49b5-a93b-5f0c30dba6f8", "comment": "Malware payload (Mirai)", "value": "75efc49a4de86a195a6e9118a8624b5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015845, "uuid": "bead17c6-8be3-4b49-bf8c-b0a883893be3", "comment": "Malware payload (Mirai)", "value": "00fcfc8ae3b6fc6479bb214d3f36ce0810a539772eb06fc3487b7a8c37145f48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015845, "uuid": "69b0ce99-a503-4ae9-8822-e93833c3caaf", "comment": "Malware payload (Mirai)", "value": "8ce53713f6d3bff332679fc01cadb193cb21c89f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015845, "uuid": "82e83e5a-9c76-48c1-a7d7-246f21d63268", "comment": "Malware payload (Mirai)", "value": "5a1071f780430f4d2784c25cec1387c86a91705d78b438707c5f3bfdbb7f5ded900f18fcb433127d84b999293d6095af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015845, "uuid": "7e8758f3-dbf9-4463-9bcc-d21019819a25", "value": "T1F0B2D0B17014F8B2C7A200B75AEDDB83FA800EF8D0E873295469099DEAD5D43BAF1547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015845, "uuid": "14ae73a1-e8d8-4a3e-8066-9323a3e6744f", "value": "384:tZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3p62hymdGUop5hr:QX9nxn8o9wnBoWzEQf2EjKb3p9s3UozJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015845, "uuid": "16632369-9ecf-4d0f-98de-5b18cbf5a4c5", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015845, "uuid": "cf458305-d03d-4c75-97db-3351d2d52694", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015845, "uuid": "b052aed1-8399-4ad2-88b3-6c7986780407", "value": "75efc49a4de86a195a6e9118a8624b5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6b8b12-5eeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696007604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007604, "uuid": "8857a1db-9748-4d17-b158-dc1b711321b3", "comment": "Malware payload (Mirai)", "value": "09d0ce18afb52de44079bf40705f46df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007604, "uuid": "e1ec1ea0-29c7-4d5a-aac5-744e6f84a612", "comment": "Malware payload (Mirai)", "value": "0199a9ee0110d1a9a9b831a041474878b94dc52138d23aa3a0f09f88efe3fcfe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007604, "uuid": "1995b0a9-d30b-4c33-ba1a-ad0a807943e3", "comment": "Malware payload (Mirai)", "value": "5fc079b01967f70f9ee4094803a277aba751dee6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007604, "uuid": "ffe060aa-0f08-47a1-9014-d1d0bea82aaf", "comment": "Malware payload (Mirai)", "value": "f2976cbb407b45dd4d1993c86c98f101d0b021b68636637071f420922d3820e183e87c9a944db76dd30bdc19358b0223", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007604, "uuid": "8a7e765b-13e7-4883-ad0a-664c8a2fec3d", "value": "T19A14C61AAF610EFBDCABCD3706E90B0229CC955B22A43B753674C524F54A54F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007604, "uuid": "bea4383d-b307-4b52-b624-39f1ceabf110", "value": "3072:PUbcWxHXYyl7W/on6P4sxZJTzc3YP5FE:PUAWxoy4/onG4sfpcIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696007604, "uuid": "75a3ee59-b9a6-41df-bf43-712a3a27bc96", "value": 202544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696007604, "uuid": "a489b5e8-3e3d-45ab-8f41-a5084bb9da24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007604, "uuid": "b9723fa9-00fc-4f87-9061-b2347072198b", "value": "09d0ce18afb52de44079bf40705f46df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1972eb4-5eaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695981945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981945, "uuid": "506df14d-872a-44bf-97a3-b1a97b6e6d58", "comment": "Malware payload (MysticStealer)", "value": "ab05293845dbfcd83ad08146d5d1d96b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981945, "uuid": "018e521a-f680-4331-8312-18d7fe42b636", "comment": "Malware payload (MysticStealer)", "value": "01fd57ee221646b7caa3c143b8e26e5c0c86f6a8373976c63ca4da4badf2748a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981945, "uuid": "280c1bcb-4893-4a59-b41c-917c137e1ff9", "comment": "Malware payload (MysticStealer)", "value": "a18e3c7fb7bcfbc9615875e7781344032537ffe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981945, "uuid": "ebf6d1e2-6e17-481c-8217-25b35d313943", "comment": "Malware payload (MysticStealer)", "value": "7bcfa2a5f1fed1ad9817c44eb773d5ed3f61063d0a29ff3b8193f8e44556e9a06090adcd30f2594afc77294736644059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981945, "uuid": "8d3c2da7-cc07-41b4-8be2-b2bb834e85fe", "value": "T17E25AE213DC591B6EDE320B743ECBA3547ADD4B8071906DF06C857EED2646C27B3268A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981945, "uuid": "0f8fda75-bc86-40bd-9111-c5cbfab20eae", "value": "d215e7ae5c8053185b6f0c1eed2c8e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981945, "uuid": "96a8f285-a305-4b98-81dc-d24a1a2667ea", "value": "12288:a+2AohYZBYDKzcx9jkmP8bey7/0RDMmZZxnyUuyyujOYwapS1rB/9:a9GYDKzcx9jkmPe/knxy/9apQB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695981945, "uuid": "4421602c-de5f-402a-9dae-d2e8b0f665c1", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695981945, "uuid": "adff2119-2fc1-4081-8bf1-496479022f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981945, "uuid": "a6df0a8d-bfe1-474a-a89d-8b5444e69d0c", "value": "zor40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9c4d7d-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695977586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977586, "uuid": "b6f3d521-b9f3-46f5-baa9-d648c6e0737a", "comment": "Malware payload (AgentTesla)", "value": "ec4d6d5005020b5a5e2d4ff1797a61b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977586, "uuid": "21318621-5421-4029-adce-b1c0c4e7b5a4", "comment": "Malware payload (AgentTesla)", "value": "034cc3d5fbbc537705c747c03967c9c52cfaa04554065fd050cdd78de60105ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977586, "uuid": "bb2b9ed5-9e0b-4724-b172-27686209ec3b", "comment": "Malware payload (AgentTesla)", "value": "310f583da47de04317aa87384e8c85c0162b33ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977586, "uuid": "3eadbad5-5084-49f1-804c-8ee2a5b67922", "comment": "Malware payload (AgentTesla)", "value": "ffdaa4d01d84af294b7175b9b3136b6571486ff5320adeee1846c8574cbcc2f77a7c6aee9bc318706b7740965a2bb9b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977586, "uuid": "ec4795c7-cf79-4f11-9087-953ec46a43ce", "value": "T179358B9D321171DFD95BC876CA982C68FA60A476431B8253B12F16BC9F4D9ABCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977586, "uuid": "3e604419-6d0c-446d-b6a7-12b2e8449dd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977586, "uuid": "fa178df4-5368-40f2-ad5c-0f56fa68dfa7", "value": "12288:5aB0WWObWy9YncSJSVyC6qvHL1v2B6rJXh/MOeh/tG/HXhd/lc0K8lbZZ+Zj8Jab:5aO4595RVyIvR2g/Mj1oLlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977586, "uuid": "8065ce63-6ffd-4545-acfb-e47e2567bfdf", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977586, "uuid": "6e458697-b548-43cb-a365-422b208944a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977586, "uuid": "3b8cc8c6-10c9-41c9-b4a0-ba48f219f701", "value": "Invoice & PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f74c81-5e72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695955807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695955807, "uuid": "2f065d75-31d5-4cf5-9cfa-0281f3922581", "comment": "Malware payload (Mirai)", "value": "39be118a94b0ff2fc9b47110706f9e37", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695955807, "uuid": "878d7fe9-29b8-4504-a056-d49aa094ecdf", "comment": "Malware payload (Mirai)", "value": "04623ccff10b6eb89d2be7b15ca97dc7417f26075fc92875ed1f074bfbaeb8c0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695955807, "uuid": "babf1c66-59a8-4268-b169-52f76293d0b3", "comment": "Malware payload (Mirai)", "value": "4113d309b9f2a336b084df13a07807bb0c33ae05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695955807, "uuid": "98736e44-5bcf-4ec5-b51f-b9ba6dae0dae", "comment": "Malware payload (Mirai)", "value": "e8c8b1692aa708bb436ec5471c0b63007346ae1127a85ada350d5829daee26619d092204f65fe97e2789c4aa77e68010", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695955807, "uuid": "0f1e4cf1-88bb-4009-9b33-1e1f88b665f2", "value": "T151A2E015BF2883CBC832697495D9F5D21296FC61F2ADCC492540C15BF5A33AA6434F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695955807, "uuid": "bc48f4b6-328b-4c48-819d-3129bcccef43", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTW:M98o08kxofBE+ZkXaEbp2F2TWul0c5Qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695955807, "uuid": "7594fc54-3f8f-4f31-ba06-0be6cac6ad32", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695955807, "uuid": "f5f3b81d-b111-4da9-8eb7-5ffd5a9a6fa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695955807, "uuid": "112b67f9-a0c9-4240-bd9b-cec42a8a3a51", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8585b64-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987164, "uuid": "1a339750-f342-446b-bbed-12ffe96d9acf", "comment": "Malware payload (AgentTesla)", "value": "0751808f1900d6f44516d71d76ef6c16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987164, "uuid": "4aeeb220-18bd-48ac-bfed-16fee584ebe2", "comment": "Malware payload (AgentTesla)", "value": "0638019d83072a8f6bab02e4dc735df24d3dee3c375bd9cdbb952d1fe613b2ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987164, "uuid": "e1368af8-3d4b-41e0-bc11-a369ba656521", "comment": "Malware payload (AgentTesla)", "value": "d1ec6e727ce0186095c10b853b0010b7119e8408", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987164, "uuid": "dcb4cc51-df05-4f3f-9db4-850ae9edb82c", "comment": "Malware payload (AgentTesla)", "value": "cbb0645038c287df3464b170c7f95f639e91c1dc42655baa13898dba4ae8f274d3088fcf3a6e47d416977efccb0b2c4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987164, "uuid": "4455313e-c154-4f2b-a361-07f1f952f364", "value": "T16FF40102ABC41681F6BF72B689B5017153B7BA01993DDF2D0CCC618C1BEB691BA45F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987164, "uuid": "34df5b77-f928-4b75-9834-a092d1ab7afe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987164, "uuid": "80f05c8b-42a8-470f-8585-c4a3f6ccfc0f", "value": "12288:TcKAckjgKPgiPgttdx/4/0oopyG+UPpqtdwa6GNduecAHEAG:FkMKDgTd74CPp+WC0eHHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987164, "uuid": "4203fc5a-dc33-440d-913a-65b21b5fea64", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987164, "uuid": "905b7847-22d0-46fc-919a-ed39aea9d3d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987164, "uuid": "b19e6dee-4dd4-4b82-93ac-5180fb9a08bd", "value": "Transferencia 8113220002017219-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d1ba29-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987215, "uuid": "47fd8f6d-0e1a-4e3d-be22-5ff21db4d968", "comment": "Malware payload (AgentTesla)", "value": "2999e1062dcd434b0df8174c8b0ef68e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987215, "uuid": "025163c2-00ee-4b8c-b95d-b1b976deb088", "comment": "Malware payload (AgentTesla)", "value": "06b77c2ecdb93bee0463cf82bddb64c74c530892f20f29eadbc66d4420f1751d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987215, "uuid": "16562b72-6ef5-4e6c-a0d1-6bf2b8375aef", "comment": "Malware payload (AgentTesla)", "value": "6ee537da8d7345ccd4301357dbe0b84ea780c8b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987215, "uuid": "fdca94b8-4cba-4cf0-8eb5-41613af7ffe6", "comment": "Malware payload (AgentTesla)", "value": "9977d5d2da6b0786c4e0f66446d5dad23b28e4de0fe81e1fde691095d0fe8cbe9144920907440a9cef96913ae9e62447", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987215, "uuid": "5e7c17ea-9345-4301-8468-37179b9f87c5", "value": "T1D9F41203BBD50190F6BA227599B6057113FBBA51DE39DF2C08CC609D1BEB790BA64B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987215, "uuid": "b2b41d50-c55d-4f4c-9eb4-4767c2b1a053", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987215, "uuid": "29a1eb48-afe6-422a-a3d7-0ee5c16e8452", "value": "12288:/cjAckj5dXL6O2LG1CSbssB0dINZvjgJH9BOAMRnO/gyIH473b:Iklt2L4gsMIEJHrOHnO/gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987215, "uuid": "98ad039b-5dcf-4c7a-9f9e-e8d8590c58d4", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987215, "uuid": "a315ec59-c761-4dea-ad4c-f088c206d7f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987215, "uuid": "7184356c-2cb8-4548-b23d-3643b3ae8d1b", "value": "Tez to'lov nusxasi va etkazib berish ma'lumotlari.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e951bcb-5eb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695982074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982074, "uuid": "e038be11-8f60-4923-94d7-e3c7d11f47cd", "comment": "Malware payload (AgentTesla)", "value": "8a8289752db8ca75e50788c7ce1b1e80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982074, "uuid": "02cd3349-4f66-4f9a-a591-1e7668537a37", "comment": "Malware payload (AgentTesla)", "value": "07464dbe8979eeae7ab51b558312c9add719f420ea076a88f77903860deeeabf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982074, "uuid": "6a2f5423-fb1b-45c2-9f6b-bb4b9abcfb87", "comment": "Malware payload (AgentTesla)", "value": "dee08cb992314605730d2bd0c802ea4917e8eab5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982074, "uuid": "aae3603e-4811-43b4-b9db-b0088250936d", "comment": "Malware payload (AgentTesla)", "value": "eb2a376e2950bd7b7493dcf7538a9e6dca1f5d8583e006a212aad8ee82ae1bae2fe02c437ecced80757b06a85fa6ce44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982074, "uuid": "55a331aa-c15e-4a68-bbd0-ba3271300397", "value": "T12283256DD78B02688F5203769B5B0E84A6BDB63EF35255B1302C933533DAC3D52262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982074, "uuid": "93190664-0657-4452-aff6-614d30d43c1c", "value": "768:YC7Wq0BiIsxPpwkWfYjugztCUlkXba1C/0gTNIlZhvFQCYcaEmkfv0G11:YC6q0BnpP4ugzxRgWrh+HcXtvn11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695982074, "uuid": "52c16cca-d08f-4217-9545-b719b464323a", "value": 85806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695982074, "uuid": "a98ed81a-a8c1-425c-80e8-2e70801985f0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982074, "uuid": "5bbcf73b-4996-4dae-aeb0-c8ab50be4af7", "value": "file.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e598eb53-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695977281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977281, "uuid": "677d0452-2cc4-4bcd-9b3d-aaa083554c04", "comment": "Malware payload (AgentTesla)", "value": "84d3eb45f1ea15290edd4c40af005656", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977281, "uuid": "459e2a35-1653-45fb-88df-8a65f148491b", "comment": "Malware payload (AgentTesla)", "value": "0802764e9152d0850b10d83d287ea83b6eb2654daed62d255803712f02fc0084", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977281, "uuid": "9b1e1af4-434a-41d1-a3b5-c7bf2b05d34a", "comment": "Malware payload (AgentTesla)", "value": "0f092118064f45a43a9528d0cfd207f60bae65aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977281, "uuid": "43e7b4c5-1a4d-4337-a9f5-8f6a8e7b5272", "comment": "Malware payload (AgentTesla)", "value": "b22d6fe6737c1f58749c8bee9d34ecca57d4ee67832e37fbd46cd8374fd0b6b4e35486c7047457ad5eaf4acd937ff891", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977281, "uuid": "f1e1ea2c-a640-4952-a1d0-39b69b0ceb56", "value": "T1A855DF65942964B9C7FB02374653D64428B85F8DB81FAF6D6026BFE23BFE3C22401D52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977281, "uuid": "8ddc6c21-39a3-4b13-b4d0-98225d1da06b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977281, "uuid": "06298491-deac-4e2c-a0ca-40c9d1bc9402", "value": "24576:qZTgNqg2CeDQ28rWgPamYVVN3LKF+8qRJg3ObFzPHY57DlaufYdTObyY:qKNqFCn2sLPamg10+8O2YjHYjaugdMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977281, "uuid": "1ecb4d26-4962-4782-a152-32d5239c5ee3", "value": 1371648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977281, "uuid": "8ba4c5a4-e9f6-4057-8bee-15f342e9c2cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977281, "uuid": "dc0a7803-d8fe-4e80-8120-1f1a64d3b9c3", "value": "84d3eb45f1ea15290edd4c40af005656.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cd074d-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977119, "uuid": "93318b7f-864b-49f7-8497-33cb290c3b50", "comment": "Malware payload (SnakeKeylogger)", "value": "018ccb52b75e10cd4a45aa22aa7b2342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977119, "uuid": "72f3710d-3937-47b3-9878-649b8d0c8a37", "comment": "Malware payload (SnakeKeylogger)", "value": "085432a1c99fa59ffaf3838e1a987e17df690bfd19fe6ad001ee7d9d6fba3eb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977119, "uuid": "ec764209-9f72-48d4-8936-676439899e72", "comment": "Malware payload (SnakeKeylogger)", "value": "7f0033b4a3958e14d1959555bbfbd58e667d460b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977119, "uuid": "16655ea1-0ab9-4764-8f46-27d8b80a4018", "comment": "Malware payload (SnakeKeylogger)", "value": "e1a0c6e54274b1baaf7a6fcdd2aad6d497548271ab593b59421a53722054225a6e2e1a5d7164f5ce223c6bdae5cbbfce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977119, "uuid": "aa2214ac-f7db-40e7-bd19-84b1a6f66d30", "value": "T1536413E12770E8FBDA3119B25D3516136BEBB41A30658F0B93503EEC7C626B49C5DA23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977119, "uuid": "b475b5e7-1592-4d5d-84cd-3b067b049c7d", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977119, "uuid": "282dc32f-f835-4c4f-9779-226ee2185d14", "value": "6144:hnPdudwDvX6XTt3LWygobl2qgZbyWI2ku6nQ+i1ic3OYBsXA7L:hnPdj6ZKygjq0IZnK1wYMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977119, "uuid": "5a44abf2-6484-4527-9d65-d1ebc0e50d82", "value": 312048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977119, "uuid": "6101c196-4589-4d42-9be4-0a1c5b1bb3ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977119, "uuid": "0b7c0ca7-96fa-4d81-96eb-c14f417be29b", "value": "018ccb52b75e10cd4a45aa22aa7b2342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf60bdc-5e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1695974393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974393, "uuid": "0d663bf6-9c7e-45ee-8c76-26fb35ac05ff", "comment": "Malware payload (RemcosRAT)", "value": "340596efa9f427602ac8193d73976c06", "object_relation": "md5", "Tag": [ { "name": "AntiCrack-DotNet", "colour": "#C525C2", "exportable": true, "hide_tag": false }, { "name": "example", "colour": "#4A820D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974393, "uuid": "df70aeca-fb22-4e94-a487-0152e128e459", "comment": "Malware payload (RemcosRAT)", "value": "08d6b6f72775e23311bb86777e01831b95a14b6810c2b5504b28b6d182ae1023", "object_relation": "sha256", "Tag": [ { "name": "AntiCrack-DotNet", "colour": "#C525C2", "exportable": true, "hide_tag": false }, { "name": "example", "colour": "#4A820D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974393, "uuid": "f847ee66-adaf-40aa-8bfe-7cd94e09ab9b", "comment": "Malware payload (RemcosRAT)", "value": "aff25b3ccdde8163e03e2d6caeb95f0f90419bc1", "object_relation": "sha1", "Tag": [ { "name": "AntiCrack-DotNet", "colour": "#C525C2", "exportable": true, "hide_tag": false }, { "name": "example", "colour": "#4A820D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974393, "uuid": "cee63430-226e-4f41-9ba8-fe69cb406d76", "comment": "Malware payload (RemcosRAT)", "value": "d5d7ca39f02535e54e29f009d862ba4dd8691e74f035e0c2d63f139e8b331519c3d4fcd693d1f6700cb12a21ee927d06", "object_relation": "sha3-384", "Tag": [ { "name": "AntiCrack-DotNet", "colour": "#C525C2", "exportable": true, "hide_tag": false }, { "name": "example", "colour": "#4A820D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974393, "uuid": "e55c7754-91e1-417e-b740-6c4f4619a737", "value": "T1EB73F7CCBBF5FE56C65A5B39A49216403F3DC19B3A16E3971998083E4C6A3DB7D08843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974393, "uuid": "585ec4d3-c27e-457d-b5aa-459d869da542", "value": "1536:8cYiow0mnptr3OSZlJZvUWPQL8AuotArAPKV:Z0mnbDhZlJ7ZLOiAPKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695974393, "uuid": "3205fa65-4584-472f-8b31-bbbcbf3b180c", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695974393, "uuid": "2f80c215-447d-432a-9e34-d12e8e410700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974393, "uuid": "e2849614-fa4d-4373-bf19-d64bfaec2673", "value": "45.150.67.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8f6560-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696010310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010310, "uuid": "744cf8b4-b5e2-454c-bcaf-d8498c521dbd", "comment": "Malware payload (Mirai)", "value": "08a81aab9d5f3e8148b70e666acda429", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010310, "uuid": "a9a4ee15-33d8-442c-af03-e4df14eab319", "comment": "Malware payload (Mirai)", "value": "08e560d77e2dfe44c196d31006d4f1ffdd4a2bcef63bf0fa182958948b85b0ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010310, "uuid": "911e5e12-3bc0-4436-8082-2184a3f99c7d", "comment": "Malware payload (Mirai)", "value": "712bf7b781f3d12ee47b352a897fb856fbdff008", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010310, "uuid": "69c61e78-4ece-483e-9b63-34884bf40d52", "comment": "Malware payload (Mirai)", "value": "d35b89edc8c269ef8ba929d7fa4298dd5c40a3d723cefe0ad4beddfca93bc69404cc60e919b1545ea144e82431491f7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010310, "uuid": "18b2d089-732b-4f0f-9f57-d9adef08275c", "value": "T1EE43851E6D168FBCFB59863447B78E219A5833D627D1D642E16CDA002EA034E741FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010310, "uuid": "c4901e52-1d22-479e-a99b-6b2988c86a49", "value": "768:bvaLxUxyQpPT5rhmu3rFtmmSnoh2Lt3ug+j1EZi0e4fyMnup//dujgtywjz:bvJFP1jtYF+j1x0lk16gtLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010310, "uuid": "383c0296-951c-48dd-8b7c-c1ce809df338", "value": 59768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010310, "uuid": "c3a89dfd-e40f-4128-b2b6-cea3db07ffd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010310, "uuid": "990b5b38-a48e-4b5a-8d49-177a80259c48", "value": "08a81aab9d5f3e8148b70e666acda429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8daebcf3-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986582, "uuid": "aba320e5-1163-4b6c-811e-54c445bdbb3f", "comment": "Malware payload (AgentTesla)", "value": "ffa36ab31490ed8673cf0a764533957a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986582, "uuid": "4cd1a579-75b3-41a8-bfa1-461665136fda", "comment": "Malware payload (AgentTesla)", "value": "0935f662f94abce86c36498625b8623d4e37dd790394ae78a6cd8d33b71707d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986582, "uuid": "e65abdbd-a968-4360-969b-448c1a5d1198", "comment": "Malware payload (AgentTesla)", "value": "ff1fac0949253aa6702ac699da51a3063659ade9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986582, "uuid": "f6b2081c-b66a-426f-88f5-78551059be0f", "comment": "Malware payload (AgentTesla)", "value": "f4816ca0243f94b1f402ccd51207752be546b0eb458df58b2275e10a9bb1fb9ef83b9aa490bc42aac2e6235384cf2c47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986582, "uuid": "2c747a65-f7c0-43eb-aa8a-8c26388598cd", "value": "T19DF433CCB4845C1C811D1A75B5AACC7DC7F9310867A5B3A8ED7D000E5BAB9E672AE703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986582, "uuid": "5d7dba06-b360-4544-88da-20365d0b0869", "value": "12288:WMnWQKfeVGzd4pNHBIJyTYN5jvK6o77xKomvPEI91P9l95gUV60KQle2RggVV+Rl:vWm+dAjiykSXv+/zF/oQoAgM/XJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986582, "uuid": "ce5cf1fb-2f7b-4733-b814-01fac65761e9", "value": 760118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986582, "uuid": "bb13088a-3096-4623-98ac-6d853bf8c482", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986582, "uuid": "714758b7-7f72-4b9d-b26a-c666244fe64d", "value": "PO90502.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c705477-5f0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696021155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021155, "uuid": "ceb33855-8768-4717-8e04-7f03460b2be7", "comment": "Malware payload (AgentTesla)", "value": "f3171656c08ce2ff0d76b6c6a6a9952a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021155, "uuid": "e7019768-c9b9-45d5-a7b7-00113b1c9c10", "comment": "Malware payload (AgentTesla)", "value": "0958695f2488c982acdfc6f3c7cd57675c88e9ca7f37d870d08da0a77b7286ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021155, "uuid": "d6710960-4f46-4956-895c-2db7ef99a15e", "comment": "Malware payload (AgentTesla)", "value": "933d932b45f8159ec6bf54f8ae796f9cbdf3efeb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021155, "uuid": "db5d971e-aa93-4bf5-8105-9a358e6fc9a2", "comment": "Malware payload (AgentTesla)", "value": "7bb5ff68ff3d0a95abca4fab403631a16808cfd8c5dd2064aa01f3a00836bcbbdb6323936aab7f7a96e162e150bf073a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021155, "uuid": "1bed9d0d-f21b-46e0-a586-e3cce4da4340", "value": "T117455A42A413556DE55A3232D052B71C8660CFF95D3BEB0DBC0EB29E86B3B935C39683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021155, "uuid": "8e5e4635-97f8-420a-b57d-ae7e709f9b7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021155, "uuid": "233b118d-7f2e-4c65-bc2f-5d30fbe6c70b", "value": "12288:jeH0RLamVPcvWX1DThnbPKmM5DtfoAe8cESenIBglQ+A4K:C0PPceZ9ideASenTQP4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696021155, "uuid": "3301aee9-bca8-4581-a82c-f6e658107bb0", "value": 1213392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696021155, "uuid": "abcaf0bb-6bdd-46f3-a6d3-9f9b58dd48e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021155, "uuid": "348bf662-34b2-4451-b021-9f486f810911", "value": "ORDER LIST_SEPT7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f5639a-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024238, "uuid": "e54af465-cd9f-4559-ba0b-b7e8d2bf2171", "comment": "Malware payload", "value": "d40a4fb6a8e84a34cc4af676899bf29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024238, "uuid": "f27a749a-113f-42f9-ae51-e7da3ee9518e", "comment": "Malware payload", "value": "0a05d590332a705577ec64ae4073bd8e65a8b06179796e5b78f2ae4cddf52e64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024238, "uuid": "8164ecc8-e720-430a-9f95-69f15fb4c992", "comment": "Malware payload", "value": "77d429fb9f1976d8bf959554d59964108d759381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024238, "uuid": "a77644cc-1491-4062-bd56-2dff2827e4cf", "comment": "Malware payload", "value": "01a6efde4e833aafdb011e10ecff619e3d7e05dd2ed161f66be7b8d9a59896e04966091356367ad9f2040498c0cd87e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024238, "uuid": "fa237fe6-f786-4684-beba-9f76b7c51c56", "value": "T14E34232E5829E073FCAA999E23C15C03C1D01173C99551FA46D2C63AE760CEEBB947F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024238, "uuid": "a23ddd9e-dc6f-4395-892c-02c7e78cb978", "value": "6144:znnPN4/Xjac2JGCyZy31HcsVph1MvrTXfny+2Sgi:hoXjX2JG431HdCvrTXP2Sgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024238, "uuid": "2c796455-c6af-4074-804e-d958ddf6d8df", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024238, "uuid": "d7439743-1e80-4cfa-8d35-ab84c67b5903", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024238, "uuid": "a6ff98b1-6f97-4458-846c-6d72eb2c01a9", "value": "288312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8985be60-5ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695978844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978844, "uuid": "2a784de4-778a-4899-a3c2-aeb06f1224b8", "comment": "Malware payload (AgentTesla)", "value": "3c4bd68faa66f240ca271fc923d5a0d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978844, "uuid": "6c2884c3-ffe9-4725-96ab-fca489bd7b8e", "comment": "Malware payload (AgentTesla)", "value": "0a786523fc26b5053c9b4865ea982deb84c240fbe6203b5fbf4ad3926cbbd24d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978844, "uuid": "18af0ce3-fdc4-491b-8c4b-807c725fa0ab", "comment": "Malware payload (AgentTesla)", "value": "12e276e13bd13c5dc5d206132c126ca4b03f4095", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978844, "uuid": "d20a0bca-844b-4d5b-a985-7f349da47579", "comment": "Malware payload (AgentTesla)", "value": "8a99bacfb6341bf48a3d41e6237489aae5c25433698b6978279582b28d982b14c23f2d2e04c34811a5938e15b683e673", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978844, "uuid": "cceb06b5-619e-4826-b47b-3092f360a7ce", "value": "T1A0B413E87AC287F2D80D9375269C12AA43B07920D211D7BDC99A75DB0A323B46172F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978844, "uuid": "2fb7b2c2-4141-472c-9925-634705dbe3b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978844, "uuid": "b7f10283-e1d3-4c51-917a-d85f21628d53", "value": "12288:AT725Wzz28Vd1A6nIQGtzhrEOPbmlpIB0KwTywu:jHed1A8INBmOgpIB66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978844, "uuid": "2f580d69-7a3c-48d5-9098-8b6a7d6272e8", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978844, "uuid": "3debee40-6c2c-458d-80fe-0193596c2ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978844, "uuid": "d5c30220-0c86-4b9f-9ed0-b6ac751a2f43", "value": "RFQ Ansch\u00fctz BOX-PC RADAR 950-014.NG007 KD-RAN-10011 REF NO 231218-SP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ce51ba-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987507, "uuid": "97c1f2fa-12f2-42ae-8d84-1722a7857291", "comment": "Malware payload (Mirai)", "value": "ed55eb852852db480217cfadf5122b8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987507, "uuid": "b3cc72ce-a233-47c2-8ca3-2d458e88fc88", "comment": "Malware payload (Mirai)", "value": "0a7d9ee24566c03c04913c9a499fab0ee2729d1289843673d72bf716c5b508eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987507, "uuid": "05bf020b-57b4-4685-b791-5232dcd9c7f3", "comment": "Malware payload (Mirai)", "value": "48d4f6374b5aaa5c0d51cb114822f12bee919bc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987507, "uuid": "d7a84a5e-97d0-430e-8d98-b30429540c1e", "comment": "Malware payload (Mirai)", "value": "30f1554bc0a4037cf83a784075d6b4d2f83d73569c1b0a60a49b72db2b1c84957fc4d574c49d2bf286de399b1cafcffe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987507, "uuid": "ada3bfac-bbce-4485-922d-fdc8f0b5997d", "value": "T160834C20A97D2E26C1D0B57F22FB8315B2E2270E26B4965D7C760F4FFF2464068572B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987507, "uuid": "c681e04c-48f9-4e2d-8ac8-e15d16552cd9", "value": "1536:49eb2RVvTRssZva1/2ncGZcq7x3axNcFFhzki6vFf3fAfiqFtyFFp:ch+NcKvFHAffFtGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987507, "uuid": "bc763f13-67e0-442d-899d-1667a9f1683a", "value": 82764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987507, "uuid": "220ea105-e0fc-46ba-8c32-cc31fa840b9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987507, "uuid": "af1a858f-ab82-4b96-b37b-154a9d2e16d7", "value": "ed55eb852852db480217cfadf5122b8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc46771-5f05-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696018954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018954, "uuid": "f83567e9-eb81-40c6-b1d3-a436918dfbcc", "comment": "Malware payload (IRATA)", "value": "4b737c8355a7330854fc7d0f7417b49b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018954, "uuid": "f5175e66-2a51-40a3-b78a-dd6e7c25c4f0", "comment": "Malware payload (IRATA)", "value": "0aeac137dc1c146c79a369ffa19f48870f0b0e7ed91aba9a088c6b9e514b0083", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018954, "uuid": "3c188437-f8ac-4557-954b-634b7fb016d5", "comment": "Malware payload (IRATA)", "value": "b25e7c5b1ea931bed5719e7a24853e9649dd6628", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018954, "uuid": "20a32f25-63bc-4e25-a75a-f70bbee7999b", "comment": "Malware payload (IRATA)", "value": "81eded4a463b289147c2d34d3da69ffea2979914dc542a5376379eebc9a1fc42cd69a7993efcbcd3a6032a44dd96c2ae", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018954, "uuid": "f05b8c04-ce5b-4281-ac2c-cf120869139c", "value": "T11BE59D97F395A86BC4F38372817613A5518B4C228F83DBC76D28767C29BB5C41E49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018954, "uuid": "dc9ac262-b1f7-4da9-8145-43a2e55efdcc", "value": "49152:/T336bJCTOgLCrgPYvS3jAsxfM7jMpE5IMuER:/T336lgLCrgPoS38LE0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696018954, "uuid": "e9a484c9-ade4-4718-a430-9f34debe3804", "value": 3296135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696018954, "uuid": "3cd364eb-ceca-492a-99f6-50fe3f03d102", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018954, "uuid": "74d736d9-a813-4b79-ac21-5321071477d6", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f8dec0-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986590, "uuid": "2ede4026-434d-407a-b54a-60038048c20b", "comment": "Malware payload (AgentTesla)", "value": "5edda4e170c74a69835e8bd822c51803", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986590, "uuid": "9b048716-004c-4630-b6d4-87984376ea5c", "comment": "Malware payload (AgentTesla)", "value": "0b8fa64ce20b4cedd71c6e36261052f0ac8948ea296c6ada5791c90d563c7e6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986590, "uuid": "ea5bef51-f2da-4928-bbef-075906e686e3", "comment": "Malware payload (AgentTesla)", "value": "daf25f4e5eff37fe7677ce3139b0042a3ec5e236", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986590, "uuid": "2fc274ad-d6f7-4d8e-bb2b-4055d187bfae", "comment": "Malware payload (AgentTesla)", "value": "4a363dc91b559581cc79a533d0e85eff8de07c150f2bae707369591645fc4ba204009fafff7b00eb1a0586d7edd6cdd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986590, "uuid": "781a3415-ebf4-4c36-a7a7-1c9e0ff61ea0", "value": "T1FFE4233F961A82BC909F718B2BA9E51473C537DF737109097852D04C6B8F3AAB80E587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986590, "uuid": "facd7161-90e4-4daf-9836-30e1e69596eb", "value": "12288:WTaUMotvoZmtEEPnBu4fYbHI4LXP+FEXpH1YUyKgOm9oQbvs6:/UNEsnBu4fgIm+FiVYUyKgl9oQTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986590, "uuid": "7728d861-168a-402a-809d-2c4da4240ec2", "value": 682144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986590, "uuid": "d7aded4c-57ce-441e-954c-e241d3de3eb6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986590, "uuid": "dd886647-8950-4263-938a-76cba0a0100b", "value": "Yeni sipari\u015f _TR-WJO-27-09.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad108bca-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977186, "uuid": "81863d74-9091-4d5e-adce-79f109eef7cd", "comment": "Malware payload (SnakeKeylogger)", "value": "865281a9b94d502bc3c12cb4e7e861a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977186, "uuid": "4aa48568-2b25-4503-ae90-8a9b949dcc7d", "comment": "Malware payload (SnakeKeylogger)", "value": "0ba7c10b9a514f623f07c1c49b4fbf3b4c97c1c2d4a2b8623b98a8b77cdd4718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977186, "uuid": "d8b2445d-1e91-425c-93ff-401f53d535f0", "comment": "Malware payload (SnakeKeylogger)", "value": "9116de5861f97e7a2bdbc60e84ca4ae668b0ac6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977186, "uuid": "9b5eb387-e80d-44d7-9d23-a6dada34574a", "comment": "Malware payload (SnakeKeylogger)", "value": "f0166a51878be6cd6e6e9f7826c4bfed72b1bbd01a16350a5b3ffc0d6e6516afcada98d8785a553ed6b32ff7a6fc25f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977186, "uuid": "4df7ed30-81d6-4ee7-9e1c-29724a1ec7c1", "value": "T16FE4022076FE0B5AE5BE8BF544214A0947B670AA341AFB4C4CC670DF12B1F81C755EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977186, "uuid": "14d234ce-b4ed-4c78-ad65-f9f809d168be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977186, "uuid": "3350ff21-4c80-4fb1-a7f3-a1caa094d5d7", "value": "12288:17eyiRJU/Wc/nKWPvfjrZmsY+igCrnO/dy/6tR1qiJtcMZesHqSe/0:pFFeOBPjr5iXrO/dyS1q29ZesKD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977186, "uuid": "e8f13144-c4e4-4fc9-9bfb-476711e813d9", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977186, "uuid": "a3681a05-4f04-41d4-a58a-df329cb3211f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977186, "uuid": "5687ef75-77fd-445f-88d6-74da37840a7c", "value": "PI for PO04182.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acac31ae-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696010257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010257, "uuid": "22b4bb24-6b96-4131-8470-641968ead47a", "comment": "Malware payload (Mirai)", "value": "0ea0f0cf9c7dabb225ee56cab6cc85be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010257, "uuid": "7e98dd02-8d1a-450c-8deb-83db792d739f", "comment": "Malware payload (Mirai)", "value": "0bab95b96eb35ddf016f508e341d742ffa8101b0319621cb1d5d0f33e7959ed5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010257, "uuid": "86b4bafc-476a-41dd-ad8f-3ddfb9d40513", "comment": "Malware payload (Mirai)", "value": "52ca08e477820fdffa6a31cc90196d2495b23e46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010257, "uuid": "ae2ae286-49ef-42b5-ac78-7a6e06348dc9", "comment": "Malware payload (Mirai)", "value": "de524011222f5c6599d38911a2727158ba935385ea52eaa27901966e1a671bd09b5f0d9b9e248b68356550d9defa5b4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010257, "uuid": "ffbd808e-a954-464c-b8ef-a7273024dc2e", "value": "T1B5133C42721C0F17C4A35A70253F5BD087BEAAD032E4F285665F9BA68A75E371482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010257, "uuid": "9f6ddaeb-c8a9-4bcd-9f3f-5aedf913adc3", "value": "768:g40J4bzio9RfQRW0qRGQ8Jt8hTVsBWltn2susHzFuMtdW4dLFrwZ:70JOC+QqhTxxjEMtdFLKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010257, "uuid": "321830af-a0b5-42e9-bf38-dcb3a146d281", "value": 43780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010257, "uuid": "58fd8980-e35a-445b-827d-653b7174060c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010257, "uuid": "607c4fd6-6f2a-40d2-8145-0868da3cdb23", "value": "0ea0f0cf9c7dabb225ee56cab6cc85be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5707f83f-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987350, "uuid": "78a6691d-51c0-4d31-b2b1-1e9ad716bfbd", "comment": "Malware payload (AgentTesla)", "value": "19dcf8912bf618f99ed2b14a218abecc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987350, "uuid": "1632d63e-e551-4cf4-8045-8e9d8f461acf", "comment": "Malware payload (AgentTesla)", "value": "0c5191bdd545d9c2abb7809fa5a342adcf3e766bc4c4e320f5799b4430bbb203", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987350, "uuid": "e4884133-2ef2-4e9d-9454-8e83aac382f6", "comment": "Malware payload (AgentTesla)", "value": "a2e8338d121835e40707f62b794a9303c88ac615", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987350, "uuid": "709129c5-14ff-490f-a53d-98f479d5243a", "comment": "Malware payload (AgentTesla)", "value": "f9a97c2da88748a0e445b4a4b6c557af560d20cdea967b032e35c614d7d4dcaf7cbce7df69554b0961dfa2140c993467", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987350, "uuid": "3a69b36d-ef2f-4331-ba47-0b122f81ca90", "value": "T189F402016B921591EABE73B49DB6013103B77A62DA39CF1D18CC60CD1BFB691BA01F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987350, "uuid": "5689649d-38e7-4fc8-9bf2-113bf9740037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987350, "uuid": "bf2b49bc-e163-4e7b-888a-4957a266a331", "value": "12288:ycDAckj98RyVyXQEnq2jBUQj6ByMsHTzPHtH1DSxBEMPdzSd:fkuRlXY2uQjLMEzPHZ1DSxZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987350, "uuid": "b6ef8c2c-9d45-4a03-ae26-ea3ecfb82ff7", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987350, "uuid": "e81a3237-ca85-4529-8afa-52ef14422eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987350, "uuid": "105751a6-c5cc-4990-9d01-0480105f3b47", "value": "INQUIRY FROM ERWEKA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7e223c-5efd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696015516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015516, "uuid": "5dc96ccb-50d9-4e68-9294-5356d4c45c87", "comment": "Malware payload (RedLineStealer)", "value": "05e7c2f98cfb59cda7a1229ced9a26eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015516, "uuid": "c9238604-2e47-4843-88cb-d5870941e15f", "comment": "Malware payload (RedLineStealer)", "value": "0cb977d41f3be38b80f94f0aea4115f6244dc91e5178cbeb5724bf7af3addb7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015516, "uuid": "b22bd59b-d976-4c2e-a5fd-c582d784a598", "comment": "Malware payload (RedLineStealer)", "value": "b65bca239f621cfdff408b968198b0ca3ddaf139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015516, "uuid": "2b8ad9f1-3dc5-4efe-a107-235ac2d485c5", "comment": "Malware payload (RedLineStealer)", "value": "7d8d506827a3ee2f95b145eae7c92018bf5f4caf911b04ddab07edee68a5874343632d3b190e1a81b4c8979ec891fe5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015516, "uuid": "475074be-4b00-4dbf-a939-60bee3a5f8a9", "value": "T12F34AF11B4E1C472DC7225360AE4EBB95A3DB83009915ABF67E40F7E8F34281D636A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015516, "uuid": "667d7797-2afd-4137-9589-7dc9713a917d", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015516, "uuid": "45698aa5-f8e3-48e2-803f-7ee8856bc631", "value": "6144:fu07dHH5YhBWPGmoQz33/g/vZAO4+EeYHs0BC+:9NZYhBWOQAxaG2s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015516, "uuid": "cdcf145d-49ef-4bf3-800f-d0b49c590d1c", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015516, "uuid": "b3b78acf-b022-4407-96e7-576109f80abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015516, "uuid": "d73969e8-2b50-4d0e-8d20-f8a0c9c1d6e3", "value": "05e7c2f98cfb59cda7a1229ced9a26eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfea91b-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987413, "uuid": "c8532160-9f13-466c-83b9-bea4a59752be", "comment": "Malware payload (Mirai)", "value": "ed81a0ba1b903212322bbec419ff9741", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987413, "uuid": "c190e4a4-994c-4402-9236-c021c859d20d", "comment": "Malware payload (Mirai)", "value": "0ce6cd55631749f1a143cc24b9bc7397fbc9d3c84445f3acdffbe621c93aa2e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987413, "uuid": "ce0a8737-dcd6-4fd7-bdaf-ae15fb31096a", "comment": "Malware payload (Mirai)", "value": "ccbccd293a9931933747e722eef9e285f856116b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987413, "uuid": "b505f6bb-65c6-4d2b-b71f-aad9d609d19d", "comment": "Malware payload (Mirai)", "value": "fc69178dbd9d30d62c9619862e6689dca95cb6f8ce13aa4018bd7c0e478d9973d98edc93a3156b800958127008d16840", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987413, "uuid": "1700ce86-acd2-4d06-a873-aec1e7d95693", "value": "T1A1B2D0717015F8B3C7E500779AEDCB83FB801AF8D0E873291465099DA9D5D42BAF1207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987413, "uuid": "0347c41b-e434-4480-a509-c394f7334c90", "value": "768:5X9nxn8o9wnBoWzEQf2EjKb3pp8Ms3UozP:5tn+o9wjfBAZ6JzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987413, "uuid": "594f9915-9016-47a3-905b-1c809baf2dd1", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987413, "uuid": "d646f2db-b9ea-4192-aea8-92239ab08750", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987413, "uuid": "fe2fd7be-7496-4c5c-8408-143589ada196", "value": "ed81a0ba1b903212322bbec419ff9741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4f8378-5f17-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696026659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026659, "uuid": "6ffd36f9-ecac-4c42-bb63-0fcbc9b514cc", "comment": "Malware payload", "value": "31840c1807be3b4360a84003481f603c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026659, "uuid": "e0679910-91aa-45a7-b758-39f84599921d", "comment": "Malware payload", "value": "0d39a22e45534948580c93b143d37b56ad02705661bcc8b94dcbaae99cc22a4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026659, "uuid": "7887709b-be27-4357-9e20-4b9e9084de07", "comment": "Malware payload", "value": "65d11cac02aa3312fd0db4e3f8d284f14740953f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026659, "uuid": "e68c1629-1e85-4370-aded-0acebfcc52fb", "comment": "Malware payload", "value": "fff2976e90cf847528f3222700e5f725bb2bf5b3544f1a53c6dad45ad41546ac6f020edab9395bdbb31cb51b6ee32525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026659, "uuid": "0a0c0525-4c23-4b95-91d0-67961e4a8c57", "value": "T188557B239280223FE8578B3B742A42567C2AAE5236E550874FBCFD5C1FF61C075B2AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026659, "uuid": "08fd7578-92ed-4524-ab28-694f990f2ba7", "value": "24576:joCSlR7AOBe0qIBSSzLwRrh9wymulLQMDNmIXT:sZcSzLghuoUIXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696026659, "uuid": "afaef67a-1f0a-4458-8d6b-b625aa3c6488", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696026659, "uuid": "9b7a327f-3057-4ddf-845a-b4ce979cac75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026659, "uuid": "a3f5caa2-653b-4498-8c0e-2e3083c6de3e", "value": "SecuriteInfo.com.Win32.Delf-THP.1208.16543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb1a317-5ecb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695993968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993968, "uuid": "c65b4170-5810-40f7-9991-bd8afee544cd", "comment": "Malware payload (Smoke Loader)", "value": "f78b0f3ccd0728997ce4aff0779bca99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993968, "uuid": "1d1febab-63f9-40f8-9052-39811c34bcf1", "comment": "Malware payload (Smoke Loader)", "value": "0d6d48eb967e5e3328ac8bd80dbd0797169feeafff9ec742a60d8690a146f02b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993968, "uuid": "08998106-72d1-419f-8117-2c23209d5a32", "comment": "Malware payload (Smoke Loader)", "value": "e3882f274720766fc9fb687bce77013d22f0e729", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993968, "uuid": "76cc8a90-1dfe-4032-bed7-28adbcf58610", "comment": "Malware payload (Smoke Loader)", "value": "6e8d4da3fd227830f88da932fba2061e42a521b385098bc02e16f09f54343f9fc9d0daf8d6c78b8dceeba39050b397e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993968, "uuid": "b9789001-01a1-4a97-bd8e-a4585f65e886", "value": "T17D34AE03A5E2BC60E5674A758E2EC6E43F2FBD724F59676B32145A2F08701B2D2B3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993968, "uuid": "db2b993c-68ac-48d6-8f70-40bdfa45d962", "value": "cceb1c098bb76547116fd8d11380b21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993968, "uuid": "a75968a2-1d5a-41cc-bf0d-9ce6fa418ba3", "value": "3072:5XjPEU7Jp4YLajbmPH02aPYhGGwurGD+L0NWqGYR7N7h5m+ypDz1Tvskt:dQUwYuv+a0rG6UW87wvpDhTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695993968, "uuid": "3f0531e5-2d73-49b9-b5df-3d6c5ea19149", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695993968, "uuid": "cc78fe8e-4bfe-4d4b-8e08-9f24ad05527c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993968, "uuid": "39efee43-d8b1-455a-b462-4eccb2948d28", "value": "f78b0f3ccd0728997ce4aff0779bca99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc3649a-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977105, "uuid": "bc2ac59a-5d9c-4217-ad23-b07fe235ad43", "comment": "Malware payload (SnakeKeylogger)", "value": "9336e1b94359080686ac7d96212cd60c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977105, "uuid": "28315294-12b1-4165-b245-ae19ecda5cb3", "comment": "Malware payload (SnakeKeylogger)", "value": "0dd0c3082323a331ad2d5d36f5f7f3ac11826772077df7462da3229525d97862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977105, "uuid": "6241c2a5-0f97-48bd-aa38-a9688d03d69a", "comment": "Malware payload (SnakeKeylogger)", "value": "8cccdb6b4fbd9eee8ba4fe398c32da41f160b6f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977105, "uuid": "bcba0bf2-52aa-4cee-897b-f0198b547dee", "comment": "Malware payload (SnakeKeylogger)", "value": "3c5e56bf474ddc6a4c5895399ef0bf4f03f88443278e2299575e2be2559c5048e472ea5d7082a4262bbd313e7d5b805a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977105, "uuid": "640bb92b-e14a-4dab-91d2-fea3a22d8e94", "value": "T1B5A4AE50B7949130D627C7BADC64F4329E3A7E8A990AC50F7DC43EAF7B31B467620126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977105, "uuid": "623639c8-c164-488c-835e-c5cae4e6b878", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977105, "uuid": "34d0e633-3bd5-49f4-9f82-91a7ebeabfed", "value": "6144:Rk5+kbkZJ0aU7BfOp+1nRReEgNac8E9baVa0+f9g819Ri9WFYop10:Rk5Zki1pPOocCVax919RaW+w2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977105, "uuid": "db429da2-6f23-4012-b858-ab58ee75abb0", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977105, "uuid": "f96b0d70-f1af-4532-b34d-1d07a52da8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977105, "uuid": "df51f233-dd8e-40b3-9d63-4aaaa7c2d086", "value": "9336e1b94359080686ac7d96212cd60c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008413e3-5eb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695982051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982051, "uuid": "4b1aaa5b-e06e-4b6c-ac50-135d388d1ec0", "comment": "Malware payload (AgentTesla)", "value": "8d1af21aac33869bc9ee5bc8e4b563e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982051, "uuid": "85ee4da8-b43d-4962-aa6b-73e8b2016e62", "comment": "Malware payload (AgentTesla)", "value": "0e9dfe4666c16b2f1298f6c07653de476d8642af1eab5a15de25c249471bfd73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982051, "uuid": "7d5f8eab-14e6-4101-ab6b-47bb6d527ade", "comment": "Malware payload (AgentTesla)", "value": "747f004c6a808a8486861c5e4acc7ee13a8deb94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982051, "uuid": "ff9c149c-a6bc-4669-8d61-f227a32d0da9", "comment": "Malware payload (AgentTesla)", "value": "192972cd0281724ba75e7fe570566c2b75a348c28121ea776d81ef99b3987a1bf620933a118ce2d07329bfbb9bfc905c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982051, "uuid": "1cb53121-22bc-4980-b133-e38a8f182c8e", "value": "T1A955D00FA904CB86D10D83F47E1369D80A0D7F19EBD569DB24927B8F3E316A259CA1CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982051, "uuid": "13f5a1e6-c3e2-4e64-a559-1937287d92fe", "value": "24576:RWQmmav30xSZyEw6VdUhrZyGw6V9UCkNa2ZbvMIHERgrpuvPwUx:gQmmQ306k6VWy6VWHvjHr9un/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695982051, "uuid": "aedca3e0-f4c4-411a-813e-f51dcb03fad1", "value": 1292800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695982051, "uuid": "de9497e5-9916-47c5-a11d-3f9388371fab", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982051, "uuid": "a4666449-0df6-4f14-9dc4-d67fbc1b626b", "value": "RFQ 9-2023-0120.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639263ae-5f01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696017006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017006, "uuid": "9adc5911-f464-4bda-b510-631f7db13122", "comment": "Malware payload (Mirai)", "value": "618daeb3a50707d509414cd6a6771816", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017006, "uuid": "af030e40-757a-4ff2-afc9-ead70405c5c5", "comment": "Malware payload (Mirai)", "value": "0f13603ae8a9e41384a649651ddefca309f9d509848f131d80cbbc4bd1f396ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017006, "uuid": "f388be7b-8457-46de-8178-788a4c1d49b7", "comment": "Malware payload (Mirai)", "value": "79fb581faef0bd82be1c8a63b06e064907208de2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017006, "uuid": "79412670-074a-4e1d-a286-f870152ea67a", "comment": "Malware payload (Mirai)", "value": "5fefdec5d4adc504f9270badb36416816d49106b244d6186d7124a613a7e42254951f962aa6dcf9a891c9dcbbb3db1d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017006, "uuid": "36aac41e-6f72-4533-b599-d787c40dedf8", "value": "T11233027267AD29D151F09777FC33BC1A669C17F4986B30DA28F06A1977C68024FF2682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017006, "uuid": "c400b6d5-03b4-4a83-bebe-a25cb2a7bf63", "value": "1536:d9O/ZMAXIxNUk0tF3LcPqF1aBexo4opKZbT:d9O/ZNKyJF3LGqFUFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696017006, "uuid": "60c1b24a-db30-4da7-8c9c-2399e20ab816", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696017006, "uuid": "442142ba-df52-4013-a2aa-77dce3f4586d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017006, "uuid": "e0749ae7-f50b-4e9b-8653-c129a25023e4", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32995337-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977410, "uuid": "13e02b27-13a1-4570-9b05-0bff23cf55b3", "comment": "Malware payload (SnakeKeylogger)", "value": "ace875c365d7a5ce899658d3d89994ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977410, "uuid": "12224289-6148-4f12-af25-a52bf9c540e7", "comment": "Malware payload (SnakeKeylogger)", "value": "0f25306693110deb7fd3d0f27a8bc3c2160247b3e05620d8a09550226cd6c09f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977410, "uuid": "bb110e85-5f17-4be9-8b74-3d66bd3440c1", "comment": "Malware payload (SnakeKeylogger)", "value": "0eda8237f95c5360e0ce78c9a92115163dc3a0b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977410, "uuid": "a4030ff6-a96c-44cf-848d-f0eed6abbbe9", "comment": "Malware payload (SnakeKeylogger)", "value": "f11680b4354006b4f836be87f13c4ebc0a3dfd07e3b6136b442be1234998d549dad5e727a190045594e2ca0413ab68fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977410, "uuid": "c1770438-b245-4d46-aa00-9ce455411c03", "value": "T12CE4018677292F62C5BD67FA0168221513BA95676032F3098CD360EB5FB2F091F65F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977410, "uuid": "dc814020-2054-4f8b-974d-a2ffa6253207", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977410, "uuid": "84a102ac-1a83-49e5-8b43-f6ef35f5e636", "value": "12288:xVj3hLQvfdxOo7gpXtrXsF725JQn7KtI5N6+kBzvuHoSQFbZyWHCDYKJOP5O7HMV:xsMc79ozvuHpQyWHlk4UHMvHKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977410, "uuid": "fd25cd16-e6f0-4770-a667-164a9daf4b83", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977410, "uuid": "fc57bdf5-5838-4fad-8be6-809e1ff25da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977410, "uuid": "39932f9f-3900-4598-8bf0-79b9a194683f", "value": "Transfer Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652dd577-5f1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696029035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029035, "uuid": "91b54c72-a57e-4bc4-b087-f50d583f9e82", "comment": "Malware payload (Amadey)", "value": "5ffc2197da8da12de83042da7c5477b4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029035, "uuid": "9abdff8f-2b75-4bef-9908-6fc91c3d6809", "comment": "Malware payload (Amadey)", "value": "0f425b2cf3128eff1c522aaaabb0375adca5468aa4a98c3f37e0f055c1b45a22", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029035, "uuid": "1b648911-b755-4bbc-804d-65bcc13d6b4c", "comment": "Malware payload (Amadey)", "value": "162de1e6de75afed5ced327c6c86c9ba640e2a8d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029035, "uuid": "22b2e08a-8084-4911-8f25-5949ce8feac5", "comment": "Malware payload (Amadey)", "value": "b58d6a75dcb64aa069b1d530a46478624d4bf60ef2760e6e0f4d6fa3cdffb2a5f3449ee7a1d839a248c880d67becdf5d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029035, "uuid": "ce105a4d-6677-4c0a-9a7e-aefbeef7d816", "value": "T1EF3523578AEC1961E87617B154FB03D30D217C920A39DBAF2787688E4CF26D034767AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029035, "uuid": "a6cc9cfa-2c50-4b24-850e-a14b4c07d6ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029035, "uuid": "02a99a82-2371-45e3-8e2c-dbb98046dc65", "value": "24576:Vyb0ONzjX2rVTJvuN3dAgeH8sVWALK5JsY7CjoMi3L/bYE:wxtT2rV1u1ducYWKKiPsL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696029035, "uuid": "81a5257a-2fa2-4a6e-af03-a7ee3bef25a7", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696029035, "uuid": "5ccca253-7efa-4453-a7af-ebf06604d8f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029035, "uuid": "5def8279-9937-4bf9-88fd-4e9028f33d05", "value": "5ffc2197da8da12de83042da7c5477b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb693dc8-5ec9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695993102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993102, "uuid": "2b983ae4-fdec-4d97-bc25-8331efe529ab", "comment": "Malware payload (Smoke Loader)", "value": "d3d48efa951967a7192eb9d899867eb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993102, "uuid": "40341275-00e6-46c4-8ad3-dc84cbe888c6", "comment": "Malware payload (Smoke Loader)", "value": "1022f8d025585a82bca212a2ef054c19b01cea14cf12b209aa357c0fef6cb23e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993102, "uuid": "c7ddbdd1-e007-4c34-9890-4a4f9cd9af0c", "comment": "Malware payload (Smoke Loader)", "value": "81ece1b53cef8ab0d88bbd10ca4c821a4bc0aadd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993102, "uuid": "1559cdeb-3474-4037-b955-e109e6c653f4", "comment": "Malware payload (Smoke Loader)", "value": "b855af5c0b008ce0eeed65957d4afc6567cdffabe4e680ed6139029ea159301284c136d016385076e3158c2d2b3faf47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993102, "uuid": "3261376a-118b-4ede-a0c0-a30bfa724fac", "value": "T192349F1292E2BC60D5E746769D2EC6E43B2FB5714E5BA76B32145F1F2CB01B1C2A3702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993102, "uuid": "d6af8885-3c93-465b-bc36-cf880f31b995", "value": "cceb1c098bb76547116fd8d11380b21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993102, "uuid": "3fe93414-f491-41eb-a9b8-ed5d5c5d684e", "value": "3072:OXjOoNOhDisPErVH2SEQJbTfwCfCPCVi7uFbZUBxKJh5mpfxapDz1Tvskt:WXNbsc7/J/fZmCVUuFbZUL7NxapDhTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695993102, "uuid": "c405d52b-09f3-43c1-893a-bcc79a3afe40", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695993102, "uuid": "fb808b9d-1842-4785-af11-6c7976ac9a3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993102, "uuid": "4f0ca424-ea67-4f94-8cf6-55fb54b8a62d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa79fcba-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986631, "uuid": "c1cbadac-a74b-4988-9c9f-c3fc9edd63d0", "comment": "Malware payload (Mirai)", "value": "43844d33f140d2596ec47c2219864863", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986631, "uuid": "9f0e7b04-5f6d-4a26-aba5-30df3018a8ac", "comment": "Malware payload (Mirai)", "value": "1093127119ba5c2ba5552897286e613e951b2c43d873bdd147b75df9c42d7479", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986631, "uuid": "01774a24-4927-473f-9afc-eac6f3257256", "comment": "Malware payload (Mirai)", "value": "24561464cc3ed03eec59aef1b7fb23b55f980911", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986631, "uuid": "926bf1ac-8f5d-43fb-b311-6bc2c10b5fb6", "comment": "Malware payload (Mirai)", "value": "b48bf5b693dfe1c6de79bb44d3af3b10211c360dd13156a6e8502dc9ec22696e2c8591be7770d4ea20869c788b2b6c2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986631, "uuid": "731660d1-9218-4324-951f-b99278529690", "value": "T10F93741E2E22DFBEF75C82341B778E349695229136E0D684E29CE7081E7434D685F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986631, "uuid": "0abe5ffa-9c11-4e31-b165-fa20113eca3f", "value": "1536:Kg68tVByJsmm15vdrBMsxeNNH/wGxvXEtNb:Kj8tVoJsmk5vdrBMzfwGlXEtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986631, "uuid": "bbd2c406-007d-421b-b3ec-79c5fc260a90", "value": 96280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986631, "uuid": "703cae70-7c69-42d9-bafb-574fc6c56f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986631, "uuid": "37289dda-488c-4bcf-a921-63ec6af374a0", "value": "43844d33f140d2596ec47c2219864863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308508a1-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695986856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986856, "uuid": "c5e20e9f-8980-4d7c-9c71-7be5bc25a425", "comment": "Malware payload (SnakeKeylogger)", "value": "816c7761599a4e2b666d2e47e380c615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986856, "uuid": "9def425e-0235-4671-bc22-97c2b74c784b", "comment": "Malware payload (SnakeKeylogger)", "value": "10979714162c9b426a7e9b2e14a582b03b4153bdf3cbce775b69b505a2463cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986856, "uuid": "4819b9a4-05e1-42cd-9f2d-bafefa169edb", "comment": "Malware payload (SnakeKeylogger)", "value": "6e1de32829fce91c28e24f42972575ba4803318c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986856, "uuid": "360bdaa3-2629-493d-9134-7321a54675cf", "comment": "Malware payload (SnakeKeylogger)", "value": "86518fe97071e47a98b6756e04e9d593dee677f0776ac078f2b199ab3442c799865d71665595c12c3c466fcfdc78e223", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986856, "uuid": "d677f762-0a9e-4c93-a473-e466e6aab6ce", "value": "T177D4124576EC2CF7EE94E6F1B249CD109AF3234DA303EB5E8D9D00E409785953893EA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986856, "uuid": "7dfdfdc7-2452-4a44-9b43-ae8739022561", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986856, "uuid": "835411a4-778e-4bed-97d8-90d1a15b9218", "value": "12288:bJFl3t6SU4VbiQQoiu6dqHnqczOYhT9/yLhUQ8vFheac4FdKwJ4mAp:Dl9aMb6okqHuQaL89VcSgwKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986856, "uuid": "bcf245d5-3f97-481c-b21a-d1b82e940d3a", "value": 609624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986856, "uuid": "20b04f2d-d06e-45cf-a612-19f8a1b7d78d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986856, "uuid": "128075eb-714c-4eaa-a04c-d2bda5efc16b", "value": "Hesap_Hareketleri__20230929_194202031.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875fc7f7-5ebd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987860, "uuid": "a1f56159-12e6-4086-ba25-029e7086b16a", "comment": "Malware payload (Mirai)", "value": "74a2e7e2d4b5e87704d0a7c5e54ab5f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987860, "uuid": "2032edf2-fe90-4c11-9f0a-e010ce13a5e0", "comment": "Malware payload (Mirai)", "value": "10c73ef1bb200a237e0059068b5ec1d281b2a007ceb4dee2cdd8bddde9ed75bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987860, "uuid": "8c49dd2e-ffbd-4132-9b81-7bef170e3f83", "comment": "Malware payload (Mirai)", "value": "29429c62a6a2a3eb73a407653ee0ee8066b86ab4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987860, "uuid": "7f6bb89d-031c-4bbb-9b47-82c2f3719b96", "comment": "Malware payload (Mirai)", "value": "f7eb456e3a4b82ff5d5ec3f2272d59f65eb0c52d2432e449a2a7743e53b385a075af45379b79ce9387a8fde4c7b56a9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987860, "uuid": "5838d568-30f7-4f25-af1c-e1dfb0b3c3ea", "value": "T150D2E1027241FEE1C4B00231ED278A9B72257D79D1D134FADA3D0EF8A6E9A0D47F4942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987860, "uuid": "232f4816-e4bb-4b41-aeb5-0ff40ca8e413", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXgZ9q3UEL7c:WRwynNIOQQ1KMwMLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987860, "uuid": "3773802f-1114-4729-8701-05d342af9e60", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987860, "uuid": "7a9ceae9-b595-4039-aa1b-c8dee9e187df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987860, "uuid": "777dd516-1245-49a2-9342-9d8d3d298680", "value": "74a2e7e2d4b5e87704d0a7c5e54ab5f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf082b3-5ee5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696004862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004862, "uuid": "e457ead3-3e9c-4937-9ed9-4902d86f41cd", "comment": "Malware payload (Mirai)", "value": "a9406cb338e5606eb22805f97c7d12ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004862, "uuid": "f9f591e8-6903-4a11-a610-389e15c14d05", "comment": "Malware payload (Mirai)", "value": "119df13622bd6af7d703f5216cee6870fb4293483add5d132fb61c9e64e215eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004862, "uuid": "7da2c2ca-4375-4ab8-bba7-fdb299e754c2", "comment": "Malware payload (Mirai)", "value": "9a3ff2eecc150e5085c8be1241048b199b59c5f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004862, "uuid": "64758c28-486b-404a-8c6e-b9855d43ae91", "comment": "Malware payload (Mirai)", "value": "c9ce20e3110259d60578e20bd11952d6f6865c011c0f43fc9fe572f47beaa404ad00eba73f1240b1af0db8554d3992d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004862, "uuid": "7fd9fbcd-36c2-47aa-b4df-4ec6d3ed189e", "value": "T13FA2E119BE1C828BC832293544E9E9D61356FC71F2ECCC092940D16FF4B33A95874F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004862, "uuid": "a0b46cab-1dfa-499f-9aa5-9048a0478ec7", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAK1:x98o08kxofBE+ZkXaqGbp2F2TWul0c5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696004862, "uuid": "a1d34599-49ea-4cee-8481-b2e4f299fec3", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696004862, "uuid": "7a09b86f-7459-47ea-b47d-83ea85f55189", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004862, "uuid": "7bf49d61-78b9-4327-94ac-6167a5b94dfc", "value": "a9406cb338e5606eb22805f97c7d12ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff36ea42-5f14-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696025428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696025428, "uuid": "70942c09-89bd-463f-b86a-f1ce358aac04", "comment": "Malware payload (Amadey)", "value": "37e5c43c490a6a0c4d0c6345f07a69ef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696025428, "uuid": "5878c03e-b089-48f2-af32-7fa3b69e7c4a", "comment": "Malware payload (Amadey)", "value": "12fb005f8400051a07486a0b93e1429ec4db0ac2575d9eb1630e7d804813d60f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696025428, "uuid": "d48c361a-1c29-4bc6-a600-9cec51c247cd", "comment": "Malware payload (Amadey)", "value": "310e97e1dbe9a6c854a92fe0df453f397288ca6e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696025428, "uuid": "c6caf275-6d4a-4bfe-826c-5ed2d7b5f052", "comment": "Malware payload (Amadey)", "value": "d52317a4fef6eaaf457811018ea79ece00d330a347198f36899331ba59864f087c5f3e9e657cda1027a85007ffcdff51", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696025428, "uuid": "b50c5d0e-09ef-4e76-b4e0-0c421a581206", "value": "T199052206F6D89562DCF12BB04EF607D30D3AFC919D30879B2789688A0873995F57272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696025428, "uuid": "9a841dd1-cae2-452a-872b-a6aa054b5c15", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696025428, "uuid": "36be58be-ad18-4087-a9e2-63088d6ef6e3", "value": "12288:PMruy905bnvC7qQJAYscbZdIvmmFUt+4MTwMsQrn14qtY8JmLgIuPR2UHtYsbTT1:pymvCHpxZdIvlQxSsQr14KJmLLO7e8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696025428, "uuid": "1064a5a4-f468-4a15-acf5-2d02d837f31e", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696025428, "uuid": "1e3bd6f7-0a35-4ace-b397-162d66fccd39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696025428, "uuid": "0ab888b5-f94a-44fb-8baa-131630f83076", "value": "37e5c43c490a6a0c4d0c6345f07a69ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05713d0-5ebd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987902, "uuid": "d9c78a0a-e886-4696-a029-bcdc851083a0", "comment": "Malware payload (Mirai)", "value": "6e608b7ae8b5f235a2e93132e9061e8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987902, "uuid": "fcf71031-1dfd-4999-9cc0-198a0eb38cba", "comment": "Malware payload (Mirai)", "value": "131433d06a43b4c62a5d692a1d386812d89920cd436dffec7a0ec0616a9b9689", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987902, "uuid": "f68644b6-7630-4e38-8a57-47ef66d60d24", "comment": "Malware payload (Mirai)", "value": "973d2b539f39607ba574a06e0875a242481b8ec3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987902, "uuid": "bb9811e0-940d-400b-81a3-7c8d767b30c2", "comment": "Malware payload (Mirai)", "value": "c63b1bb618ec240da864ec57c047de0eda593efea7dd508395bb6844208696208a9639fb362c8c093b45dca44f8348ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987902, "uuid": "7428d879-d778-464e-9427-c1a491a632e3", "value": "T1C1431925AD792E26C0D8B57E11F78724F2F2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987902, "uuid": "9f0c3066-78ba-438a-ac26-406226a3dd52", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDj:eL0AxvSHfymp0xgunvCkV6vTMDauI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987902, "uuid": "241a9e19-1364-4dee-a715-288536d25789", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987902, "uuid": "6ae85a1c-9226-49e4-ada0-79eea944f73a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987902, "uuid": "2a36ae0f-80ff-416c-9d8d-be0330d4fe26", "value": "6e608b7ae8b5f235a2e93132e9061e8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72bde18-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024448, "uuid": "d863931c-fc7c-4203-8cf4-d2308f9a8b7f", "comment": "Malware payload", "value": "ed717d4edc77c8aa63643faf92109812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024448, "uuid": "687370e4-c16e-4365-8e48-627b082b3486", "comment": "Malware payload", "value": "13d372e229b1e11446c9cae3f6e7e7f15eae9a50ce3547978f2c356f156c64be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024448, "uuid": "c140b2a9-df28-4f50-81fd-20eaf23eb672", "comment": "Malware payload", "value": "88276465764ab64f46e3e69df02a67cb60915154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024448, "uuid": "f3404ca0-fec5-4759-b554-94818f84702f", "comment": "Malware payload", "value": "c0340aceeba0410ba0318718d19a540f4d66f1b3f780f83061b67e630c678aac0af9d4f3c6dcb21e2d834c13e7c6752c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024448, "uuid": "93b96f6a-6039-4976-a072-7f8f95f4fc84", "value": "T1313423255580D38F5021D58FDE88687E7857CC3028870AB0A6487FAFEDD7C96AE6E5CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024448, "uuid": "3f9bc6ac-9345-4d92-b029-fb63b2166130", "value": "6144:HmjkoJurE5sIKNpYIv4bp+ryV3Y770oLMhlUR:HmjVJL58XL+gr30olR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024448, "uuid": "1434ec58-d301-4937-a78c-656ebd136dea", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024448, "uuid": "eccb6773-db87-4d23-a699-e6a401cd9703", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024448, "uuid": "bb0b8d2f-a821-48e6-8635-26c408b04bb5", "value": "288338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66205517-5f16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696026030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026030, "uuid": "34200f90-513e-44b1-8aab-23134f048382", "comment": "Malware payload (Amadey)", "value": "04054c71c89ea473c901396781568a73", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026030, "uuid": "08a1169b-ad39-4d48-940e-dda28dcdb297", "comment": "Malware payload (Amadey)", "value": "14037f661bbbb0a094c15e15bfa39ac41e5609e6ab8b2ba7020e8e79f0120e36", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026030, "uuid": "90e5dc01-4ee5-48eb-934e-a48e92bde3d0", "comment": "Malware payload (Amadey)", "value": "bb557c96e2b972f0cd3d18eb9a1ee135a8445cb0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026030, "uuid": "a0e8da2d-2e81-48de-a4f3-93c214c25e41", "comment": "Malware payload (Amadey)", "value": "d9c43e136c10b16a1f96c913e0bd97e8704e16a1f0ee995b3dd17f6e0769e4f016729ec46bf7ae52f9f5defb4c2f7b22", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026030, "uuid": "041144c8-0119-4205-9d1b-dac6fdd7e907", "value": "T11434AF1175D2C472DC7215360AE4DBBB5A3DB82009925AAF67E40F7EBF30281D632E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026030, "uuid": "f874d1f8-bc84-477c-9c8e-ceb1b4d2e15a", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026030, "uuid": "3c659a97-4618-460e-8ef1-f84b96123381", "value": "6144:2Xz4SHy5uoBMFGV5PEkIXEHvZAOs1zu69yJVs0BC+:TCmuoBMUOMxkqJrs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696026030, "uuid": "ffd347b1-7954-475a-8339-78075c2cb403", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696026030, "uuid": "49490996-1a92-42b3-9650-a805bcc8cf7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026030, "uuid": "c4b4d231-e9ab-493c-9abd-4c0dbe464a43", "value": "04054c71c89ea473c901396781568a73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2661d18c-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024205, "uuid": "ff9441c1-8145-4bd4-a730-3e81352ab0b7", "comment": "Malware payload", "value": "a650daba45e045824f8eccb56e111988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024205, "uuid": "16671f91-8b1f-4440-9327-1ebf3a8c8382", "comment": "Malware payload", "value": "1444fc437bab8cafa75ab20ae11575fab7f5a29fa3a9c488d79b44c8994e6116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024205, "uuid": "9812eba1-2cc5-47de-bf9f-5624e887d9b2", "comment": "Malware payload", "value": "e5c93ad9a1c481406e2740024fe97039675f2688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024205, "uuid": "49468a44-d8b3-45ec-be0b-7ce5ce891644", "comment": "Malware payload", "value": "d76da4161d9e62310144f099a6905d7608b21016d7399942a9d803513edd710269feb7184f3406632093b0ccff8f9053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024205, "uuid": "23b22400-790e-4442-9a4f-ffae33f7d9f5", "value": "T1DC342335585AEFDAC8996C2D3466B23841E492C6582CBC7BBBB45C517CE3091C07F12F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024205, "uuid": "fc5f57a3-bc79-4090-b2c5-16be7f8d1843", "value": "6144:chDfivUa8r1PhniJQ1JnxbMh+GaZzcP+u/c3v3OE:KfivUPUQ3nBMN2u4+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024205, "uuid": "a5866474-4b34-438e-a08f-ea45d6526b0b", "value": 251920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024205, "uuid": "8beceacd-eef3-4866-8e94-effdd3fba955", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024205, "uuid": "cd4c41da-9e00-4314-af32-ea1d0b01d75b", "value": "28837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c9f2cf-5e7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695961252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695961252, "uuid": "c5bf6219-4036-4dcf-8ccc-baca70dcd429", "comment": "Malware payload (RedLineStealer)", "value": "1e5e5a78bffa32246a93e34a56b19142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695961252, "uuid": "28ba5fef-15da-4e31-930a-e3e5cda05eb6", "comment": "Malware payload (RedLineStealer)", "value": "15bb8a20aef27667092cabb8d5d7d0d6674b26459b8fa295eadf4822fee16e00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695961252, "uuid": "2c2abcc2-b4bb-4203-b06c-39b08821da3c", "comment": "Malware payload (RedLineStealer)", "value": "77421c1771a6043f254b31acbcc24c246203d7eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695961252, "uuid": "c70765ba-b354-419e-a0fe-71943327472a", "comment": "Malware payload (RedLineStealer)", "value": "b65a62ee18ebe25b2a6733169fde163fe60aeeb80bf1dc3b1616e702bc26a97ca620c3af98e9d21fca4f7520ef0fdd84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695961252, "uuid": "0a359492-f89b-4e6f-baac-38ee9ab92c4e", "value": "T167A4E113B3E1E821D0764E315E39C6B4262FBCA18D6966EB33587F2F18711D1AB66703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695961252, "uuid": "fdce3944-5fff-4447-ae36-a94dec0a6927", "value": "d749dd3982d2564e67503d7c8e1b49ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695961252, "uuid": "67510c05-8165-4960-8a7d-d12c52fb7ad7", "value": "6144:5TtbFklzalgXbSzoRlpuHKGFbuDTB1jHF6kvcMyjaSl98GUP2QkGDq:Fv8zMgLSmyKCuzL10dja7HP2QkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695961252, "uuid": "609d4f46-63b9-4bee-9757-9614772e27e2", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695961252, "uuid": "05177ac2-b467-4292-bbfb-40a65632200c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695961252, "uuid": "b6480069-2b78-4e34-8846-66a9da0e3cd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ef083d-5f01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696017008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017008, "uuid": "f4c570e0-5b1c-4bf0-a8c7-3deaf732d5b0", "comment": "Malware payload (Mirai)", "value": "2c14126bfd25c3379c611f6229392e1f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017008, "uuid": "cb0871bb-8811-429d-9302-f5ba86ef6bff", "comment": "Malware payload (Mirai)", "value": "15c246905961137fbd3a396ea45dc60d7a3f8e366366742ac58c0054fbd968a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017008, "uuid": "cf660a4a-6283-439b-9cb2-b5b26e073565", "comment": "Malware payload (Mirai)", "value": "e80b9efea4bd8e8efeb1f22152f67d055ea5da44", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017008, "uuid": "7542113c-192e-4309-919d-14b9537681bd", "comment": "Malware payload (Mirai)", "value": "dc7094e8f11880aa9b8d5950c09c2c43a787b1ca2becd503ba789f7c1d35bba8f430e172b77918f9d1c18ba54c0f2dfd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017008, "uuid": "e9a23ee0-1f85-4c31-af68-67396a29898c", "value": "T1D7C2D03066EE1CB1C7500532F7B857C9BE530F7DE5FE3890114046BA39419592EEA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017008, "uuid": "08b8f4e2-134a-4952-8b16-75d1625e4c6e", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEeR2hymdGUop5h/:A7soTAZ3alkXLvFh8nNEe4s3Uoz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696017008, "uuid": "0cc6a7a2-6ae4-4966-9d51-4619b267322d", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696017008, "uuid": "01957888-229e-4959-8f8e-33cdb4195971", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017008, "uuid": "92821eb3-3850-4b02-bc53-4672bcd2262c", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94aa48e7-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986594, "uuid": "48f117e5-9448-4d64-b358-12b6311c8666", "comment": "Malware payload (AgentTesla)", "value": "1c8b394dfcf617ac8e2dd5688b061669", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986594, "uuid": "6a2560d6-2047-42c0-b534-b22f32b9a993", "comment": "Malware payload (AgentTesla)", "value": "15f50ba333524631c241aed0d3ad78d1846b2b58aea175dd98e178ae26d009de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986594, "uuid": "7d1fffe6-339b-4cb4-9c5b-0a298fed8eaa", "comment": "Malware payload (AgentTesla)", "value": "c10646818f8096102fa0a9f8c220fdc0dc164bfd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986594, "uuid": "56612fd4-4135-4c7a-bae6-9c397cb8cbee", "comment": "Malware payload (AgentTesla)", "value": "49cd31f68fd363cbb3b6ae2aa036f8abdd407acef2f1c666daea364252eef24e146c89b9cb2fda41b5da0368604fa870", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986594, "uuid": "447e1b0a-69c3-448c-bd94-04d5097363fd", "value": "T1FAE4338DC6F678D0F78D45A16A222DF80A234B475397983CD7C200996DEA374788DF6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986594, "uuid": "416ae343-eb98-4d98-9fec-04e4d1191bcd", "value": "12288:EfQAgCrk/YxCX1I28bOoehLUxpXwwEL6IijZ92eBlOADdK4Q9zsf1:E8CpcFfyCvL6IijTRBK4+zsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986594, "uuid": "d0ffa44a-8719-4829-a53b-6823ead91ffc", "value": 710160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986594, "uuid": "71db2097-e10f-43b2-8ab7-97ce948bf248", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986594, "uuid": "1cb3f195-5f6a-4d69-936c-b8387dda7d96", "value": "Prueba de pago.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2005cb8-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015903, "uuid": "dd31159b-0f58-4813-a9f4-9405d120ea2a", "comment": "Malware payload (Mirai)", "value": "bf5dca3f0cffe6b9d0bf539cf2246742", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015903, "uuid": "c1d1472d-a520-4a4a-a012-d762e1cfcbbd", "comment": "Malware payload (Mirai)", "value": "161e754bdf8ccacf539dfa014a2a63c70dc332cb7335093f4382c5f5fc21b523", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015903, "uuid": "7b5e41ac-ca02-45a7-bd29-0c6b7f476a9a", "comment": "Malware payload (Mirai)", "value": "873db273e5e4fbf96da9a34e62a0c4186e4f61e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015903, "uuid": "b24e1ed0-6194-4002-bdb1-441c0adb733c", "comment": "Malware payload (Mirai)", "value": "9c946426029589b8ed75b9c699e2d1fa9cb01d007d0dfd3a48ac16821d177b42e6acddb77e08928b50fafc6d60b7653b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015903, "uuid": "39f3c026-77bd-4efe-8c68-ed8139a554ea", "value": "T12A142A46AA418F13C4D227BAFA9F424533239B58D3E773059924AFB43F8679E4F23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015903, "uuid": "a24292c5-9e83-4d11-b17e-a0d694b87fbc", "value": "6144:VUQKaRecaKIpOu5m1YnscG3bzdB4M/R7Gu:VUGRecaKIpOu5MA4VBt/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015903, "uuid": "1cdc36a1-cf23-4903-8799-0b17b1524622", "value": 199530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015903, "uuid": "485c3871-25b5-4386-9376-06e3f2a6ca86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015903, "uuid": "b65c3f90-5993-44c6-87d1-7fcebb456db4", "value": "bf5dca3f0cffe6b9d0bf539cf2246742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2499dab5-5ea7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695978246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978246, "uuid": "81910240-fbd6-4fb6-a476-5683958f12a2", "comment": "Malware payload (AgentTesla)", "value": "6c5cb296bfc90c5aa66a2679a841b14e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978246, "uuid": "fbe8d659-1be7-43f1-b5b3-ab973d843aa6", "comment": "Malware payload (AgentTesla)", "value": "1625b2bc1e2dff7af51d05b176469c33a7d5a544aa34f4c982c07b7a302f332b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978246, "uuid": "af5ed9b8-5e6e-437f-bda9-b45529f2df80", "comment": "Malware payload (AgentTesla)", "value": "3b727e4114426e26ff07343b7c307d4335597670", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978246, "uuid": "5271574b-1859-4490-b6bf-fbd7764789ba", "comment": "Malware payload (AgentTesla)", "value": "d2064f901a529fe420fd38fb86f0720f9ff3bacb8ee7644aa319a8b53d1f76d6b21bc87df1657abcc0f9c0713ae5b2e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978246, "uuid": "4ff2b697-f242-4b29-ac7a-c8385fba0764", "value": "T1CFD423AC35E08B90D894133B53CD21670371F2299A00FF6ACFAF22DF4A76725A561F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978246, "uuid": "33b67155-52de-46eb-9e6d-3f4498db5035", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978246, "uuid": "dfcc32cf-f042-45e8-8817-3a6d68e85a0b", "value": "12288:mW725z3Q8kh9Xps9qLjgm4r5Rh44/bL3XQPxosoG/ZtU6CcGpdz:qFk/Jh4rZv/3XyZtU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978246, "uuid": "3af352bb-a7f8-4921-892c-632dea19246f", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978246, "uuid": "52d9244c-5580-4b13-b09d-751ba2e4137a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978246, "uuid": "2a6d8627-fad5-4a9e-85d7-82b3f8923887", "value": "PO23_4747.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d18000-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024195, "uuid": "ced14a3b-9080-4baf-bed8-4ee4504aae7b", "comment": "Malware payload", "value": "1702c44c758bafb60e8983ae77bc387b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024195, "uuid": "1787ee86-e5af-4c7e-986b-ba4bdd8463d6", "comment": "Malware payload", "value": "16fd1b7c48621bddc84a3b5e35b03732a0c264289a83b8c6aae1510501f80fd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024195, "uuid": "9e11fc95-a010-47bc-bc58-8c96e4ad6d9f", "comment": "Malware payload", "value": "b9f9760fb5946ad79f94a9d0f34f87f06dd1c4fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024195, "uuid": "ad83506d-5bbb-4b9c-96d8-a9d6fea85d75", "comment": "Malware payload", "value": "4735ef021015dcdd220f37ad52ad26f3cf98dc01b4b9311557a298af9c93b92f25f1d2025ab517ce9f960c25ce56904b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024195, "uuid": "25c29382-09c7-4a9e-8466-02ace1370181", "value": "T19334239069851D86F68225F1664452B3CA878832A5DEEC09FFE3173E84B7E1F3437875", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024195, "uuid": "628f4786-ca00-4575-9d9c-b5dc77d95723", "value": "6144:cTAwUj8G1CWF9oVJShKrWvpfTznxnyCgwse19ljrKmhucL6HXsB:Q5+N13qwhKrWtdyCXljrvucPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024195, "uuid": "45843bfe-5f57-49ec-bb4d-44f1040b7e37", "value": 251920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024195, "uuid": "b14f9025-8968-4f2f-a2ab-98ea57ea3daa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024195, "uuid": "9fddcc54-06b4-4a20-9b61-99278e8a0f04", "value": "28836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421f4f61-5e89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695965410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695965410, "uuid": "98d27e54-cf44-4ecb-8eda-5f0301c0788c", "comment": "Malware payload (RedLineStealer)", "value": "ad52ab68dad439860eadbebfbe31a3e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695965410, "uuid": "6ba063a1-506f-4aee-b816-ae01345a4086", "comment": "Malware payload (RedLineStealer)", "value": "16fe20ecb5af584fe0e4baf89426f308defa670ab6ee03ce841c82b4398eeac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695965410, "uuid": "cd2cad81-46c2-4483-b9a3-3ab1038b3d74", "comment": "Malware payload (RedLineStealer)", "value": "40980838bc035230299612420432ce4c57a5a4f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695965410, "uuid": "3be374cd-16ef-44a3-b844-bcd9d6c50929", "comment": "Malware payload (RedLineStealer)", "value": "b78ae45c43631559d0b9bc381d0f8960f87629a49881e1b734f0a96086994341eaad9eb1acc898f6600c487e20a31cf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695965410, "uuid": "32a61a22-a2d3-4ae5-9938-bee1b4c9c969", "value": "T145158E2138C48176EEF320B743ECB63646ADE4B407195ADB16D81BEED7606C17F32686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695965410, "uuid": "a6e592c3-2d00-4425-b053-42fb0db08015", "value": "d215e7ae5c8053185b6f0c1eed2c8e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695965410, "uuid": "1e1ec14a-0e16-4eb4-bb3f-ede3052b9914", "value": "12288:c+WAoWK3DW9g145x58OpGHmEJ/qdDyyZpxThSGu4ywzXI/9:cK8W9g145x58Ops/yVzSMXw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695965410, "uuid": "e7cf21ef-95cd-4cc1-9cf5-a287b9ca97eb", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695965410, "uuid": "eaf1cfff-5f03-4edf-a7b5-b0337774bb92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695965410, "uuid": "d5dcfd1e-7f2c-4c93-b7af-7847b5baecd7", "value": "ad52ab68dad439860eadbebfbe31a3e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02363569-5e95-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695970457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970457, "uuid": "babbfee8-84c2-4bfa-a329-956ca7df8496", "comment": "Malware payload (Formbook)", "value": "ea417761dd217b7b0159a15fe479c364", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970457, "uuid": "1ca107db-c909-4bdd-b45d-bf03fa158b0e", "comment": "Malware payload (Formbook)", "value": "17d272750dddfce88ccd4f7e6f5296f0f4ac9886fa6f1d0aa12c086507debbbe", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970457, "uuid": "36be5107-2a75-474f-8c17-3382e69efd65", "comment": "Malware payload (Formbook)", "value": "a3cb73fdf7eb943c521ca69d28237fe73aba3f31", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970457, "uuid": "42e481bd-5b79-44b9-b998-7e4a9d06c8bb", "comment": "Malware payload (Formbook)", "value": "81d875c5a18da5f4f546ddaa590f1e08e622a1b1c07f1f14c5a5028dba8fe70d0012b09ecc89b478cd86511fd8f8285c", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970457, "uuid": "d65ecef3-ba4a-4e2e-b0ab-74e73ea17727", "value": "T138C423BC95D78F471601B3E08C66A725417E6D6222CCBDAEF62310CA6FCB4D5EDE0846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970457, "uuid": "f033a089-f54e-41da-86be-f47230a939e9", "value": "12288:dzr8WGoC8YSyQe9vDiRIpPAjXLmljbmOsvww8/+G5n0Bv/KcARZ6+AQE:dzr8WzCHS3A2RgPAj6lv+fA+y7DE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695970457, "uuid": "4d3980dc-1232-4195-9f77-86e66947498f", "value": 543063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695970457, "uuid": "2705cce0-53e1-4bbd-831b-a0271d56ec08", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970457, "uuid": "647eb65e-c0b4-4084-b5e3-a74532083a1b", "value": "Urgent Bulk order cms quotation request 4179202023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc729a3-5ebf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695988680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988680, "uuid": "ab3d47fb-fca1-41b3-807c-e974dabd19ac", "comment": "Malware payload (AgentTesla)", "value": "38d8ff52d35e7fab1fa3a10413e11570", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988680, "uuid": "ed5af6cb-6e9e-4e0d-aba6-43e8054ff000", "comment": "Malware payload (AgentTesla)", "value": "1820201900ef3644a747983b322ca8c63c48362a4e9590b719ec824e5930f642", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988680, "uuid": "646bab5e-33c2-450c-a58c-f5659099fb73", "comment": "Malware payload (AgentTesla)", "value": "3de93044807a42c01ff9030c3dc3381bea6dd643", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988680, "uuid": "497ad9f9-5098-49ce-a68b-122659e31ef6", "comment": "Malware payload (AgentTesla)", "value": "fd0f4db298ca5970025649b3fb8e2db93c07b5fd5696728c12def8cd7dd5454e6e99022c34cae864711c44647c664571", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988680, "uuid": "32989f37-cfcd-491f-b0c0-0d4f5fc59c5d", "value": "T11F2523342F933DD90BE0473C35679A060E705FCDC628E6DF11F5B4939229FA6DA1A660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988680, "uuid": "be2bbbc0-0a4f-4d8f-b4f9-9fd84629ca96", "value": "24576:zCNjF5S1Hvjspl5HEUe0Ek0DUMLDFFS7K03pWlWIyJQL:GNuvBWgHoW0If", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695988680, "uuid": "b416ffa6-0696-4bcd-ad6a-fb22974254dd", "value": 1041849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695988680, "uuid": "c831d1bc-8791-4348-a6fe-8a1cd033f809", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988680, "uuid": "98de15f2-2856-4ebf-8fdc-b52e42fc6121", "value": "Urgent New Inquiry RFQ_Pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f492d3a-5eec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696007872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007872, "uuid": "e8332235-3c5d-4454-8cb9-2c188aaa2953", "comment": "Malware payload (Mirai)", "value": "c3f4bf6473119209163b4d64388fae20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007872, "uuid": "398544de-4390-4567-8021-ec236c0208b4", "comment": "Malware payload (Mirai)", "value": "1832a40aef8d7eefcfcdd9e1858e21b6e4e93bf08582ec6e580b0932c429dba0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007872, "uuid": "1f3c5ae1-ef52-467c-b47e-27a8c0fbd61c", "comment": "Malware payload (Mirai)", "value": "6b4581f9d02e90d28fc1b8144c4d22a2f8c18a02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007872, "uuid": "b5bcb199-27a8-4e02-b925-563f7d4199d6", "comment": "Malware payload (Mirai)", "value": "de99e2038d27049b2047c59e47a96e9400a206313f856dd47a76ea5d17ae65c87d454443e12ca13182c0679836bf03ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007872, "uuid": "3a199329-c046-4946-9b06-1680ee4ac97d", "value": "T1BF431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007872, "uuid": "733639cb-8748-4b21-abe4-78c84907854a", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwz:RqtmZPuutfbltZFBSJsBcfDSTFI+BEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696007872, "uuid": "9942ea76-f01f-4be8-b188-4de0f6986a12", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696007872, "uuid": "4ceff616-f63b-429f-bbd3-c42dcb4cb593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007872, "uuid": "b6de2ea9-8e2d-4997-9574-d53f7dabf3b7", "value": "c3f4bf6473119209163b4d64388fae20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074ab902-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695990652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990652, "uuid": "47253d34-b012-4aec-994c-1884e3ef3be3", "comment": "Malware payload (RedLineStealer)", "value": "f2c5501c3628ae24e6d1be1e13bb47a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990652, "uuid": "9c00b75b-3f85-46af-95d9-7665d560e41c", "comment": "Malware payload (RedLineStealer)", "value": "18442229e86be0803345decd123943e28d522e586bd43844e6e8b9f91053587e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990652, "uuid": "66fa9e4f-8d5c-4d7e-b1cd-d5e8a670057e", "comment": "Malware payload (RedLineStealer)", "value": "4a28cd83ecf1e9ee14f3917161d9ed2cc4875296", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990652, "uuid": "7fcbe056-d725-45df-9f5e-7c266e2b4660", "comment": "Malware payload (RedLineStealer)", "value": "ea044583bf36f70eaca7313f48595a06a993848ee54d140d76f9b70c76975f973765fb28439972ce2561a6cee8f7d6b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990652, "uuid": "b56d14c5-4728-422f-a564-a39d0ad7903f", "value": "T1C515235B56D444B2EAF66B7048F713830F76BCE1ADA4535A2786AC0A6CB3680F170737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990652, "uuid": "1abc3006-671b-4aec-885e-ead0b96e0daf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990652, "uuid": "05ddc2a6-9f24-4a07-b805-a59619989131", "value": "12288:dMrYy90GQjqij0XbD842CopyQ43nv8d5tI4JjQ2MQFayW4sxd6LOU3nGegQ2l:dywmUEfeD564JjQsFaF4Owkc2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695990652, "uuid": "2ea46c74-79d7-44ea-a237-a0364bd870ff", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695990652, "uuid": "573ad7bb-81e2-4447-b6b5-bb1a15befeb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990652, "uuid": "576eda00-8a29-4427-94ab-3e9acc31b21f", "value": "f2c5501c3628ae24e6d1be1e13bb47a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0d8abf-5ebd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1695987924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987924, "uuid": "efdce97c-8f64-4cfa-944b-8d67c1b3e7f0", "comment": "Malware payload (DarkTortilla)", "value": "6419a1e59348225baafa1b58ed611fc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987924, "uuid": "05c2b2e1-9ab2-44b8-bcaa-5ea088cec866", "comment": "Malware payload (DarkTortilla)", "value": "189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987924, "uuid": "ddc49b14-a49f-4ddd-a91c-1c4144340b24", "comment": "Malware payload (DarkTortilla)", "value": "89e4e06f33ddacf9092907bca221ad111fd4dcf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987924, "uuid": "464006e5-030f-42b5-9c2c-fd2541332a1c", "comment": "Malware payload (DarkTortilla)", "value": "6c473d55485e189d028359eb0772e39e1aeccd414381c4c62ab49a210636b319ca5211ab9e4e4289bcf9010526f6a66b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987924, "uuid": "ea875aa0-f126-4012-9c52-37f3ca7bc729", "value": "T12665F1723B81AA65C5250734C022D1B063F0DD4A1261DB9F38EB3E7F7EF5A029F59A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987924, "uuid": "1aa94046-9358-407e-a0b7-b028b44e563a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987924, "uuid": "984f7526-9e18-4eed-85c7-35d855dc6af0", "value": "24576:twFgDyuHZ0uHO/dqvTrHxm/vDlDLIgNgOknWH:phHZ02O/dGc9UgbsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987924, "uuid": "b68707e1-31e5-4b3a-aebe-94433efc4d73", "value": 1526656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987924, "uuid": "656efa4f-c1f8-49b0-81aa-7f266a5fc0c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987924, "uuid": "68e37fa0-cd1f-401b-bfd6-abaf0b496218", "value": "6419a1e59348225baafa1b58ed611fc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6284b753-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987369, "uuid": "35cde9b3-a4a4-47d4-aeec-dfbdab3d55a1", "comment": "Malware payload (AgentTesla)", "value": "337f191b6b135a5f86e7b79cd29ab42b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987369, "uuid": "8760574a-e73e-44c9-99fb-7895e93e427f", "comment": "Malware payload (AgentTesla)", "value": "189d17c7572c0ad248cdbda9fb1fae17fcb30d4bd61ac6497ecc184340869e3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987369, "uuid": "5f38cf5c-54b8-4bc7-9230-88c5dcb0c74b", "comment": "Malware payload (AgentTesla)", "value": "cf9c3bd673010c18a6a87f98c0c39cb304e5cb4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987369, "uuid": "f047d688-8ca1-4cdd-9c5b-e010b5aacc14", "comment": "Malware payload (AgentTesla)", "value": "9d4ee0ae67e3daebf87224920fb201f3326ca389b47501b68df7c8731b9734505a42d13f7ebd79f087a05149e77a82ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987369, "uuid": "0c699ab9-65c4-44cd-8e20-9fc63365a4d4", "value": "T17DF401029BE91581E6BB727199B2503107B77E61D939DF2D0DDC50DC2BFB290AA04FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987369, "uuid": "3aa24a8b-c29d-4f3b-9a3d-50c060324a13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987369, "uuid": "81f2e96f-ad48-4908-8b1e-6c101c55469b", "value": "12288:uchAckjwxQ/0blzCfx2aPbTqzreKfeCPEUo05sHvAkJ4:lk9mlz2x2OoreK7Pa052oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987369, "uuid": "51fcb0b8-67e2-44d8-9f65-fb04a8126375", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987369, "uuid": "ade43571-32ac-4d60-be59-4ed79343023c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987369, "uuid": "3f520f4f-e499-4f9b-8dee-d645680420aa", "value": "QUOTATION 22589092.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0dd4f0-5ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695978907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978907, "uuid": "64246af1-4175-41d9-9155-c2771df0594f", "comment": "Malware payload (AgentTesla)", "value": "1c56714ac0acf4ab07e27bb124c0f487", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978907, "uuid": "45080a67-8441-4073-8143-23317904cf3b", "comment": "Malware payload (AgentTesla)", "value": "192c5860a708f4d8c7e8ec491d765e3ba28bb6102710083ca3fd961bdae183ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978907, "uuid": "b0d53cad-c512-43b9-aefe-83d3ca78edbe", "comment": "Malware payload (AgentTesla)", "value": "8a346e06301caacf0a86437293bbbaa48f3e238c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978907, "uuid": "60424b84-f68d-4ae1-981e-4ed68f48a76c", "comment": "Malware payload (AgentTesla)", "value": "ce9861c052d3c442b10635b566ce226320320f07d88a9d29db6af0d2d90300c61e7bb0a90cfc705a7d91990128baf0e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978907, "uuid": "23fe140a-8510-44a7-81a6-9bfc08d7c127", "value": "T1FAD42388749A4B51E4C9277A679E42318771B6606152F775DECF3ECB0E3238C2A52F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978907, "uuid": "999fdb72-dbd1-4e58-bbcf-e88cc16a61ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978907, "uuid": "6cd0c3a6-dc41-4b89-8caa-2b91f3fc2c61", "value": "12288:d725c5KQJaPpffEhZIVgrFkwBLC3KBzb8v7v4UR3q5t72OUg8ao:k6YPpshZooXVCaBzb8v8UR6F2m9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978907, "uuid": "7a6d150c-c224-438d-8862-139d419ca17a", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978907, "uuid": "53125687-6c54-486f-8523-5620effe6ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978907, "uuid": "b52301ee-33e2-43df-962f-e9b5e34a0682", "value": "Bank Report.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ff55d8-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986561, "uuid": "6da55a39-e5ab-466a-ae31-d1d87af5e699", "comment": "Malware payload (AgentTesla)", "value": "f581a22141cfca088686fb56530c206c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986561, "uuid": "92337b8d-ef41-4f9c-a278-a6fb01804f10", "comment": "Malware payload (AgentTesla)", "value": "19565d82969fa3ba5cc912d89706e72b0b04c69de891abe9801a259fa5ccc0ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986561, "uuid": "cfe9fa3a-6f6b-4bdc-beed-3677f90371c2", "comment": "Malware payload (AgentTesla)", "value": "81ab888391caf83d839c347145ba85c88f980744", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986561, "uuid": "6a697d71-6261-4972-b5d9-c9b458e62a63", "comment": "Malware payload (AgentTesla)", "value": "168cad83ac427c3b624590e2bbc3e4e4006852b966baa91e9199da97e3ecd70afa7081a8f8d6b3b5693587b9ddcc6894", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986561, "uuid": "c1a18df6-5161-49b8-a35b-5e04e1276592", "value": "T142F423A109CE41A1D3DAE096B2F930E5F84976E005CBDBD9C850773AB4790F31BA54EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986561, "uuid": "f4dc83c4-fbc1-4c9d-83cc-9de5d8321630", "value": "12288:N/e8XDu5ZwfwChw4Dw2k9X5K9DQVzpZ3EcXTzhWDmRtCtYqzHXgqpbc:N/eu0wf1Jw2OXcBqT5TzEdzv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986561, "uuid": "ef381089-70ef-4a28-8f9a-9746a81d95ca", "value": 739882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986561, "uuid": "1def2c0f-58be-4735-b9d0-43406b056a60", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986561, "uuid": "d7d78ea1-0579-472e-b1d9-f3ea04d49c3c", "value": "SC-2023-289.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2279de21-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986832, "uuid": "be9dd624-5fea-4646-866c-51511f7524f8", "comment": "Malware payload (AgentTesla)", "value": "627ad831b90f29e02b003018b1eee07c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986832, "uuid": "3ee8444d-ee52-4981-848e-175290de39f5", "comment": "Malware payload (AgentTesla)", "value": "198c38a216309f3e974f7e5b9bde336e8d77b9716cff0d8d55f1d324ad303a0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986832, "uuid": "650d4f21-af31-4f7a-8145-638d95978ad3", "comment": "Malware payload (AgentTesla)", "value": "9c0034aa327d1a39b36c5773e593f0d6f351a231", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986832, "uuid": "28bb2860-8ec1-4a7f-8e70-dab9f047b47d", "comment": "Malware payload (AgentTesla)", "value": "247c3217271445a913efc7dccf3dc475d64caf5641619a67398ecb8429699bb1b752d42f2013ec93b174716e45726310", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986832, "uuid": "e3407acd-38a8-4ff8-877b-37556976cac3", "value": "T1BEF401025B9521D1EABB22B55AF1413107B77622883EDE2D08CC50CC6FEB7D1FA55BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986832, "uuid": "f3b28ab5-272d-452a-a31d-d7e258990fe1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986832, "uuid": "643b3019-0481-4e0f-a8a4-961e221ec0fb", "value": "12288:ncO4Ackj+SoXBDJ2VicJjIpr95q32hE/dx20wHM1k4aqROePlor4hAFFI0z:kkiSoXZJ2TjsrfAwEzwHQaaOOlXAFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986832, "uuid": "73f33fcd-e29d-4122-86a3-9de4e98a2ed6", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986832, "uuid": "b9dd2561-2d91-4e1c-9b8a-b2cabca5beac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986832, "uuid": "a740de4b-a635-415b-9072-e6295e719fd4", "value": "Hesap.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30688da2-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977406, "uuid": "fe7224d3-adb6-407f-a28f-ea8cc500e44e", "comment": "Malware payload (SnakeKeylogger)", "value": "8e841cfc7f7abab974f8adbc4e260346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977406, "uuid": "9dbe0285-6dbc-4a3d-a525-147242316780", "comment": "Malware payload (SnakeKeylogger)", "value": "1a552b5db668c321e7f584e0f2d379afc41c00707e4fecad232823445bbcf8be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977406, "uuid": "f416c6d5-5ceb-4a39-ab14-5b8ce0d08682", "comment": "Malware payload (SnakeKeylogger)", "value": "385ba1dad2877c6a712cda30dbb4cd47007d93ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977406, "uuid": "4bb2502f-7e0a-4b6a-b666-ade2c7561a89", "comment": "Malware payload (SnakeKeylogger)", "value": "9711a68519b8303da91f802ff4920753ac8509f90f9aecdf87430255ca232af1bf33ab5260a2460f6e9483250eb17419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977406, "uuid": "44287b7c-374e-43c9-8fcf-85eea669e569", "value": "T11D156B9C311175DFC95BCC7ACA982C68FA60647A470BC21391270AFD9A1DAABDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977406, "uuid": "ae61c193-52ac-4283-bfa4-7001e72f5c3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977406, "uuid": "e31aef73-ed29-4f4c-bed4-e4c6d9adc86e", "value": "24576:IwMf2oD5HOhpMmKHeErwqFSVSd+i92MScNXVbzQn:IBzODMmAeswqIHMtNX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977406, "uuid": "a9224272-266c-4c2b-963b-ccdd1f51ccc7", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977406, "uuid": "4c6675c8-8dfa-43b8-9e5f-cdbf5a517ae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977406, "uuid": "da747f04-9958-403c-a750-3902f0476faa", "value": "Payment copy_Usd 163,500.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c0a548-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695987051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987051, "uuid": "8fe81be8-56d7-4836-b6ea-81b008fc59d2", "comment": "Malware payload (RedLineStealer)", "value": "07e7698a6858c82e82d952cde2f8750c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987051, "uuid": "28e24da5-17ea-4b61-a679-4d31a058ce5c", "comment": "Malware payload (RedLineStealer)", "value": "1abc82a0e714d6910ef072262ba8447fd04f94924cbf38191056ea9e9be6ea74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987051, "uuid": "6a8e7f24-be63-4196-a08f-196bc1d212eb", "comment": "Malware payload (RedLineStealer)", "value": "5d5933865133312adc6435e84ae1c9c8a769f6b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987051, "uuid": "ad342fa3-c758-4f25-96cc-1bba7b9414ec", "comment": "Malware payload (RedLineStealer)", "value": "0e10ddf8a07d7b02681c19214443dc262d89548e0f6f22da68a6f2bec817268f2e900cb5a07ed47cfa8da4160b69b911", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987051, "uuid": "94c7ef1c-5392-4002-a949-3f1bff3694da", "value": "T14E64CF0262E2FC61EA224E719D2EC7F47B6FB4725D99676B73185F2F08701A2D263701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987051, "uuid": "e90505dc-1215-412a-8786-168a23f4f3e5", "value": "2a568f33595a0107732fea57be00f8ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987051, "uuid": "93b13369-d395-4a52-83f0-438b04bb9031", "value": "6144:UUo7LVzp15RMgMKr7X/yaXMK2ncYQMjg4pDhTcB:UUS5z3TMgMK/P5XVezN0EDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987051, "uuid": "0bf4241f-8be9-4444-a0c2-9cb24dcdbe53", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987051, "uuid": "7d04ed43-1378-444c-8bc0-3966cdabb232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987051, "uuid": "ee6dbfca-cb05-4834-80ae-82a8b898b883", "value": "07e7698a6858c82e82d952cde2f8750c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6632d804-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PureCrypter)", "timestamp": 1695977497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977497, "uuid": "1ff256d9-d9b0-49ce-bd7e-eecd4fb67f0d", "comment": "Malware payload (PureCrypter)", "value": "f9b5a8a84bd495918fea261121b0c6a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977497, "uuid": "b9be5c9d-7ea4-4685-8dad-ff611dae5ef2", "comment": "Malware payload (PureCrypter)", "value": "1acb5b4a1f0e65cecc73b689de3b048b724523edb6c8abdbc179d541ee7cf3ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977497, "uuid": "cdf09d8c-fc19-4aef-a5eb-0d5dc4906645", "comment": "Malware payload (PureCrypter)", "value": "0781a5aecac3cb4eac12511b35ed1db4c20eb0a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977497, "uuid": "b023fcf5-8490-4260-8823-43de754e3292", "comment": "Malware payload (PureCrypter)", "value": "b35b6704d2ce15d957b99021ff309a2767e4b263114ae42ca6197885db19cb8f8ffec3efbbe426f84a1edffd7f4a9717", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977497, "uuid": "e405807f-310f-4638-b630-7df890732ecc", "value": "T17BA23AC2B6845ABBFD75037064374A50073ABE7ACE51671F29C47B6B3CB37430516A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977497, "uuid": "32fc1e78-36dc-45d2-94e3-cde856b7ed95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977497, "uuid": "093bb139-ecde-4eea-9d28-91fbcf888bee", "value": "384:sk2s+QmI2APL6yRqtxAx+roEOsVK/KO+sB6fO1x:wns3RqtGx+roAYP+9Ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977497, "uuid": "e60a0d49-6653-42e8-b403-2164207fd456", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977497, "uuid": "28ace934-be69-47dc-bf3d-12fa5b273e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977497, "uuid": "f4037407-9148-49c0-8e5e-012853338557", "value": "Peyurs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dd03c6-5e93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695970012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970012, "uuid": "b8a9b779-ca90-42bc-896b-0fda79c32962", "comment": "Malware payload (Formbook)", "value": "e54c1b7dc4d3b31ace903a884289989f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970012, "uuid": "8e4011ef-6845-41c8-aec3-8b4925bc3db8", "comment": "Malware payload (Formbook)", "value": "1afbaaa3bed4cf1ea7975f019b5eac1faf75f78c4f727b32d3e88429ec64feee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970012, "uuid": "f4978644-8abd-42d4-9249-7a7350d0d74e", "comment": "Malware payload (Formbook)", "value": "4ef61cde816fa0c0369ee440badfd47fbffc89c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970012, "uuid": "6ce42383-8bc2-4251-a2af-b8d55f05164f", "comment": "Malware payload (Formbook)", "value": "6ffe4c906b4e381b151b83246d13ab49117e7e5a7492ad145f9b06e30b68a5f22788e80b7b4bf0d8e41c42c0902a9aad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970012, "uuid": "4eff50d8-1f28-4a6b-bfd1-afbbcceaa7e8", "value": "T12D842386CAF4C17ACF568DB488B7A7730FE5151200916B4B1B5D6A6DFCA3463CE3D2A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970012, "uuid": "a1ecc1a5-2104-4df9-9ddc-01f7c4e9a546", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970012, "uuid": "b57db20c-b9c2-4e90-ac53-63bc1e938260", "value": "12288:JnPdBL1hmusy9WyEXKibssmnaRXVo35dRvqk:VPdBLGucBZmEVpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695970012, "uuid": "acbd411a-d4d1-440e-8291-0e5d6db2f216", "value": 394663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695970012, "uuid": "d0d7cfbd-b86b-4310-b03c-6930a07edd25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970012, "uuid": "c06cd5f2-5292-4464-9aa8-8e43811e1e52", "value": "ALLRFQINVOICE09876000090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abaedc0-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987436, "uuid": "0c070510-ff72-4bc2-a37a-9ee3da5106cf", "comment": "Malware payload (Mirai)", "value": "428e62e0c9ad1dfc3bf3fbc30ab01a97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987436, "uuid": "6c871687-1edb-4ca6-8709-0dcc4f8b9131", "comment": "Malware payload (Mirai)", "value": "1b9af587e3e810954c888fa0efa0efc5140e5369c8238a40d8e973a7e99dd30c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987436, "uuid": "cdf6272b-0c9c-48d9-a00d-9db6997669da", "comment": "Malware payload (Mirai)", "value": "1fab01c811a90862520890909df3388b91616b4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987436, "uuid": "edc3f406-e52d-457f-bc61-bded9e28e50a", "comment": "Malware payload (Mirai)", "value": "846ede1f8ccda0aad48bda70e7a5afbe3246945faa861ac75234471c9d5821f1e5b438c76b9069436340fd2a30789e5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987436, "uuid": "3ff530e3-2fa8-4714-b7aa-79c4feb19e99", "value": "T140533BE7F500EA7EFC4EE33644130A09B131F26506532B33A76779ABAD361E44867E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987436, "uuid": "f9181945-59a3-4b7d-99ad-1c4924ffec31", "value": "1536:/Xn434gti+lysr4E5N81Ak8UaD+ZWRnz97n3DRGf23hTx:/X4TLZME53spk5zlC2RTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987436, "uuid": "0d7ca185-ca66-471a-b4af-ac1b46a3f64d", "value": 65676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987436, "uuid": "1d93aef2-390d-4ec2-b346-505a4ad9b1ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987436, "uuid": "4407c485-29ff-429b-ba95-5f059f8a9d29", "value": "428e62e0c9ad1dfc3bf3fbc30ab01a97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233d7f77-5f10-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696023341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023341, "uuid": "0b73d6a3-18bc-4d89-8588-af7282d6a97a", "comment": "Malware payload", "value": "9a676fa0ab3a4529660de62cba800b0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023341, "uuid": "ddd34d46-b901-4c07-988e-7072b4ffd7cc", "comment": "Malware payload", "value": "1b9e7c91ed999dd6074fdacbae68eaca98a10bf29f533e9092723e61801bc3c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023341, "uuid": "784c3eae-dc11-462f-9779-960a4c52ec01", "comment": "Malware payload", "value": "004e23c3a2dadb18aa7fb1127689a4856627bb86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023341, "uuid": "9b94f052-f78b-4f47-9bce-84e3d2f515e1", "comment": "Malware payload", "value": "52c0ab521bc0c10e2b1a7884d1303984e25b7eaacda323f38a291b8cbb1e14188164037631fae42166047c1e27b226ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023341, "uuid": "d4484817-9bbb-439c-8c8c-3d7f21144850", "value": "T19AF43313D2019EC773EC2DAD8525BFC271F8A9A60594725746B1682E084BFCF7C39E58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023341, "uuid": "a9e5f76b-f998-4436-8e4c-ec144d9c6d8c", "value": "12288:c/SdtOTLTQRwFiq8GcE3P6/JNROYETN+RDehtx1h:KSdtOToQp8GcE3P6XIrTsRwbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696023341, "uuid": "b77fa4c6-497e-459f-9739-6810ea53522d", "value": 733248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696023341, "uuid": "d2e9afea-6463-4818-959d-b1dc270a5062", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023341, "uuid": "015d277e-6a50-41b6-8148-a2fbed177621", "value": "@01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49d1366-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024497, "uuid": "69c5fecd-2041-405d-8ecb-8620013595ed", "comment": "Malware payload", "value": "3ab67c27d9e1736f4a1ce3add365e544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024497, "uuid": "ed59a0c9-35f0-410d-b496-4fd140dee502", "comment": "Malware payload", "value": "1c28b4b8e7eda34b94c06147551a7c88d3eff11986a3d4d9ebd25bbfee5af5ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024497, "uuid": "c06c2312-6108-4b5f-a5da-4b19a10edc87", "comment": "Malware payload", "value": "6bec26d514d91d8d2ef57fb7fd833a0bec7e325b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024497, "uuid": "011cc6da-1078-4bc0-b7f0-ce836848a13e", "comment": "Malware payload", "value": "316a705f999bdff19d6eca8d75f44155403c26d917ab76c89c8bba2d8ed31b66f9a8a13d71831991854ab1cc5d2403b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024497, "uuid": "42d6fd2d-6106-42d6-9a59-82589efae326", "value": "T10434237B90D816BD1BEAD3E408B0D7C43BA76484B9469F2D8614EE8134DEC85CD873B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024497, "uuid": "5d406334-6ded-4f91-88bf-f60df6bf7ed8", "value": "6144:9BaIu/HptcYhiqFjktISI2J9xqi63OqfkEBkfHH:9BapdiK89Roi63OqfkkCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024497, "uuid": "7b14653d-3f5b-455a-906a-68df440c9bb4", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024497, "uuid": "a82b4423-447c-4abb-a6be-83ba6ef2974b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024497, "uuid": "170e8232-eae0-4d15-a609-d0f42d17a68b", "value": "288344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab3bf18-5f1b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696028131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028131, "uuid": "ce0367ca-65af-4d18-94a3-226e05a63d5b", "comment": "Malware payload (Amadey)", "value": "15ed191ba76383decb3024925d8944f9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028131, "uuid": "a52faccd-2c46-49cf-962d-d89aa8c2fe41", "comment": "Malware payload (Amadey)", "value": "1c3715533760b25561a481466c9d5187f70c4767b4c78d3b2b80f03e2e7d5055", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028131, "uuid": "1fec94aa-cdbc-489e-99c3-416292b0ced7", "comment": "Malware payload (Amadey)", "value": "0ab8a7a0c7c2d924e750c4d6feda97dafbff921d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028131, "uuid": "0e8a25a7-887f-41bb-962b-e3896f108aa6", "comment": "Malware payload (Amadey)", "value": "e698c407a45140564f6c6424358795c3a8d8cf2b14000388c1732ead2be2ba083c10669d6bb84c47c9f53394a546b626", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028131, "uuid": "77a75fc9-d8a0-4bd8-8131-393d43db1216", "value": "T187352312E6D8A530D97627702CBB06A316367E361D7842563B42CC990CB77C8F636B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028131, "uuid": "72ce6ba4-222c-418f-9dd9-a3aa4547c49f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028131, "uuid": "e90b2455-ff45-4bc1-a6c6-c0cd2abbceb0", "value": "24576:+yiPXwqPUe66Wo6QtymBGypUhK1dfK/3bCpm560jv:NiPgqF1BVA6ZpUhyyI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696028131, "uuid": "28ea3128-c8bc-4c66-be6e-d55574264738", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696028131, "uuid": "800f531b-cefc-48af-b3a2-68a30c2be655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028131, "uuid": "7ab92b55-70ea-45d7-8e27-b041fa25070b", "value": "15ed191ba76383decb3024925d8944f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9e5712-5e8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695966606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966606, "uuid": "8c00d4ca-8b7a-4bc6-8c75-1f187760a97e", "comment": "Malware payload (Gafgyt)", "value": "3462a86f19e6c7bc1e520098d994a55c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966606, "uuid": "f65b5903-610a-463f-a33b-d5059a0335e1", "comment": "Malware payload (Gafgyt)", "value": "1c54db457a4af53e77d9a10254131edad64596835ad298d7a5c0dc708d75e0ed", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966606, "uuid": "19f6f671-d597-4d43-8982-442298f1aba1", "comment": "Malware payload (Gafgyt)", "value": "a319df1a726f2170b690ed725cf6f4c2064844ee", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966606, "uuid": "6740f65a-88e5-4f88-9fd3-a4fbde7503a2", "comment": "Malware payload (Gafgyt)", "value": "61342a0dc04b64352d40ac23ea97a0bd48004319a53e96fc22778e6ea2ddd1325eeb5599e65a42e13fead36536b3c25c", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966606, "uuid": "11ad9f4d-4870-4745-be4a-219b99833408", "value": "T1AA0423AA3E117F79D8E58B7947F21AB0C35A74522262DA51D36CEE289F713CD084F390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966606, "uuid": "02b5deb3-2fe0-4376-ac01-df25195b0fb0", "value": "3072:w1uLA+dDARbI5hQGbnffwRAmne4qWwzsqqj:euzEe5R2Amne4qWwzsqqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695966606, "uuid": "11053340-1cae-4e14-a811-dc632e0fceda", "value": 174385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695966606, "uuid": "660170d3-bb76-4608-90e0-eefa3ac17b33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966606, "uuid": "e2a7ef3a-3504-43b5-b3f0-55a8ec333fc4", "value": "mps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df246a5-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695977402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977402, "uuid": "774036e1-b276-4713-9991-e41815905bbe", "comment": "Malware payload", "value": "90bff409b8f58d827740b65f674d1015", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977402, "uuid": "577ad634-82db-433f-bb33-8acc2843ab38", "comment": "Malware payload", "value": "1d862176fffa70dbe9e1ccbc6986c1a26d7bf2f8384c26de4f8c9c492a9368e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977402, "uuid": "6b4abaab-43ac-4d03-8c3c-4ad83b66041e", "comment": "Malware payload", "value": "a04b5710d353977395e861893726aee9e8d8d783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977402, "uuid": "5add5f2b-6680-4892-a1fc-98d2ea12dbfb", "comment": "Malware payload", "value": "0fb8a851dbef88087131e69a2d19c0c96b5d98b109030fa5a0ed9eaf6d22b9ac9ecb3f2dcd8cff95e78f5346d44be836", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977402, "uuid": "ea724d4f-feb2-4e76-9469-07829098fa0a", "value": "T1A9D47D12575C6A02E78F53B6E2108939C7F6C121A3DE6B9A59C5EDF81CF7F14E80089B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977402, "uuid": "31c3e39b-30aa-4c34-9a78-0c929d8d8b69", "value": "12288:Vf6TL2fgsNc5p0sSksyunTHU+DyGar9JyajiV8R3V4TY3:Bjs99++GaFiVw3V4Tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977402, "uuid": "17b5f57b-90ab-41b7-9159-8d78ca4c8c11", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977402, "uuid": "44a74c4b-b1db-468b-b15c-3a37eabaadc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977402, "uuid": "691f3004-a5d1-4e1c-97d0-25169b7fbd0b", "value": "Gztoqonzcv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9f65c6-5ea3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695976841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976841, "uuid": "f444c878-0f18-4c55-aef3-75507348019f", "comment": "Malware payload", "value": "f08c0b6803602943d8ae017027845a14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976841, "uuid": "360be1b2-7f4e-4422-ade5-d979239ae3c7", "comment": "Malware payload", "value": "1e68134caa808e6a8e4f0d54ad79e3ba3f7db9a9c7a407837efe5990493ced5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976841, "uuid": "a9ebce83-6c10-48bc-98d2-7959730a266b", "comment": "Malware payload", "value": "ed04331f58011ca18ad75054142553a6f4fde4f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976841, "uuid": "b2180f22-fcd2-4f47-92e7-6a6d22a7db90", "comment": "Malware payload", "value": "5ed48bb6f73b666d1c60308c66ece615747d52282a68bae7ae54a4f825234bc5393ed755438abcc672af06d2c4d5e805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976841, "uuid": "75497272-de0e-4dab-99d1-599589726c41", "value": "T12236123FF268A13EC56E1B324673826099777A61B80A8C1E07FC354DCF765601E3B65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976841, "uuid": "86b00c4e-42ba-47ac-a2d9-968ae55e8edc", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976841, "uuid": "8c00e1cc-e233-416e-a164-fe86e143d232", "value": "98304:ykLEpls+yc8Gr0ZjL7uWOm6qCNqjdySicpxXHR1fSd2xat29s4C1eH9s:dEPs+ycFI5LasRCIDDHRdct5o9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695976841, "uuid": "71b43b05-8200-4579-9558-f29203211abc", "value": 5135013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695976841, "uuid": "150eb21f-4e58-4bb6-8035-5a829e9e0123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976841, "uuid": "1e78b3d4-9fdc-4393-8df3-c572c8f89f24", "value": "f08c0b6803602943d8ae017027845a14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0df0244-5ea6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695978105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978105, "uuid": "92f8815c-2596-4d53-8c9f-674a088a2f13", "comment": "Malware payload (AgentTesla)", "value": "10cfa81391265f69579693faf04281e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978105, "uuid": "931af05a-d564-477e-a751-4f6c82cab457", "comment": "Malware payload (AgentTesla)", "value": "1e7f5604e1d8b3d04603daffad0a90767b5dd09a639ab9ec783e3bef0df196e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978105, "uuid": "c87b153e-ea95-4119-9c5a-c32ba5f91994", "comment": "Malware payload (AgentTesla)", "value": "4d45dc110242ccc80748bd8b026bed22cc006ab6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978105, "uuid": "30c29b36-0c4b-492e-b72f-30a139ce4122", "comment": "Malware payload (AgentTesla)", "value": "58ce366ef0990f5f64968a95b323fb8fbb27a3ef88d3e5e847b784dc61e61e8940f310a3a6004cfb877bfe6748f59c5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978105, "uuid": "f81f12ea-206e-4734-a5e3-e1620a52991a", "value": "T1B2D423AC34C98B55C58C17BA1A9D562743307A90D313CB79CDCF19CB9BB231D2660BBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978105, "uuid": "1d5ce373-e6ff-4e98-9c38-a4e13c68b415", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978105, "uuid": "922fac88-d2b1-4acc-b9a1-e2a15bc0d2d2", "value": "12288:9725wZUGY8/RelZdnHIip/keyfWhMkmyw88SJ:EiZUSRonoip/0WCVV89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978105, "uuid": "12a5473c-3e49-4895-b3a3-6e654e5d164f", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978105, "uuid": "9fa6ba65-d89b-4a57-a17a-30365986d367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978105, "uuid": "c412ed4d-ea8d-47f4-8ee9-b2950480165d", "value": "CV_1.docx (2).Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbdc6920-5e9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695972970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695972970, "uuid": "fdcc1d9b-519d-4d4d-b040-4c8ab63280f5", "comment": "Malware payload (Formbook)", "value": "71f512d16689197ac0ca673fcf8e0d65", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695972970, "uuid": "3dc073a5-179c-43c7-9bff-14ef48a3eea0", "comment": "Malware payload (Formbook)", "value": "1e8eb41fef0fb0bde52030cff289b87abcd631c72f79d7da7b1f5ae6815a13d9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695972970, "uuid": "56e01bea-0fdd-4b14-9f83-1626b514a875", "comment": "Malware payload (Formbook)", "value": "4ebc2126574bc2d69ee7307c90d57ea5b2320593", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695972970, "uuid": "e0f0014f-3d80-42aa-bf00-736849aab877", "comment": "Malware payload (Formbook)", "value": "b0277e6bfe2de9a1dd42cbb0bddc29680e6622d84cde235029955fed56d9fe7f3d8be09992eaec5cfa9cd48c6a5188d7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695972970, "uuid": "1e3e72f6-4a4a-42aa-9e21-694ce722803a", "value": "T1FDA39A68E34F02A98F61227B9B1B0E5491BDBA3EF65011B1745C433533EED3CA22627D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695972970, "uuid": "e6606a2b-0802-4b13-94cc-dce296939e7f", "value": "768:5wAbZSibMX9gRWjEB5RIvn0F7JP0/w221Xf4Ksl6B0BrBKXEXqC:5wAlR/Ia7t0/wX1Xf9m6WBBH6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695972970, "uuid": "eade1447-fc9b-4fec-a023-bd896ef0dbc4", "value": 101826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695972970, "uuid": "b4c5683a-b2a6-4976-aff3-f995e90d278a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695972970, "uuid": "95b02a5d-eee7-43bd-a894-0e3e1ae31f9f", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.10125.11811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384df9f4-5f10-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696023376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023376, "uuid": "7d7482a9-1020-48ca-94f1-0577af4e7525", "comment": "Malware payload", "value": "7a489db4d288bb70d5ec8f9068a5cca1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023376, "uuid": "c7e05971-e264-4449-a6f4-828cbc8fea76", "comment": "Malware payload", "value": "1e98571f0d9733fb4614ff282be1d7238721ab3f7218e1178f9f2cc45d84c959", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023376, "uuid": "662ba3db-c262-4b6a-a6c5-5084422f68c0", "comment": "Malware payload", "value": "a7d6552bc64c21a6beda3027648b0ad5037318f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023376, "uuid": "db950d63-2bfd-407d-b805-d57216bc1d44", "comment": "Malware payload", "value": "e2b60e706854d99224cfbd8d2cd6926a80daf5fa97b3519b4f86c242385269ea9e849cf3d4c6254567d08d43245132a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023376, "uuid": "e704dcca-b2aa-4fcb-a33e-756a52609ae5", "value": "T1DBF423C1D0F3878C5829463973EB06E499AD3E32497AE9C2A69A3CA6745C347723CB15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023376, "uuid": "b5529fa7-b1a5-4a96-8a73-847ac0e1bff2", "value": "12288:rlWB7oXvNT97OSjc57FndhdLaoSlve7e5YPuUZs8xBadJYBKxvCHzopbfYfyVwL:M8vzOS4579dklve7eG2Gs83i6gaHUpkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696023376, "uuid": "7808c245-7e76-4bbc-b2b6-9fd658ed872e", "value": 733248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696023376, "uuid": "7e70de0f-01c6-4d68-a85c-914f0a3a609d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023376, "uuid": "deef17d5-1945-4a9e-9372-b498e6fc0d51", "value": "@02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be3fbb0-5ef7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696012698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012698, "uuid": "7ca3b024-ea43-4c96-bfc3-5868d64d9b91", "comment": "Malware payload (Amadey)", "value": "ef66835a28c5da29d069a4d4cb3a4884", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012698, "uuid": "22cc3795-f1df-46a2-ac91-affafc531d19", "comment": "Malware payload (Amadey)", "value": "1ed15d7ed3f2fc3e8ebcae4e67252c026805771a5786f8177de54e7f8c28bc5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012698, "uuid": "82de3231-c7be-414c-ba01-a05d59554930", "comment": "Malware payload (Amadey)", "value": "6307f88c46ad434bc54b03ec7cef30ff58bbfedf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012698, "uuid": "833def95-c87e-41fd-aea5-4bb3fe836544", "comment": "Malware payload (Amadey)", "value": "41063b3fcc9b22f4b1a0eb58fd22674fb7ebf5010447906aad760be301a34a660424491a059cc9b55f5233e9e573001e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012698, "uuid": "d41950d7-9847-4cd5-bc77-b8374353cba2", "value": "T10834BF11B4E1C073DC7A25360AE4EBB95A7DB8300AA15AAF67F40F7D4F34281D631A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012698, "uuid": "c8ade2e8-07c1-46ed-9172-5df8a9f182a7", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012698, "uuid": "58d03c24-b8f4-46a7-91c0-c7d302944071", "value": "6144:wzz4SHy5uoBMFGV5PEkIXEHvZAOCkRhHXoVs0BC+:xCmuoBMUOMx1HHks0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696012698, "uuid": "f2c6ab80-f1c4-406d-8359-94c6719649cb", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696012698, "uuid": "99320598-bc40-4c55-8239-52a2336ee22b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012698, "uuid": "8639718a-6e5b-40a9-b0ac-8a93c33470da", "value": "ef66835a28c5da29d069a4d4cb3a4884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270c0741-5ea7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695978250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978250, "uuid": "3a422890-0cb9-4ede-a4b0-9c7ebda1ab5c", "comment": "Malware payload (Formbook)", "value": "5a260cd1c4c74abfffba83be3ac024f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978250, "uuid": "f7d8d842-2a95-4a09-9671-66f6db299304", "comment": "Malware payload (Formbook)", "value": "1ef0585dccde8a7c1fac3374d6d4db5abc92a24920f76b9063cfb1e5baa4f711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978250, "uuid": "6cc15288-557f-49b7-a38c-7e134206f0dd", "comment": "Malware payload (Formbook)", "value": "23be471da5a3af35ec028ab9f5351a7c983aedd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978250, "uuid": "bcdc1fa1-1dee-4d2f-971b-79a372b9b744", "comment": "Malware payload (Formbook)", "value": "0dc6daf4a023dd5ff2a2b731042de11d2e3f664b77d08e2ba1d3de19e6140ad3e00aafa245fa0d88a84860f51a70da70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978250, "uuid": "45a31399-e6da-4420-98da-285c97aec817", "value": "T162D423A6399E8B64D98D067E87EE00594370B640D404F368CA8FA6DF0E7D39C6621F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978250, "uuid": "22e2824c-7a7c-4edb-9993-da50bad2e238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978250, "uuid": "2e0dc95a-c896-4117-94c2-26e4df49a71a", "value": "12288:wO725NgQfjBqCmRAHSrEzA15uctWEk/dnDqQ7MIV:wxfjcqyTHtWEkRqUMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978250, "uuid": "39e176dd-dddf-4c1d-95b1-48a3ed21a965", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978250, "uuid": "6dbf0a11-cf73-4a8e-bd37-9d40070efe50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978250, "uuid": "bbb82ec4-b6ea-4cc6-8ae8-fffe68045901", "value": "Shipment 6345AB Toledo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97dca223-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986599, "uuid": "9b1568d1-d807-4aca-8ea9-a0694a56aca7", "comment": "Malware payload (AgentTesla)", "value": "fd2c52c8a3fdfd8015400a1ec02b8648", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986599, "uuid": "387a9664-0c67-4dc2-82f8-de4e2b11f1f7", "comment": "Malware payload (AgentTesla)", "value": "1f3b7f3ad8b73e19d81f88cf2a6f78e99bb92d4192dc9e73ae5a571e42a2daea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986599, "uuid": "2ff534da-128d-4c76-b116-1be4b614a390", "comment": "Malware payload (AgentTesla)", "value": "dbeff047a9094f2e684802740cd88b4dec1b926d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986599, "uuid": "988a83c2-c88d-4d69-b3bf-c462f44b56b6", "comment": "Malware payload (AgentTesla)", "value": "883b0ab6c023f60b00e0130458d41a899bc70677fa9974519d0993bad11e41f7ab76c8fc701502a0614820c32b5ce7b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986599, "uuid": "ad0b39d6-5cac-45a3-9579-33a166fcfde8", "value": "T1AED4231E99BA5730CEDB54D56EB2D0B99B0270730231250EDD4B1AC4BF1A3A3721DA5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986599, "uuid": "e342d618-8d85-4369-8cc3-e2f190625774", "value": "12288:GDVkMXcEZ1EE9z64BpZrmSPq+LllMSLh4/yAumAkwpTu/nMkPpU2b:6VMErEE9z6apZrmELPV6pu/kuC/nM0Zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986599, "uuid": "5ec6d674-6dd7-4517-8980-885089fbf651", "value": 651317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986599, "uuid": "abc68c7d-ae90-488b-a6c3-fe922af1337e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986599, "uuid": "1a5ce330-f566-469d-86a1-a60b3f837fd7", "value": "PO-4501336858_WJO-003.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652a6d1e-5ec7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1695992098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992098, "uuid": "a7661edc-6286-4d7b-afd2-5227d91db6f4", "comment": "Malware payload (RemcosRAT)", "value": "2dddaa9f2ed801d55242f73524696ef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992098, "uuid": "58934fbb-f3fd-46d8-bf49-139f10f1655a", "comment": "Malware payload (RemcosRAT)", "value": "1f667508b2ddf652347fd73ac2e084cb004a8616cb04282e59d3ce63ab1e959d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992098, "uuid": "3c9922d2-44a2-4e60-ae39-2020950b5de9", "comment": "Malware payload (RemcosRAT)", "value": "dea46e90d5f26425eb6ae7aa0e36d313b02fb132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992098, "uuid": "c4ad12b8-0aa4-4e9a-8576-0c18f2cddb0d", "comment": "Malware payload (RemcosRAT)", "value": "5979a5bfd9e37559681c8af2aaa5befa847964345bcbd671349d18a9b75d46d9ed311bcfb0e5a03cc689b4c7409ffe4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992098, "uuid": "d9d886ad-6296-44c5-ad81-4027657b1452", "value": "T12D15C003BA5F46E1D6CA1737D9AAAC848BB0D443F28BD729748D23F658433668D05E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992098, "uuid": "71a962f8-c8ec-4611-a08a-c4fd291a9130", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992098, "uuid": "fcf0f65e-6ebe-41ba-9f83-a11dd242f070", "value": "24576:3Y/WNHhinydd/ST4ndNlJx2De/EbelEs:JBwydZK4ndNrxme4eB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695992098, "uuid": "876003be-84aa-430d-abda-20aa3e9f4da1", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695992098, "uuid": "96790bbf-b4d0-421b-863a-419ef3608937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992098, "uuid": "83feb3a0-9882-4c92-91de-7e260615e507", "value": "BG279a23_NTH_Viet_Nguyen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cb6dd0-5ed6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695998667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998667, "uuid": "ed2da9a8-407f-43d5-805f-325cf11eccb5", "comment": "Malware payload", "value": "ed8594b20e148abdaccf94a426b1a622", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998667, "uuid": "980c745b-66af-4339-84b7-f7538c7d9bb9", "comment": "Malware payload", "value": "1fdc2e0cc63c9ec3d8ef30dd56ad226a255eb4189dee5b35daa1ebf15ec3e9f0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998667, "uuid": "04070481-dd13-4b2d-a2de-19217ac4fb09", "comment": "Malware payload", "value": "7778eae252b0508f9723286d1984f051373b9862", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998667, "uuid": "a15f00e7-228e-464a-80c2-bfe0fa3b3da5", "comment": "Malware payload", "value": "a12834fdb78afb1be704a71b75f4a216d7df87ecc98e0385dfbe7ba92aa20d6b8bf18f38274000702d05d06c5d49dc71", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998667, "uuid": "03d016af-b9d2-4353-8f72-9b89aeabcd18", "value": "T1AD25AFB875047DD6662F576BDA96ACED03B62B6399CBA4CC80647BC305A3335FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998667, "uuid": "7fa5fe48-3b8c-4c91-b376-3f91fceabf44", "value": "24576:pC+BFia5SuWBxzwJXwmsyfll5+gY6YaKmlxHJXhjFJs6mNgmp4Urzp:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695998667, "uuid": "dd1ecfaf-b515-41dc-b7c0-09407f3c69f7", "value": 1031327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695998667, "uuid": "a7158b0e-e9d4-4a52-a137-b9fac07e6107", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998667, "uuid": "3068c8ee-6fd0-4b44-af28-88bfdbfe084d", "value": "RFQ-E3443.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fbc9af-5ea3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695976658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976658, "uuid": "b1f25b6b-cdff-4c47-af40-d27be35722e0", "comment": "Malware payload (AgentTesla)", "value": "d6391443a37735b5d8dfd52bf4a45914", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976658, "uuid": "6fcf0940-c9bd-40db-a892-fd5b8e55101c", "comment": "Malware payload (AgentTesla)", "value": "2029b84d785d6e3379aab8455ffd8ddda16c01304d507d9dc009d71186da2009", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976658, "uuid": "28f4bf0b-d544-4171-a8f0-64aff36273e8", "comment": "Malware payload (AgentTesla)", "value": "96391f1ef23fe27f576f5920b747dbd29a8c4acc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976658, "uuid": "3cfc6c8e-69d1-402b-975e-845c8e129e6e", "comment": "Malware payload (AgentTesla)", "value": "ec60accdbfe89fb8bc356b6d424b35c239ee1a0bc7b26d257c14760174fae3cad3b1ce056580f729ff23e794f1d6ec02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976658, "uuid": "fbd76330-96d0-4cd0-87c2-9d0393046433", "value": "T132D401217AF94B5AE5BE8BF5442A5A080770A4BE251BF74C0DC7B1DB26B1F40C610F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976658, "uuid": "3df447ff-29c9-446b-a01a-9b8aa4888cac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976658, "uuid": "20b3b1b9-f992-459d-8622-cfcfb61c5e0f", "value": "12288:s2XyiRJU/Wcp5GGHQIOhKVVovwBJV7cFKKbvqVnjqV2A1M9rD1EE:9iFeqHsvGObDqVGgA0H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695976658, "uuid": "0891bc75-25db-42a5-9fca-20ae544d550f", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695976658, "uuid": "5df60093-6d3e-42d1-8883-1be49a4cd42a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976658, "uuid": "0c46926a-a693-423b-950a-53898c2ab6fb", "value": "SecuriteInfo.com.Trojan.PackedNET.2402.6534.13640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef33e13e-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695977727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977727, "uuid": "91a7b9e1-fe4a-4124-b7af-3a1d6bf825ca", "comment": "Malware payload", "value": "654475d8c1d480ec35da987d8803fa2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977727, "uuid": "90a5764a-71c5-4c6a-966f-4e013066f80f", "comment": "Malware payload", "value": "205ec3a913c4138ebee48bf2f583cec1d501494cc8aa25a01c19a8d4e2182f00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977727, "uuid": "b11a0966-0b1f-4643-bf42-7819ed9b0a0a", "comment": "Malware payload", "value": "f3a577724fea18bc2b8cb3012ce2e2b4dc5c796b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977727, "uuid": "925f2ffe-f69c-4e51-9330-2eac59d5fc63", "comment": "Malware payload", "value": "19b5b030af0ebec715bc6ee58d1980ad00075d403f70a7dc770b13ec8ce1c7c56ca2bf3b585b65898b6e5baaa017576e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977727, "uuid": "60c1d470-e2f7-4470-b3bc-fbc9c6ce8e32", "value": "T1FDD2B71E535CCA72D85372B59C1B66B2272CD631CB623F6B1FF4AD1A1DB22C809E2530", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977727, "uuid": "886f8b65-1807-40a9-999c-f51fce6dc73e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977727, "uuid": "259cb753-9ba8-46ee-b4a9-de23978d1da7", "value": "192:WrcZBNu0gZzHhaFzQxSKM+QYo03AiP110se9eae3e3eae8ehezlTSBPxSqDu3SDX:3pcDhkQxSKW03AU1g8PxlaCDfmI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977727, "uuid": "288f924c-e662-49ce-9548-879b5f825f67", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977727, "uuid": "c13206da-efbd-41a0-909f-932354add275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977727, "uuid": "f59cfe98-ee68-4410-99ed-926945cafa37", "value": "Xtfmrvcwu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a9826f-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695986535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986535, "uuid": "54236cfb-d1c4-4135-8361-c04f52852027", "comment": "Malware payload", "value": "0673b734e2501f943ea111ad097b34cc", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986535, "uuid": "50f379a4-dafd-42ba-b34d-e26b1aacefbb", "comment": "Malware payload", "value": "2095c2af3c786e62ddcdf77e0a4ae7eb6d1cbdf6ba993fd8e7ebbc5cf1b04211", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986535, "uuid": "f5c20748-a079-49fd-ac25-a6a792bb604f", "comment": "Malware payload", "value": "50e4a9adc58c9c5400b7b13ff78c243eb122d0da", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986535, "uuid": "a0ae1bc2-3599-4e7a-9421-b078a28a19e4", "comment": "Malware payload", "value": "8ddbcaffb0772467b63215aa5e3c41fa6a76d877f0896aa9eb9b06c62a50fd27882d50e69cb31bd1b45ae1ff4e9ac31c", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986535, "uuid": "fddfb3ea-9fb2-431e-b23a-d64db27214cf", "value": "T11F529E1DE509FC29C2B6E57EC52D50FA698C6288C542F94F2212FA1D3B194D7172F2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986535, "uuid": "0d605771-2a3c-4289-b1f1-1b02704f244a", "value": "192:8j2VuQFDdQXjRPznaoH4+dX42I/+pm2K1lO7GRrFEBPJ2Z3Kmy+8Cvfg9HvCl:8yfFuNPr/HDX42ImQ2PpBPJ2cP4vfqCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986535, "uuid": "1216065f-c710-40a6-a354-d980e634a7e3", "value": 14480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986535, "uuid": "d6ab5a82-5b25-45bb-acd3-18501c05f8d5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986535, "uuid": "780e18d9-ac44-472b-9cbd-70cb94d2cc4c", "value": "ram nath1.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4230b295-5ea6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695977866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977866, "uuid": "bc581807-9cf7-4e0b-b219-bba18392f55e", "comment": "Malware payload (AgentTesla)", "value": "3119e5091060068cc37c8478d241d038", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977866, "uuid": "f60a0e64-1334-4d08-aa60-6f666381b555", "comment": "Malware payload (AgentTesla)", "value": "2138dbdfee8ee957a0b9d2475b12d71e80a4e93d3f70aad66015bfc332021a50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977866, "uuid": "f4808dcf-9f28-41cd-a03d-710dc51797cb", "comment": "Malware payload (AgentTesla)", "value": "43c694b17d97b712f61e1affe90a3ee26e8caa5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977866, "uuid": "90efa1bb-3fcd-405a-9df1-88d86e71ee1e", "comment": "Malware payload (AgentTesla)", "value": "d0a6ef41bcfc0be8fd2f185bacf779ac7c9ee438ec84bc4d7d53a089c82acc6364d3c32cfce4d040d52fe4971635d34e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977866, "uuid": "7110f0b6-fd36-4f27-86ab-276316ee95c7", "value": "T120D422EA7A854356C58C2B752B6D222783B0F612B117D73C8E8F259F0E3835519A1F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977866, "uuid": "6d4d5672-3b74-403c-a9ba-b60965901bd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977866, "uuid": "548a6cea-778d-4202-a7cb-39ceb19c170f", "value": "12288:SG725HiWxZojfp5j9rGm8/JldjqxH/aWCZe2COj6b:6ti8Zc5dcdehacu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977866, "uuid": "47f61c70-8a9e-4f88-acde-8a1a1d480e98", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977866, "uuid": "19f1506e-5b96-453e-85c2-6461a991f44a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977866, "uuid": "7140575e-1d93-4c82-881c-810c9a88490e", "value": "quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee04f82-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PrivateLoader)", "timestamp": 1695986584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986584, "uuid": "9520430a-b9d0-4346-8c94-08551f0aa71f", "comment": "Malware payload (PrivateLoader)", "value": "b9a096baebdf8e44368e9724da8e56dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986584, "uuid": "82beb0eb-cd0b-4a2e-9e00-cbf8c46478b0", "comment": "Malware payload (PrivateLoader)", "value": "2157d146a890d32c5ba49f31fa1840e5b0d56e4dd0bbf5f8b14cc4e482a47bef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986584, "uuid": "46f067b7-b61b-4f45-835c-012b350a41d2", "comment": "Malware payload (PrivateLoader)", "value": "f9873fa92ae8b75e23e353f43ae1ba9087edebfc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986584, "uuid": "f534490f-836e-4d76-b39c-a0b486173a36", "comment": "Malware payload (PrivateLoader)", "value": "f59019b2e23115316db5bef8b2435525c2b61aece8f86aa95fa55334b098921637a7380644f491093eaedd4e6e3d74fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986584, "uuid": "c04131ed-607a-4a82-a4e3-6aa990eefa91", "value": "T18516227363B4114AD0D1CC3AD233BED172F503578A86FC792ADD68C624318A6F613AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986584, "uuid": "1d61f4ca-d4b9-4d27-bbd6-a72f4bceeedb", "value": "a30456d356096db6c5256124ce90b11d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986584, "uuid": "9e5308ff-be9c-4980-a247-146dbe45256a", "value": "98304:OJhDwVgp97vYIP8nq5g88RzpufFdx37e5vQCxt2xWwESu:OYVgLs1qlYp0Ff37exTjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986584, "uuid": "7f0570be-ef0d-4a5c-8e2f-7ee8915ea274", "value": 4185600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986584, "uuid": "3d0973f7-ef43-43a4-891d-9eae005bf00d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986584, "uuid": "bad120c0-efea-47eb-9394-0dc725817745", "value": "b9a096baebdf8e44368e9724da8e56dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1886bfc1-5f17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696026329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026329, "uuid": "9a062da4-9fe9-46d0-9119-4a14c2bb453a", "comment": "Malware payload (RedLineStealer)", "value": "780d2e800f96ba58754479f096830f21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026329, "uuid": "980e6ecf-2a18-4b61-baf0-b8d13e9b3849", "comment": "Malware payload (RedLineStealer)", "value": "216e2221b99ee5579841f6a626348a6a8db8df0e2eb844b2618dc0164ace6489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026329, "uuid": "71ca5cea-aa7c-45fa-8760-6d414baec0b6", "comment": "Malware payload (RedLineStealer)", "value": "c69e55688d443d68d4aa791b036ee26aaef2dadb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026329, "uuid": "b5986a70-bf02-4636-8297-cb6d4413d282", "comment": "Malware payload (RedLineStealer)", "value": "a670049975f4136bfcca44e34f65db5e1218bd543358439fcd0e1d953814387e88b966196855507ce9fb0ae07267ba2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026329, "uuid": "df07fe8f-9f4b-43fd-9b0e-e2403a3babeb", "value": "T1F7352365AAE4D072C9B5233428F727930A33FED18C78566A33958D4A1D723C1B8B537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026329, "uuid": "29a9a067-e788-4fc1-aa45-67a0e4c43498", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026329, "uuid": "fa41cd7f-c972-4a58-af37-d450dfbac451", "value": "24576:MyV+svCgyP3BNNDcvRER1hc3rCv6T8L2ngcg:7VTvCDRN+UaWNan5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696026329, "uuid": "687a77f1-2642-4580-a22c-665ac085f228", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696026329, "uuid": "1ccceea3-011f-4337-b358-40fdcc263a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026329, "uuid": "7f446a07-0e58-479f-ba17-7eb1b32fed20", "value": "780d2e800f96ba58754479f096830f21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255b1131-5ef8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696013036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013036, "uuid": "ce148a6a-67c3-4fef-9c49-182744208e01", "comment": "Malware payload (Mirai)", "value": "7d052f6a3be6dcc01517f1209e52a9f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013036, "uuid": "740f4268-554f-4f45-84e1-17e5f2ff071a", "comment": "Malware payload (Mirai)", "value": "21f6e098a9130170af351ebbb3c030e4dc2376593c464819cc36cf19cd429ea0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013036, "uuid": "310cd11a-80f5-4c50-a345-1538ce5b0530", "comment": "Malware payload (Mirai)", "value": "a6eae436c8fb0ca383ad7c56df60badb406ae025", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013036, "uuid": "d7dae9c7-8193-42fc-a394-b675608cb48a", "comment": "Malware payload (Mirai)", "value": "2577962a93473bdfccf9487613db9c8e48f6dd066c1efadeb71ec62acbf1216588cbdf1accdf27dd7e5f4fcb05f18be0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013036, "uuid": "dbb4cb59-5c7a-4867-88f5-d185872b43ec", "value": "T1A1431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013036, "uuid": "076d9c7e-ea40-44c7-87ec-f22e7642e96c", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwj:RqtmZPuutfbltZFBSJsBcfDSTFI+BEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696013036, "uuid": "31b60d64-eb14-4ada-bd64-bbfbad9e828e", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696013036, "uuid": "b134e2d7-47c5-40c7-8457-4ba954d1963f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013036, "uuid": "7deb60dc-2368-49ad-a83d-eccad576a682", "value": "7d052f6a3be6dcc01517f1209e52a9f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89dffb4b-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RevengeRAT)", "timestamp": 1695987435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987435, "uuid": "f1937a4d-a476-4d4a-be3f-a0704d98d8ca", "comment": "Malware payload (RevengeRAT)", "value": "db68f317719999e99390a61384487e9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987435, "uuid": "c184b1fe-5ca1-4ed8-8ff4-773dfef57c73", "comment": "Malware payload (RevengeRAT)", "value": "2237fa0edf4d29fa10696480f45923989e0b982805e03abadd1716cd6715328e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987435, "uuid": "d32aea57-d1b4-40ff-b418-d9fde21e6a3b", "comment": "Malware payload (RevengeRAT)", "value": "e4961156fc3fc45ecd98fc6c3ae5ee8e5f3fdd40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987435, "uuid": "93d271be-4661-4cd1-92ec-f6f25e4d48de", "comment": "Malware payload (RevengeRAT)", "value": "b15409d262f76cacb9a0a3ed55bfc5deabd765451af78133b39f17b7fde28b25576a13b91678a1def2ab9d8bfd854b5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987435, "uuid": "cbd6e0e4-500f-46f8-983b-35d4f4b821d4", "value": "T1BBC34A4AF2C69612D49C1B75D0E7591403B6EF877633C64A3A8E33960E333E6B94178B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987435, "uuid": "01a8af59-6b0d-4be7-9947-da5a29413050", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987435, "uuid": "01cc6b3c-3694-4c9f-94a9-fe58d2d58ead", "value": "1536:N7eMFyfYfA2wqH8FLUInokmYE8xcljNYKob3VyryY5Kp5bFgz8H07TE31G/bIxPm:N77IYiqH8DnHE8CJeVCNoBgzs07TIQjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987435, "uuid": "da883025-e78f-4b47-9d4c-994440c312e0", "value": 126304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987435, "uuid": "057fcb7b-3870-46c2-8ab7-8486e26a6510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987435, "uuid": "3f98ac9e-6bda-42f0-aacd-af0d81fc5568", "value": "A\u043a\u0442 c\u0432\u0435p\u043a\u0438 \u0432\u0437a\u0438\u043c\u043e\u0440\u0430c\u0447\u0435\u0442\u043e\u0432 \u0437a \u043f\u0435\u0440\u0438o\u0434 01.08 - 27.09.2023 \u0433\u043e\u0434\u0430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4965b97-5ebd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695987909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987909, "uuid": "8dfd3041-9f37-46e0-b2e4-06e43991a5ed", "comment": "Malware payload (RedLineStealer)", "value": "eb69edce4df4ed81ecb296f24def4efe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987909, "uuid": "27930437-ddf3-4a18-82fd-11449149eef0", "comment": "Malware payload (RedLineStealer)", "value": "22eed594d424dcb890e53916fef86e80d36833100c8dc605af894c52e156fc56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987909, "uuid": "d9748601-b2dd-4705-b5bc-9ff8fbffc792", "comment": "Malware payload (RedLineStealer)", "value": "593175e7d9eba725467fe7b4a17461057214fe36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987909, "uuid": "191803d3-23f8-4185-8141-a2958fc10360", "comment": "Malware payload (RedLineStealer)", "value": "5932b9d1b9da61d777e7bda7b7ce13c2d1f60e3f8dd8c19d88019116935f10802284990699919eed6d1f948b604d6e00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987909, "uuid": "41a26b64-ec09-4dc8-8786-b8460e895dea", "value": "T1847419C0338469CDCC9F9AF1616217788A70D442AA57BB53FC8BACF73859365AF051E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987909, "uuid": "ddb73ce5-c54f-4bda-9023-71f4941c2348", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987909, "uuid": "7493d0bc-8495-40b7-a9eb-0913968b7257", "value": "3072:ebs4qrqY/CEN9UZhxD4rK1zf0AzIIsOoDHkTFRwPabf/ND4WeON1XKnwUAYTi+:eg4qrqRKu34rY3IIsOoMKybqON1aTTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987909, "uuid": "62436e65-c6e3-4a2e-8eb7-78be2a095254", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987909, "uuid": "b492d543-98aa-4b01-9789-4d253dc66448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987909, "uuid": "b331d9cf-dbfd-4c04-a5cd-aece23d41cde", "value": "eb69edce4df4ed81ecb296f24def4efe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d0f65d-5eb9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695986225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986225, "uuid": "b5c94865-9a36-48af-898c-5450307f1a06", "comment": "Malware payload (Formbook)", "value": "1acd6cc5c1801e8c54548fc2e28ddc7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986225, "uuid": "d71848da-bbae-4584-b771-39fa0a9dbebf", "comment": "Malware payload (Formbook)", "value": "2379179ac060df6ddd958ce586cdce95954908042554a2d051b51681b4baf425", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986225, "uuid": "69a82a01-5a2c-4be7-a7dc-f1cab194a6a7", "comment": "Malware payload (Formbook)", "value": "dd31d3e3ddf862db143637cbc3e596bf6554bea9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986225, "uuid": "60798c5b-c2ea-42a9-a48e-b9220fc563ea", "comment": "Malware payload (Formbook)", "value": "1510374119ebfbddfb01bc69656fea778bfbbfc4dada56895e1b1917a5543bbeacbef7b4a5bb23a3cafa03dbdb2c63dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986225, "uuid": "7fd8cd62-93c1-4f77-b898-c710bf036688", "value": "T146D3CF35BBAC9277C54F91395530C20ED6F5FC325C31A22A3CD1775A0BBAA91AE306D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986225, "uuid": "8acc3f56-f76a-414f-a04c-5e1bfd2c7be5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986225, "uuid": "bb89b474-35aa-4828-8d2f-f7b4337b0bec", "value": "3072:C993E0Z7JCsmf9DI8fVY8jncVPXxYtnSk:6pE8NCxOaY8jncFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986225, "uuid": "a823fc24-4eac-4eb4-9dbd-cdd91cde3d7b", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986225, "uuid": "3c70ecd2-8327-4eab-9563-b104a6518d4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986225, "uuid": "f3faa49a-5ce5-4a63-a54b-140411b24e9f", "value": "1acd6cc5c1801e8c54548fc2e28ddc7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b79b2d-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987339, "uuid": "1212c7a5-d2d6-4a9f-a5e2-8dc522849de2", "comment": "Malware payload (AgentTesla)", "value": "a7dd447512f467fbc223c69d9e5596ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987339, "uuid": "f02d3d08-1cfa-4921-830e-20d5d836eafd", "comment": "Malware payload (AgentTesla)", "value": "23bfcda4b9ecb16e315c10b4281bc1a815b74fb45fea48f29a92fd31ea9a6315", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987339, "uuid": "c6f75c62-07ec-4bfe-936f-cab7872019ce", "comment": "Malware payload (AgentTesla)", "value": "c05a3c49b86a5de3f6a25a6c4fcfd5c10d203eca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987339, "uuid": "704e3fb1-a2de-4474-bf52-379562ae5dc2", "comment": "Malware payload (AgentTesla)", "value": "1d0a1ed5e37fef81211a7d7d8da12742efaa3dc67a7c773cbd0681ffc24a510196f1e53385125084a4e315a88a861b9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987339, "uuid": "16e9d279-eda2-45b3-87bf-16dcd110ebb1", "value": "T1A8652306FB960E94F9BA75718AF6812003BBA4408D39DE1D19EC20CC57DB7E0F954BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987339, "uuid": "76c90f3b-9ac3-4c45-a928-4d0ef1472cc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987339, "uuid": "73211d2d-8389-41c2-befa-db12f19b9ee0", "value": "24576:ikjKepkNT9jW6s3wYtGXQnNIb9ie3w2gV0f9om9PKtjLBQ5BCIF:Zj5kN9aNwYtGgnaiSgGf9oMCtHO5BCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987339, "uuid": "a024afad-81a2-40ae-8c7e-7f5f08945b70", "value": 1500672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987339, "uuid": "7531a1b9-1063-446b-bc33-663f393deb80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987339, "uuid": "5a5bc9b4-0736-4d24-919c-1237fee9bf16", "value": "1nvXAdDFoUa9DOi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97641667-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986599, "uuid": "9df101bc-897c-480c-8911-a62722873caf", "comment": "Malware payload (Mirai)", "value": "fa0df0e54e043a95fd139b9c704acc8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986599, "uuid": "a01f84d3-4222-4207-bd95-c3a829ea28b3", "comment": "Malware payload (Mirai)", "value": "2497b7d7822bd70db55978c5692346652bfeefd81e3b89db501c2ef745fcaff4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986599, "uuid": "cfb32c82-29c3-48ea-a9fd-530a8b29da8c", "comment": "Malware payload (Mirai)", "value": "e762f50d3a065834b527a6eaad519ae789ecfd44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986599, "uuid": "c002ec0b-7716-4834-a8be-262a87006644", "comment": "Malware payload (Mirai)", "value": "db4da942e9f6e70cd738e1b3c9ce6617d9e3a2892bb8b0bb13a9b8d9be7202031fa875a8569ae35591fafb1c12218c10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986599, "uuid": "1ca7d534-c586-4336-8afa-31d72a92571c", "value": "T16E93A54A9F609DFBE85FDD3305E9870120CDA5A762AC2B7B3270D51CFA1A54B06E3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986599, "uuid": "9273d6cb-9b92-426e-b15b-3682f290d356", "value": "1536:LrafBv3+4+mrpehX97EpdjohL30l3gZjZ6PQvP1eEQJwb+:LrtrQjohL3w3gZjC/wb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986599, "uuid": "9dea2b4e-1f4c-468e-b949-6250915f6941", "value": 96280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986599, "uuid": "ebe613cd-b5fe-40e7-851d-3462348fa68a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986599, "uuid": "4b03bb20-6047-40dd-8cd4-91a73a89bf30", "value": "fa0df0e54e043a95fd139b9c704acc8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7661f267-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024339, "uuid": "ac10c903-1b36-44da-8bb8-2bcb2d41e603", "comment": "Malware payload", "value": "8a49f9871e5ec5d34fc8042a71690645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024339, "uuid": "0b3f91ba-881d-4e55-9c7d-9da090175b59", "comment": "Malware payload", "value": "24eacff00912d4de8917f304411263084d3ceb497a270a1cb8555f700b34ca29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024339, "uuid": "4c4fbd14-c310-42ca-b046-c05f5ccaf0bb", "comment": "Malware payload", "value": "04b19644a36ab11327e5ee43eaef96268fbeb7d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024339, "uuid": "31ef47db-280f-4ce0-b32b-bd838447014c", "comment": "Malware payload", "value": "2802be83f73abab1f9f2d51ae3eb7bd0592906911db94093410e58a8eaf8fb664e1b3a764678f4da8f821e33706148a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024339, "uuid": "6ed55d90-531e-4315-9d4e-473019df141e", "value": "T1AF3423BBC53D0A2EC58E5C920FC6440966855CEE5C87301993FB8235D3EF79E2D8AD68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024339, "uuid": "6778d400-9622-4767-9c48-086be81df4ec", "value": "6144:j5i+ndSxTWMqyKvQ7FSr5l6lalboFP5iL:Y4SxSMqyKiS8ali6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024339, "uuid": "0fb5bee0-f907-468d-9947-4cef75ec6c71", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024339, "uuid": "10d7a18c-44ea-4c17-a106-369cfbc01f9f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024339, "uuid": "65d8385b-37c1-4130-b271-8b96dc219da5", "value": "288325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13690a56-5f11-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696023743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023743, "uuid": "385d1b83-89d7-4fbf-a8a1-1e5c31a72352", "comment": "Malware payload (Mirai)", "value": "7d7e432e3b2fbd661a18ae730633aeeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023743, "uuid": "69838659-70ec-4330-9f0f-8f3c2763e4f7", "comment": "Malware payload (Mirai)", "value": "252dd8418fe8ee024baf5edfc50ee311668d3ea937f5d137f46a894fb5deb2c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023743, "uuid": "42b4edf1-047e-4cb9-aaa1-2cf81ae47447", "comment": "Malware payload (Mirai)", "value": "586993fce9ca0b6081afde9640aca95b8c035419", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023743, "uuid": "30543c84-fdab-4a0d-8235-dba9c43eb589", "comment": "Malware payload (Mirai)", "value": "18ea9239ba04ce0e80e4803d03dab8e1422a1bdc35b4966e1fd52de6fe06654acbf2a86719849a8f44c336b03aee86d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023743, "uuid": "20e7f4f7-27ef-41cd-b83b-c390c92b0f83", "value": "T12CB2F1D5D6EB17C3D392D332E0BC594DA1732AC10746450A210AB65F93A7A0E4BFB3B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023743, "uuid": "07b2812d-8bc1-4883-8a45-fdbcfdbe5afc", "value": "384:MvDKKQOcRpmYLdn6RBOFRFt5rUFW10iSelCo3AnupPFNqnrrd1NEZgO8UXWozPL8:i/QOC0Yhn6ROHWFGrcwNVFCnNBxcoYcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696023743, "uuid": "d6576329-3ae4-4549-b395-c75e3d0597ce", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696023743, "uuid": "25f5b953-fec9-4bb2-9256-78cdbbc88bd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023743, "uuid": "81d5119b-0b4d-4b7c-9efb-35412bb8bc39", "value": "7d7e432e3b2fbd661a18ae730633aeeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f808df-5ec7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695992106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992106, "uuid": "0687e078-40bc-4133-b7c0-14968158f2a5", "comment": "Malware payload (Formbook)", "value": "5bd13cdcb7983b234047365d85d748b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992106, "uuid": "995df95d-8cb3-4eb7-8066-ead640c9e2b2", "comment": "Malware payload (Formbook)", "value": "2578a3ee6e570cfe5821bbaaf172268ede5fba895d1b4be52df244e73e066bdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992106, "uuid": "f8ae548a-ff3f-460d-8fb6-fd0257d05a3f", "comment": "Malware payload (Formbook)", "value": "6b929fda95750ec40fead6eac3a7fb79445d2fcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992106, "uuid": "7dc1d5f2-dcfc-4a5c-8e95-78e980ea3a3f", "comment": "Malware payload (Formbook)", "value": "173c7abfd51ab1f57f6fd9c61bf5691a98cbe27af7a03c07ea2cdfb99511d2081441038bcb5739903fdf26f538bab738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992106, "uuid": "7a7372df-5bd5-4dab-b4fb-d1dfb77fecd1", "value": "T186841240B1A5C8D3E5B30E31593FD3371DF9EC3E69A9636B63D07A496872212C81E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992106, "uuid": "8065eadc-7f8e-4db2-9654-65ab5dba3e0d", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992106, "uuid": "f4e9e455-6074-457c-b7fc-33068583dfdb", "value": "6144:LnPdudwDzGKQa1t84Uiip9tEnyKw9W7x9tQOUnuMbznvqgd9Tcy5LH3:LnPdvB12di9dgjvNcy5b3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695992106, "uuid": "7b5bfef5-5278-437e-a2e4-bc5cd93ad25f", "value": 373666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695992106, "uuid": "4993d633-8998-4fdf-bf7d-7037de674170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992106, "uuid": "6b0daea3-d75e-41e3-b7e7-e83f4b00b776", "value": "BMLKSL030823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb4e7be-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024382, "uuid": "30f034b5-e6ce-4a4e-b536-dd931dd66e05", "comment": "Malware payload", "value": "96730c38e1a26c1d54a241064003b235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024382, "uuid": "ff34e0fd-cd47-424d-8ac2-7ccc092b71e4", "comment": "Malware payload", "value": "2595688a24323d2d8f9deba20b678a2a66cb782aea7ec4aeba876a334c209acd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024382, "uuid": "4386c3e5-eca3-4fab-849a-e3a68cd4ccf0", "comment": "Malware payload", "value": "7327597546362910a5eb0b74d5909421dcfe2826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024382, "uuid": "fb01471d-88a0-4cd6-a5d0-392272302b3c", "comment": "Malware payload", "value": "982c77599c032fb2fcc8ae514a42e5d2a4aa4aebca74d6562396e2b2fd7f3e970017fa5e6e44ad6ff80e09f56270202b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024382, "uuid": "121c8864-abf7-4efb-bb36-b316b5f00085", "value": "T1AA3412772D0D3AC9BBF2FC3FAC87AEFA0A487792A47644B719A6D4C573879055880406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024382, "uuid": "eabfb1e0-43c5-4a32-9efe-d30c7df20efb", "value": "6144:2l5c5g3KabxAbiQGmApWCZOmwP1XpLdUhX5tHUyUo:c/3Kab6VGnrZOmO1XpJUhXvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024382, "uuid": "456a1d99-e6e8-48bd-8719-dcc13a5acbd8", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024382, "uuid": "9669b8f0-8f00-434e-be42-7bf0d58eee04", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024382, "uuid": "ce94ae86-1ccf-4cce-906c-7a615ffad0cf", "value": "288330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bf3160-5ec0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695989332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989332, "uuid": "b1bb6ea4-1d94-4302-95cb-c049a9bcb0ec", "comment": "Malware payload (RedLineStealer)", "value": "73e8ac07797b8b0eb7142d10f5837ca1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989332, "uuid": "595dc2ed-1928-45cf-b320-e603badb6e47", "comment": "Malware payload (RedLineStealer)", "value": "261efd4ff095c447e6a4221afd063d486625d4e975a3f7c9f9d64660f9b9f25e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989332, "uuid": "8b9b79d2-ddd3-4e9a-a254-763cd637fc69", "comment": "Malware payload (RedLineStealer)", "value": "64f16a7fb7be54a5e5f9fb60b7f610cc4a0cf9f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989332, "uuid": "b81d9ade-7e4b-4951-8e67-782d6ce90fbd", "comment": "Malware payload (RedLineStealer)", "value": "1456fd2cd5c0332fb66141eb5cf861dd61cad01f072d0603b3d8dedf11bf32d975ec54a296a5ce3796910e428e7fe8a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989332, "uuid": "b03ba102-7f60-41dd-89f7-84351caf7133", "value": "T1A7357C3038858262FDF610B641ECF9A0495EA0B03B271ED796DED7EB86117D1663A4CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989332, "uuid": "7ad8f72f-ce73-4e7f-9758-ea3977930732", "value": "500aa68029ae375a898af1edb3f40b87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989332, "uuid": "c9042306-f979-4f90-b904-50e2559901fe", "value": "24576:FM5TBoyJAzoy99wIqbQfgia8gzhYT/iybuvQqxQV:FM5TBoyy99wISQB2KT/mvQqxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695989332, "uuid": "6b83384c-2aba-45c4-9fc0-99e09cf937f9", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695989332, "uuid": "542cd42f-34a5-4aa4-9d26-2f18aa719036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989332, "uuid": "278e023a-252a-4da3-bb66-36ec12e16472", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae490ee-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015864, "uuid": "aa959967-83f4-4150-938d-4b4686918092", "comment": "Malware payload (Mirai)", "value": "71eadc9da0901e477ef672f7f112f409", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015864, "uuid": "989f7f6c-61b1-4f9a-9d2e-4649adf90808", "comment": "Malware payload (Mirai)", "value": "26205b85dbfc94d799f4299dc0c868cc6d0c5160e0f19410bb8c1314fc883be0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015864, "uuid": "40714aee-c15d-4789-96cc-f3997ade7b81", "comment": "Malware payload (Mirai)", "value": "dd5e3214b89699b83951dd5bf18a17ccae02d8e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015864, "uuid": "0ecc1686-d036-48b3-a7c3-08a57c9eaf7b", "comment": "Malware payload (Mirai)", "value": "191a3c4cef62bd52801f3235c9063b594829f9318701720446f9e3fd57b65a13d9339a4cc31cf6b90617c5ff38c1b070", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015864, "uuid": "99dcd26d-82be-4f93-b026-5e42d2dca437", "value": "T192D2E1016241FEE1C5B00232E9668A9B72267D79D1D130FB963D0DF8A6E9A1D47F8A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015864, "uuid": "4f7606be-297f-4a52-9b69-b5b9f90986c1", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXga9q3UEL7q:WRwynNIOQQ1KMwPLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015864, "uuid": "079c49b3-61e0-4b50-8e36-797958bb2bdc", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015864, "uuid": "17c26496-d2bf-4474-adb0-ff52e72a07eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015864, "uuid": "5fbd7411-eed7-401e-8b92-ec21e79b1997", "value": "71eadc9da0901e477ef672f7f112f409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1916cb34-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977367, "uuid": "56ef836b-45fb-4de2-ab48-47a3221f132e", "comment": "Malware payload (SnakeKeylogger)", "value": "3adcb908c47a0e9e9358430dcc0c5b55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977367, "uuid": "a26c29bb-7167-4e6f-82f4-2557e2c661b8", "comment": "Malware payload (SnakeKeylogger)", "value": "2623f5e2a7aa90ec2c7d11a3e60fca615a629ca352a5ccdf9d4243c46e720738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977367, "uuid": "8f0434e9-ef3d-400b-a1d0-270ea014a311", "comment": "Malware payload (SnakeKeylogger)", "value": "a3cc683b61c6b571d973ba51c682f48534e6d01f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977367, "uuid": "19688d36-dbc8-4f8e-8645-8a1a53d9ae61", "comment": "Malware payload (SnakeKeylogger)", "value": "2a9d33fdea719bb03789f663a284079895a5ee88a0c7f15c2d7976e095b70d6cc90eefb1ddff51ecd208ab6eada9bb46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977367, "uuid": "440927c6-0f98-46e4-b2b4-1753fc284301", "value": "T1B5C3181D27F88800E6FF8A7305B19111C776FC46192BDE1E5AC0F91A2A7D7918E16FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977367, "uuid": "0a745efb-54a5-4772-a718-fa69838253b8", "value": "3072:eOOYz2Yaq4T7pwMxjF9uJokbUPITDlwBT8EDbY:vzJU+okbpTE8+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977367, "uuid": "d5c72bbf-9f7f-486f-950b-28a8212fadb6", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977367, "uuid": "213f0477-ff1a-4193-b02b-871f1fb41cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977367, "uuid": "502a29ed-5061-4b9d-bb32-f9bc1cfb8c8e", "value": "Quotation China.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11aee8d7-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986804, "uuid": "d1e8b761-ee00-492d-8911-2f94b61a8468", "comment": "Malware payload (AgentTesla)", "value": "62d8c9a085467c57c70ebf98da48f81d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986804, "uuid": "db00e8bb-c069-422a-b6aa-2c74344caf4a", "comment": "Malware payload (AgentTesla)", "value": "2628313da5e34653481666207066dd34c810d7285cebf4b1ecea700ba8aed211", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986804, "uuid": "353eec71-32b8-4a74-8fb2-816764e4040f", "comment": "Malware payload (AgentTesla)", "value": "22a86a949e727502ae7e7226795d1c0ec6f69941", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986804, "uuid": "347b0ec7-b36a-4579-8441-10fa1cd84fc5", "comment": "Malware payload (AgentTesla)", "value": "2e2e02d96f4e9498349947a1fd07a78c7b9b57a02e30ef82a8504e1ed159f1386f434abaa1584620ebe5e1b80ddff170", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986804, "uuid": "cf760157-3c15-4829-8aef-6f5ca69ef39d", "value": "T1D0255CD1F19088DAE96B05F1AD2A653021A3BE9D94B4810C569DBB1A77F3342309FF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986804, "uuid": "fb0f3ba9-dc79-4562-934d-1b0234dfc0f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986804, "uuid": "3d16915e-ef7a-4bf4-ac73-265b7e44cfb5", "value": "12288:QcxAckjdlULyUYp7kX/KhO3k891OxcifInpZKqeydhw4:/kxlULyUOgPSin25QnpZKnyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986804, "uuid": "ca4f034c-bbf1-4818-b3e1-e915911ba396", "value": 999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986804, "uuid": "b4d606f5-77f1-4bd7-b321-e38e6b0c0327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986804, "uuid": "4204a2ae-0e1d-4032-a855-f6637506b8a9", "value": "\u00d6deme Faturas\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc96bec-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1695977508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977508, "uuid": "9db1e82e-3c4c-4045-ba81-d1388d87a317", "comment": "Malware payload (IcedID)", "value": "dcddc1610068a8485efe1dfaee14100e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977508, "uuid": "a54a72eb-be53-47e6-b4a7-13e34221325b", "comment": "Malware payload (IcedID)", "value": "2673588603fc2203117206d4a318eb7aa20bd88c94342f27cb9207e56216c186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977508, "uuid": "e10ce3be-3928-4430-99b3-20b83be7d26e", "comment": "Malware payload (IcedID)", "value": "57f4554865be404ccd1be88cc1b8166895bc9355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977508, "uuid": "628ea784-509f-4e81-9e1e-5c6fff9b79cc", "comment": "Malware payload (IcedID)", "value": "a59a1afdd3dfd4796e2be880818db8a8b7d14fdb8331a942f901d6ef18787055b3b21b85e38d0cc52152b291fce58970", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977508, "uuid": "a81a1204-83de-48ec-a1f2-b96d9905a7a1", "value": "T1D8B4D5D43005864FF758CCBE5ADCE198F168DD724BA701A2E73C2D76C678C1EAD8A624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977508, "uuid": "bcba8f8a-fcd6-4d23-a8d0-4cefec38f174", "value": "06f8200dd7f647ff019f9eff071391b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977508, "uuid": "5be0ca20-e5de-4d76-98e8-152f553f5a5a", "value": "3072:hgIEnSsfJUNnx3xEbU2X6uNZru+tjj0YqvHlDUwRq5snio2fWKIulMdtb6n36WkB:uSsfJUneUTn9K43WOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977508, "uuid": "df60353c-88e0-41a6-845d-6a9a3d743be8", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977508, "uuid": "a5af0927-9977-413e-ae4c-053c3b69426e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977508, "uuid": "fd1b62d3-709d-409b-a303-bc8df2c57675", "value": "dcddc1610068a8485efe1dfaee14100e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc965989-5f17-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696026658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026658, "uuid": "187a7812-ac3d-46e5-ac98-7afce5b7bb79", "comment": "Malware payload", "value": "dd2d1046abcfa995fef33b1786b05f2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026658, "uuid": "9870cca5-1bcc-41dd-a313-b00d7319c5c4", "comment": "Malware payload", "value": "26af2fe49e2a711fbaaff3d5b604be55e5b4969c08d7a12661866482882072f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026658, "uuid": "bc51ddd0-b3d2-4cbf-ab31-500d7da92b18", "comment": "Malware payload", "value": "0e2987c3b17020e3fbfef22ebed67f5d3132707d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026658, "uuid": "01701fde-ab1f-412b-9e73-e1921397f3a0", "comment": "Malware payload", "value": "ad18df1eca3ede5034828aeaf3709ff356f0d104df5fbc64a45f1c466a8c113ba9a6beba1e1b8dd5e6c558c8792e2c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026658, "uuid": "55c76d09-6a35-41ff-8fec-a5ecdf81255e", "value": "T1E655AD32A280223BE8678A3A782E43563C3AFE9217D554875FBCED5C1F7A5C065313D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026658, "uuid": "2416730f-478c-4c81-8487-6be794704eb1", "value": "24576:22GqTi7qvyP0Z+BSSHVws+hVWP+ZvmQivu65Za0/ft:ZqcSHVihVaeivh5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696026658, "uuid": "c8ff6d9c-8dee-4778-a5d8-31fe78760bb4", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696026658, "uuid": "07292fba-253f-4824-9c3a-7a59b55ddd34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026658, "uuid": "e060026c-c9b1-42e5-a57a-53c8f0b3ce2e", "value": "SecuriteInfo.com.Win32.Delf-THP.8429.2070", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6aa4035-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696024527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024527, "uuid": "913d5de0-cd6a-428e-b418-0e42af907ee6", "comment": "Malware payload (Amadey)", "value": "046959e19eb20551eb266aef192d1092", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024527, "uuid": "29a569ae-a688-4878-a153-dacaa8826686", "comment": "Malware payload (Amadey)", "value": "26c8b7f5d0f9a0138e5ac0cd5b9d7c4ab9e9e16fbaa221117d7bf6464e85eb69", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024527, "uuid": "b04e39ff-0af4-4dc4-93c0-758cb0c4b63e", "comment": "Malware payload (Amadey)", "value": "6b4020aabe09be7c4092e9d4a922ab3d4ce76a01", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024527, "uuid": "5974ccec-6b98-4c8c-8a72-25a77d2c6a51", "comment": "Malware payload (Amadey)", "value": "235f0e77157c93b1f64ec3d5aa439f542527c48dc9b87e0376686554b55113c528013bebb0255a905555fb97284504c7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024527, "uuid": "57356a60-b263-426e-b85c-bd0b7ac28e85", "value": "T161352346AFD990B3D8F11BB415FB01870F3FBDC20E75466B6B55608A4C72AA2B43631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024527, "uuid": "ed75ae52-6229-4bac-afee-67189fec99c7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024527, "uuid": "a82b3dae-8c01-45bd-8100-604efaa7ecca", "value": "24576:ryJUGlMIhS6Yx2j9c1nFXupHDCgPjNNo+IWUhJlfcq5S:e7tNYOcJF+pHDpLo+IXH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024527, "uuid": "5e13680c-7caf-4da1-ab01-52f0a61a9f56", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024527, "uuid": "cc9a7f35-8de4-4d64-8c8a-9889283e78c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024527, "uuid": "58a9408d-2342-4331-af77-f40ca9558b5a", "value": "046959e19eb20551eb266aef192d1092.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db33e395-5f17-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696026656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026656, "uuid": "61f5720d-e288-46f6-82b4-832e5e777682", "comment": "Malware payload", "value": "161b329d2a2dd300d0a417811abdc50b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026656, "uuid": "4a79c1dc-7e55-426b-b878-cf13bcb07b88", "comment": "Malware payload", "value": "270e615d1d0ea8a441b2c381a3f1fd20b08a566cdfac3c978bd9d40f45506aeb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026656, "uuid": "b063cff7-c461-429c-9449-89a7c8a98fb2", "comment": "Malware payload", "value": "7bd27873752c378f4109fe2ccc05fc34d2984223", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026656, "uuid": "639cb657-9859-4801-9445-b211fc1f6157", "comment": "Malware payload", "value": "0f0423153812f60cd5404516873b97971429fd9a977f6a9a8e072dd800ae46788bfea285e3264d7bc1c963e0af53462f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026656, "uuid": "1812b843-b0e7-47db-a7e0-64bb12f7f4b8", "value": "T1CB942A0FFF96D897C8490D348AD293F826BAAE558D15935733CC1EAE7C3A2844D13972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026656, "uuid": "b2c9c023-6fec-4b72-83bc-522cc13b1f38", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026656, "uuid": "fe25665f-6a4c-4038-a229-a6cd8137c7bd", "value": "6144:+RR5rhZFQGrsUwF7vlPoS1txjo7z1ZlCX4os:+R5nWFpPoSSgoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696026656, "uuid": "1ee8cb7f-c14b-4021-a1ac-e69f9d0b1c74", "value": 439965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696026656, "uuid": "ca090821-f79b-42ac-bbe6-49734bd87fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026656, "uuid": "99694ce0-0b6a-41b4-8fec-7df95a655858", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.2419.23627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111dff36-5ea7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695978213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978213, "uuid": "5f43864e-a2e9-4b8e-9fca-88e12352937c", "comment": "Malware payload (AgentTesla)", "value": "b6dbaa1d1455e7d066abbd3b70be294d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978213, "uuid": "2c6a66b2-5c62-4575-9c6e-a43cef05c083", "comment": "Malware payload (AgentTesla)", "value": "2717532257cd9ef04649deae085eaa433bd423bb062a9757aa799bef93124838", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978213, "uuid": "ebc71028-a6aa-480e-b27e-fd04149322ab", "comment": "Malware payload (AgentTesla)", "value": "c62d8c7c3bacd3414167fd68a8615f2534ea7c66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978213, "uuid": "5f1559e9-80dc-40e1-bf55-c483803f53e3", "comment": "Malware payload (AgentTesla)", "value": "c6ccb8f9445bced120847224d0b4585292909f75eda65e3a13726b86592bcdfdc38548ef2fae1dce720ec94102169151", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978213, "uuid": "971b2312-3af7-42f1-be9f-8fa4c4d562bf", "value": "T111D412CCB6924765DC499B36539C6113C772B651AA21E33DCA8D384F0A3B31C9A36F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978213, "uuid": "33b80154-402f-4e1a-96d1-bf6c7a5f05cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978213, "uuid": "9d9c2b81-3087-4c28-a09d-2a86f2bd642d", "value": "12288:+725XUxthzo6aJbjl5dL0p+DiQ8BH3LW1pvVN7dzszMrwk:9WxtFojl5dLaGHOuZV3Trw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978213, "uuid": "f047e32a-7dc8-4413-a3e9-6affc321df98", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978213, "uuid": "4905e34f-7279-4a9d-97f2-268a95190ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978213, "uuid": "63c6e1d2-4a7b-47f2-aca1-019dac39e3ca", "value": "Request For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c44a78f-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695987036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987036, "uuid": "7381ad75-6dd0-4cc8-b8c9-a4190301072e", "comment": "Malware payload (Formbook)", "value": "44467cb97748f78289cca59f5ad2cc3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987036, "uuid": "5b4d83c1-a864-4509-a596-9b550243fb0d", "comment": "Malware payload (Formbook)", "value": "27c63a287ad06d5478a22155790f4d89221885d140405b2f200242955154973a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987036, "uuid": "a5b73a1a-4b33-4e77-a4a6-341ed88371d7", "comment": "Malware payload (Formbook)", "value": "acb507738efe72f7d24942f5b368871adc1d1e34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987036, "uuid": "443ce705-eb4a-4017-b5ca-f5ad82cc2f7b", "comment": "Malware payload (Formbook)", "value": "d868f6b193cbca79eb8c45576aed3ea19da78b94a923896884aa091a136d368f393b090675ba4eb8f1ac9585019740dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987036, "uuid": "ccf1f8a6-48fd-488c-97cf-b849c94c1fec", "value": "T1D36412A07365C07BDD7B6A310D3FDB674BB7586A41B0670753C17AAEBDA3682C4092C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987036, "uuid": "238a1483-6922-463f-a78a-87b77826c6a8", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987036, "uuid": "851408c6-c953-4019-9598-adb1baf66291", "value": "6144:LnPdudwDz55TyuCDiWvsXSAcXXfSpZpmCIzAiwzbLXTIWf/ewHgKyRm6s:LnPdv55T6fvPAq8ZoCEADTXTIY2XRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987036, "uuid": "a8a5ea10-86d9-4fcd-b382-fdf18fb3faba", "value": 336001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987036, "uuid": "72fc6761-85a1-4e02-bfab-40748b059a9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987036, "uuid": "c40cbbf1-d69c-4fef-8e52-ebd837dad803", "value": "44467cb97748f78289cca59f5ad2cc3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d310196-5f03-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696017962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017962, "uuid": "de696721-9c2a-44bc-b627-8bd6b3154680", "comment": "Malware payload", "value": "7f69673185fd5c62233d19e602c912de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017962, "uuid": "8c2cd7b5-a009-453c-804a-a195a38ae47b", "comment": "Malware payload", "value": "282fdb33a2250756a1ae3c90fd7c77e4237bb425d021d0256ad587d811ae46e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017962, "uuid": "037cd84f-b167-4d6e-bedb-9b9065160707", "comment": "Malware payload", "value": "59cf1b34b24756e3226790ae67a4bf9e5d68ab93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017962, "uuid": "694ae2e0-5eb0-4c83-9b08-909946351afd", "comment": "Malware payload", "value": "b99433837badd52e34b9aedc27a4dd44d509d5367664fc84a9c7b3451e3a0638152d9d165487c1e9bed1c043513da2cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017962, "uuid": "68cf83c4-8886-4f09-9150-aab214bee226", "value": "T1A643C71BF518E02FE666CAF16862919974267E3107D0AD433A85BF5E1871693FAB030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017962, "uuid": "9810db32-3423-4618-953d-d8a445068d4a", "value": "44b6cfb55b29c5fd7837da20c3841494", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017962, "uuid": "a24c53c1-aca2-423c-a7c9-4553a8c46b74", "value": "768:CwR90wbbIoW1obVJNwRAD8WQzXuzBrRebqI1flGoaxzEuO4Z1:ewbbId+bFwGDNQzXuzBrqz7aBE7I1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696017962, "uuid": "67350876-5e21-4636-900a-f046a0ed1c33", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696017962, "uuid": "f003ad3a-7418-432c-ac72-8912f5f117b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017962, "uuid": "4e6063e4-4aca-4a0e-bc10-00b62a1f026a", "value": "criptazione.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c3272d-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986621, "uuid": "86007a39-1442-455f-a999-0f2cb5cfe05f", "comment": "Malware payload (Mirai)", "value": "fa53ca0565dd0b9df0a9891276363bff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986621, "uuid": "64723bdb-951c-4d21-a798-7f3c00f27250", "comment": "Malware payload (Mirai)", "value": "284baaf86a8177172e090cdb2bb6f46c8b7c79b99781e798aa70eb3ed303c7b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986621, "uuid": "76b6594f-c262-495e-b8f7-472673ef8f96", "comment": "Malware payload (Mirai)", "value": "63fa1ae240e81bd686490c7ee986034c489229cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986621, "uuid": "be354ef8-fda4-47c3-8dcc-620225554ee2", "comment": "Malware payload (Mirai)", "value": "679c8b2fe2ba62531bab83a17b29098b7f80db36d603048f4647ef6a84140e6fc99c3baf7072fa35f4798e051278dea0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986621, "uuid": "52e8e503-e9d0-4314-bd9c-88970b772bee", "value": "T1E2531A49BD82DA22CAD11577FB0E438D7B2A539CD2ED33039A295B6177CF55B0E2B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986621, "uuid": "f4d8afb2-6ec9-4076-8233-ff6ebf441848", "value": "1536:jDXMQyWDJ1oEhRgLqmXpM4vVQrH78T7ACwY:jD1yE1VRgPXpM4tm7wwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986621, "uuid": "ebd4e466-7d24-4916-9343-9ad52340362c", "value": 62760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986621, "uuid": "77dac705-d55b-4b62-8295-0d36e8bb1e7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986621, "uuid": "7763a43b-6912-425f-87c1-c76c2dd4ccb2", "value": "fa53ca0565dd0b9df0a9891276363bff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cf97ae-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986571, "uuid": "2cfae9aa-6a2e-4194-8a3e-00ed3d8360b5", "comment": "Malware payload (AgentTesla)", "value": "51cb52e90364510a29a30a49763a3580", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986571, "uuid": "fb5fef11-1292-4a41-a0ba-3640671ec0bf", "comment": "Malware payload (AgentTesla)", "value": "28b8cffcdb66f2059003365c5acb5cdad53a037e8a8e0cc5f942b2e1826d34c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986571, "uuid": "98ee7c1f-c82c-4cda-812a-42988e6838f1", "comment": "Malware payload (AgentTesla)", "value": "bee76d9aff0be7f787e9a1121be500434503ffcf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986571, "uuid": "e7439096-d177-4b44-8755-5749718e4db0", "comment": "Malware payload (AgentTesla)", "value": "338b8a6b2ac7462c84cfc6f96ef5567b36009bba440e9b5e8217f8205abebb4c5aef013db6a3b4d32f70e30ed0932b17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986571, "uuid": "2cd3cb22-3177-4f9b-8bdd-9115291e8ae1", "value": "T13AD433C5BD148C3AAE93441A714C7DBE5BFBC95F10397ABDEA241AD108FEC51AEE4006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986571, "uuid": "26951b3f-975b-4dea-9a63-a9adb39c7a1e", "value": "12288:bYnWy6ouz7b67xITyOmG1Oh+3HVOmddmTHnjQtxuLwafR6jgT3z:sezf6mTdpOg31OmaHAxu0a56jgT3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986571, "uuid": "3b48ff20-d86a-42bd-a2d5-7061a9dbf6a4", "value": 611551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986571, "uuid": "15e9ffd4-2177-47b9-9178-208353383502", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986571, "uuid": "a291509d-82f4-4e0c-9705-8ee464f6027f", "value": "28092023-7984558.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0793c8cf-5e95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695970466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970466, "uuid": "bbaf2fa9-2fca-45af-9cb3-98f04620a232", "comment": "Malware payload", "value": "ac73a3eff4a3884354e4b7e07821e88b", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970466, "uuid": "7a47111f-67a1-4c1a-b1e7-be371456729f", "comment": "Malware payload", "value": "28fd21516af228e2aa595e44cbbe8ab95bbd438d70d94fc715ee04221d88c0da", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970466, "uuid": "6b67c854-52e6-40b8-a836-08e9de359653", "comment": "Malware payload", "value": "172d46833ca2638a14c93546fce57b6870db2e06", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970466, "uuid": "e8ba10ce-ff11-4a10-9802-5a18c5e51a93", "comment": "Malware payload", "value": "e2af0fc800ffc054a9da0a0a8d7e745ca0488ab2076e6ddaae2a90283885d85270f141e275ae745ec789c2284d6bc52b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970466, "uuid": "1eee3240-50ae-4691-805f-b039f5a47947", "value": "T1EDE16C34ED67E469E50711F2D151D5B7EC458487C25AE36FA50C26C88BA0F932B43EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970466, "uuid": "a2b665d2-30bb-46a0-9e19-3b9d532c092d", "value": "192:VFksslsSRDC0Gu0vaK3Z1xlCl31jq4JDdU+m:ZcGO0vaQNlw311JRU+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695970466, "uuid": "1cd1189d-6761-4e92-8e71-ff9108b0e5db", "value": 6863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695970466, "uuid": "5ec1ff76-dd58-4dc9-96ed-df9663d17cbe", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970466, "uuid": "47ca05a5-6bac-48f0-8c3f-ffe8732c90cd", "value": "Lingiang_Cosmetic_Promotion_Program_2023 Approved.by.CEO.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dad3e02-5ef8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696013023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013023, "uuid": "4a651088-2e31-4309-9797-bd06bed157c3", "comment": "Malware payload (Mirai)", "value": "48d98d34620705051b33d7e8129c4e93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013023, "uuid": "f34653e8-8175-4295-b122-5ff319d054c1", "comment": "Malware payload (Mirai)", "value": "29425fb37dfbf5ffee1615765052969dfdcfc56d083ad748b0ebea8ba8b0773f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013023, "uuid": "ef951411-aedf-44bd-b6f3-1d4ca795d3c4", "comment": "Malware payload (Mirai)", "value": "5d38422ffbb63d58afea228962aface16e069c7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013023, "uuid": "2561b752-4fa5-4db2-b167-c1884ff1a383", "comment": "Malware payload (Mirai)", "value": "020d62b8e6c7ea7af0d4566158d0c0ebf5ed8c0fe357b453245ce0ebf554fcea1e91e3f0cade4ff47bb7ce70422fcf80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013023, "uuid": "edf3cb42-7f9b-40af-8461-a6be561f3ba2", "value": "T19882DF3051AB74E4DBF00435FAAECEC6971A0BF8D1FD36E216586B78C94640611F83CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013023, "uuid": "c8868d46-2ada-45e0-8a53-8fa5d2b44ef4", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMax3hymdGUop5h5l4:6GV0P6+kom0tVAoNvm+to1x3s3Uoznl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696013023, "uuid": "b0e48be9-b357-4844-aa35-dd4ff1004622", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696013023, "uuid": "5db5bf16-4fe1-4e27-b45d-3666396ef948", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013023, "uuid": "c91fd86b-bc4d-4e8c-bf02-4fd34b277589", "value": "48d98d34620705051b33d7e8129c4e93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f6df71-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696010292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010292, "uuid": "610b9f59-de74-493f-a080-9ce6c88f1927", "comment": "Malware payload", "value": "8f0f5aa7c862059aecb25f4d17720246", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010292, "uuid": "432f68f3-9a11-4a11-8ec9-ee0300f842ae", "comment": "Malware payload", "value": "2a0bc36c55d281f8cc5ce642f89b4b86850fa1b1b1c5e75038ba01d9a5280b34", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010292, "uuid": "4d3a1c8f-ca28-4167-8e29-dc0e7cf8071d", "comment": "Malware payload", "value": "4aca81dc6ee6e57a40f9c4dd7b4b98c0df1bb2fe", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010292, "uuid": "945f4838-84c8-4fb8-a045-3b11201f22d8", "comment": "Malware payload", "value": "268f4c21997162e6e3e0443501a49bdc57abe0cb4b8bafa3e77b0da6ff1dffa56fca8d71f8086dddebb6bea394e38c5c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010292, "uuid": "e5503664-9d3b-4453-9410-bc18b6888d9e", "value": "T14D23F807F54380FDC05AC274066BB93EAC2675FE1238F2B67BD4A7226CD5E215D19C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010292, "uuid": "c3f03b7d-44fb-45a9-aefa-226c8e117880", "value": "768:vZCLNaOGW6bQHT9XmB3OIB/c1cV9KFf8D+wdYFmuqpjik0BLvI04Wx2fEj1sCKhN:oLYOGW6bq5XmB3OIB/c1cvK++JMBF4IT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010292, "uuid": "84fbb99e-0049-4d17-8c45-5829dc0d13a3", "value": 46336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010292, "uuid": "f5c71812-e52e-4289-b350-ab5c22632720", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010292, "uuid": "50304efd-8bb4-481c-aaa1-b0ea2ab42526", "value": "8f0f5aa7c862059aecb25f4d17720246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01b990a-5ebf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695988814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988814, "uuid": "9efeae4b-4106-4aae-93a3-b54b55fb246b", "comment": "Malware payload", "value": "885a4eec2cdfc7e2ad5998195789efa1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988814, "uuid": "fd2be6be-567d-4651-97ea-bf9d84cdbf4d", "comment": "Malware payload", "value": "2acb045c4133768581c13f6e66e50bfbeea71d38a5b3cafdf2e1d42e09b91ca9", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988814, "uuid": "20e54cb6-0755-4c2a-b75a-7a6ef4114498", "comment": "Malware payload", "value": "525403e3868f18561688679861ca5515b7531a03", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988814, "uuid": "3642b10e-b2e0-47a2-86af-0da0aebedf62", "comment": "Malware payload", "value": "a5a26c9fdcb3d7a6874c958cdf2aa529b69e977f7485d3d8f88a5acf362983a7afa8339cadc7e2c7c7ac9b8e77c25612", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988814, "uuid": "aa9b05fb-b01d-450f-a493-4fb0e7a93361", "value": "T1F8139EB8AED42C27138EBA3A8739CFBC55739015408167DFC674FA8E5645BA3805FCA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988814, "uuid": "cfc208f9-b98c-436b-8469-e6694efedb48", "value": "768:CqAbGSBVUAY4Cf+627n6njuf3WRZJybGSBVUAY4Cf+627n6njuf3WRZQ:CqAbbfUr+zn6njulbbfUr+zn6njur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695988814, "uuid": "d8c3536c-2c0f-49fc-ac2b-07341d03050f", "value": 44632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695988814, "uuid": "44c994de-3cab-4391-b2b5-623a280c9f34", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988814, "uuid": "dece9401-e1df-408e-8b3c-2ece74e76433", "value": "DMGTRE120803821_factura_CFE_20210615_8473HDJSGTW7873_SAC160504U42_B_376_20210609121247_kDHgO4j0JH.HTA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9b0638-5ed1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695996241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996241, "uuid": "9d6ca0a2-fa57-4144-91dc-6e00aa827e85", "comment": "Malware payload (AgentTesla)", "value": "727987dd54cdd7bce9f056b2a80731e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996241, "uuid": "d104e40f-db84-43c9-b4d2-83cae5d02ba4", "comment": "Malware payload (AgentTesla)", "value": "2bfade03786894ee5602d90d83d39657a99e4728be1e844198c96ab64f7b4b8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996241, "uuid": "5af11363-242c-441a-a115-fe9274ec89e5", "comment": "Malware payload (AgentTesla)", "value": "5c51e232ba1fd0f11c983dfbad96985fb2e1c049", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996241, "uuid": "bc6e0cf3-2fd6-416c-ae81-cb73b7447e36", "comment": "Malware payload (AgentTesla)", "value": "2646b3521a8751ba1d0bc137a6a2421f6728ebd26794217aa6382ededfd48d05c5a20fdfcf26ca8f17a8eb2eb64ce387", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996241, "uuid": "0a11150d-8cbd-4f38-bf61-bece83ef25c0", "value": "T118D402A833E6EF64D26E57FC18B0514057B2F46D6A12C7AA4DC7B0E719E2B510EA0F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996241, "uuid": "6bf74451-80ca-40fe-b69a-8ac3eb693718", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996241, "uuid": "43c19cb7-097b-4314-a6cd-8c93bd86001a", "value": "12288:9yt+KsOS9s9Y0ZwR2G3qEUavOz2dh3fJ3s7F3JoM89qhYURbm2qcc:9yt+KY9s9YYwgG37UKPzPJ8pNrhYURbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695996241, "uuid": "873a2b81-7f54-4090-9ad9-bfda356d7516", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695996241, "uuid": "7aee8dbd-c4f0-439b-809d-96a6bd75a234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996241, "uuid": "20fcfe50-b0e3-4568-8cfd-5283e95505d8", "value": "727987dd54cdd7bce9f056b2a80731e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6fb347-5ec9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695992832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992832, "uuid": "7e87a8c5-c742-48de-8b3e-0fc678bcc7da", "comment": "Malware payload (AgentTesla)", "value": "900dac8f37982bc1cc0fb8a252a1318a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992832, "uuid": "069b2ae2-0d43-480a-931c-e26e3561620b", "comment": "Malware payload (AgentTesla)", "value": "2cd1946baf172cd936b63b362b52e99428ea983cfcd1aff2628e6b27c86db6fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992832, "uuid": "c654c8e4-6db2-48d5-9ceb-bda32fcd3bd3", "comment": "Malware payload (AgentTesla)", "value": "33e31765e736d6981952b072b3254fa5e77c0dfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992832, "uuid": "0b33a48b-727b-4b02-9da6-139051761ab3", "comment": "Malware payload (AgentTesla)", "value": "4a6c8e04bf149f321415ef9e0fa0ffdae8a4145f50e7a9a7373e6d808207a462c95a2d07118b28b8144e08c8de9da351", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992832, "uuid": "42e79324-e903-4028-afcb-ecb20cb5fbc1", "value": "T1AE848B1026EFA44CB1737F631BDDBAE94F6FF7B1162A94A92500030B9756E80CD65B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992832, "uuid": "bd99b01e-6339-401f-a62c-a107353de858", "value": "6144:5k5fu9P1R5gDwH8H8H8H8H8HkH8H8H8H8H8HXH8H8H8H8H8HlH8H8H8H8H8HwH8m:5k5fu9P1R5gDwcccccEccccc3cccccFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695992832, "uuid": "514f1377-8911-46c2-ad1b-d566c4209995", "value": 371462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695992832, "uuid": "f87952ec-1de2-4e8e-b317-1c5488e5085c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992832, "uuid": "9bdaabb0-22f9-4de0-b06b-b16c147675e1", "value": "nicko.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd88513-5f1b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696028133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028133, "uuid": "058f3f40-31c0-4c69-98f6-f125edf899d4", "comment": "Malware payload (RedLineStealer)", "value": "b6993ec4efe8c5c7cb57cb14ad2d228b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028133, "uuid": "3a5e49cc-e586-4c55-9ced-f1fc52e117d6", "comment": "Malware payload (RedLineStealer)", "value": "2d35c6027e35619f91d84948e53357617f7c31780b29f23ad5bc46e52de5563c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028133, "uuid": "69b521f3-0fc8-4ef4-806e-4cd216321280", "comment": "Malware payload (RedLineStealer)", "value": "8ca71391f2dbc6cb03927f66c9fc67faea4d6166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028133, "uuid": "a23fb499-6a0e-4826-b9f8-51076b2640b6", "comment": "Malware payload (RedLineStealer)", "value": "802f591d376994b4436aebb6847d2d10b70a5a503157831e7c4439dcbb2b46ffa11e76271951764a2dd6e6b3d62f4584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028133, "uuid": "7f35dbec-ca82-494d-b2b6-5bb6375f5542", "value": "T1A6352263A7E85062CCE117710DF61AC31A31BCD3987A532E33882E5A45B3ADC9972777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028133, "uuid": "9ba7fb93-fc1c-435f-b52e-aa96c7f705ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028133, "uuid": "88360ceb-3f66-465f-af47-9099ff3b41f0", "value": "24576:tyouCM/s7ZlZW63sUiGEKn+bb4GN8PXwoaVjpLjM4z3U6Um:IpCC68Up+pRo6jMsU6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696028133, "uuid": "095df5b7-9b59-4cb4-882b-0b8cd2262d67", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696028133, "uuid": "5d677ee9-fda4-42d6-b927-93b31afd46e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028133, "uuid": "1627c6e5-5c45-4287-a80c-c7dce986945f", "value": "b6993ec4efe8c5c7cb57cb14ad2d228b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0145bd83-5ed6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695998373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998373, "uuid": "59cae63e-a2ab-40d7-9d07-a97e6c721eff", "comment": "Malware payload (RedLineStealer)", "value": "6b85bd9855696dbca6f94a8e3717acc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998373, "uuid": "ccfb8b5b-55d5-41e5-88ae-b2effc6312d3", "comment": "Malware payload (RedLineStealer)", "value": "2d68e2e5778b7c93f48224cbf667d44756160ba01439f238cae7bed77d981daf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998373, "uuid": "bb452faf-0d30-4e22-8e03-c3e75477b606", "comment": "Malware payload (RedLineStealer)", "value": "297b4a4c120df756ef0fe2bad68af8ba910d9b2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998373, "uuid": "cb8aa37e-d229-451a-92f4-95432b39b34b", "comment": "Malware payload (RedLineStealer)", "value": "1cf82b28d033ce9448ae87e5fe02c4117d80f1d440dee53b67939d5cf0f2ac3b8241158f1ee347420c2efa2b68dcea07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998373, "uuid": "e303b269-f3de-49ee-851e-9ad0e60940b2", "value": "T1FA84D10261A2BC2CD6664532DE2DCAE47B3FB5718E6967A733245B1F08702A3D163FD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998373, "uuid": "447188ad-1711-4b26-b525-77e3561b483f", "value": "cceb1c098bb76547116fd8d11380b21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998373, "uuid": "e81b5031-3715-4084-a515-5f4775a9e663", "value": "12288:GhWaLqvSAVnxQjUk00+ihI+QycMATTDF:GQaLWDqjC0hhI+jXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695998373, "uuid": "d9870dd6-302d-4b2a-86a0-dfa8306fd3b0", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695998373, "uuid": "20ba61fb-de47-4c4d-b977-54dc2c212776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998373, "uuid": "a99e5c18-05c6-4111-94f8-54a77f719b8f", "value": "6b85bd9855696dbca6f94a8e3717acc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d483f848-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696010324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010324, "uuid": "5089a793-e197-4d57-8b55-08a630699202", "comment": "Malware payload (Mirai)", "value": "4009a562bd6074bb6f459a1a390de092", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010324, "uuid": "a5b3b43c-4e12-427e-9131-3f2b80cf8ca4", "comment": "Malware payload (Mirai)", "value": "2d6a6da8e9e8ba737c5545353a4459ced3feb63cf2d82f322b7677898a8d9f9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010324, "uuid": "a5f31a85-45ee-426d-b265-ebe2fc6b3c22", "comment": "Malware payload (Mirai)", "value": "4f7db0f3380291145ca29f7160d67aacfeab57cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010324, "uuid": "fdb123cb-d11b-40b5-87bf-6f346c96eb6b", "comment": "Malware payload (Mirai)", "value": "f6923e37e96ee8fa5fc621c110340f63091a0abce77fc668849d790f372a5fc68de3d363bf36900a9cd70f9ce43f4dde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010324, "uuid": "10e3c629-2fd4-430e-a4c6-09d27b726410", "value": "T17E03D651F8825A27C2E1137AB6BE4A8E332073E982CFB617D9214B107BD551F0D63F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010324, "uuid": "d005150b-7066-4c84-862d-059ee289d5ea", "value": "768:ZqILBdhxPh91eftcG5dm80LyFBWEu/tOr4MkKvlw9QSo8qMurE1Jomxu/NkwckkH:c0zmf2G5dmSBWjV8kZbJqa1RuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010324, "uuid": "97f683ba-72c4-4a67-baf1-da2338e9da99", "value": 38116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010324, "uuid": "9c07bc05-ba9a-4d50-9b32-131a107574f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010324, "uuid": "2caf4bc8-d629-4203-950a-0b4eeffdadc3", "value": "4009a562bd6074bb6f459a1a390de092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f439231-5eec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696008033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696008033, "uuid": "043abd11-5381-4200-88bb-85c333ef4701", "comment": "Malware payload", "value": "138f497467183fc2665b157863841d3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696008033, "uuid": "a8862fec-49c5-4dca-adc1-88ebdd8a80cb", "comment": "Malware payload", "value": "2d7b5138fe37bba9002976f956ca8dde23634c764eaa1ea282c5971797d92ecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696008033, "uuid": "73b5bbe5-f2a0-452f-bfd3-aead6dace735", "comment": "Malware payload", "value": "41b0ae168fee430ee835a20b6d0747fec1226511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696008033, "uuid": "8fcdbcbd-976f-4e30-9816-040d8ed8558e", "comment": "Malware payload", "value": "8869f8c7686110e9ac8b79188371a41dd82fd9c925506d0aa93e1f63d2ba245a1cb8a906b8d1f9bc0745c84e4591b7e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696008033, "uuid": "19917857-7b91-402f-8fc0-f62cf97be054", "value": "T11B74BE1076F48031EC73143288B4EBB4176E79644F965A6F73BC1B2F8BF92C0E15A5A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696008033, "uuid": "9f3f4d65-1c3c-4837-b979-8b1f089c8891", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696008033, "uuid": "ddec6f35-e2ec-4fbb-a367-2d1a9e50617f", "value": "6144:SXTeW/s5GqrO5aXnfEGIXWPvZAOPyMylde7OcLZstFt90tqS4BVs0BC+:pmcGqrOk86xZyyOcLZstFDjS4js0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696008033, "uuid": "f0c44408-3b23-41a7-9cea-2824b457fd06", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696008033, "uuid": "b5a091d7-a09e-4c9b-a1f7-433e1d7e767a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696008033, "uuid": "0c526e45-5979-41a4-91c0-a987d39d2967", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77376ec-5f07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696019724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019724, "uuid": "d036cfc3-b82b-4653-8dea-cd8d1ccbc87b", "comment": "Malware payload (Amadey)", "value": "50d53ccddcb21bcc34aecab4837643a3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019724, "uuid": "0199bde1-36f6-4da8-a108-2e1d137b2b12", "comment": "Malware payload (Amadey)", "value": "2dd12ba5ec9cefe83d3d75f694fcb042e38bfa2497f7faab35925f502aa01200", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019724, "uuid": "84639f99-7436-4ec3-87b5-00621e39e90b", "comment": "Malware payload (Amadey)", "value": "9edf6722f7a9e1b70ccd4043355163107a8d111e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019724, "uuid": "96a6bf50-bee4-4d14-8754-0526d7873af1", "comment": "Malware payload (Amadey)", "value": "81a9196debe093a659304531ef0efaa2e48384df4ea5dd35193e5a31e142537de2ecdf9250ec45a580c0989c16e4c2d8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019724, "uuid": "b64f0a6c-ba74-4ca6-994d-a13e8c25baa5", "value": "T1CD352242A7E051A7D8F527F068F3024B173ABCB19C7543A76358AC2A4CB3A42F53577A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019724, "uuid": "1b37ece1-c371-475d-90a5-01507a5d7967", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019724, "uuid": "55c20a37-1b81-47b7-bfe4-a81a0282875a", "value": "24576:zyhzdCR1vA3PiCQ0Rfu7NVD5P81/Uqrf/W/HQrOeAwHc47030:GhzdCrY3PhHRfYBErfu4DHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696019724, "uuid": "1627a342-e1da-43da-8dfc-576335029bf4", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696019724, "uuid": "d5a799d0-b154-475a-bd39-929ea1a9fdaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019724, "uuid": "2f208ecf-c61e-4b0b-8447-57cbcc0c8ab0", "value": "50d53ccddcb21bcc34aecab4837643a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3edd4a-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695986904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986904, "uuid": "a2acdb74-5f03-442f-bb95-2f6bea0d34c8", "comment": "Malware payload (RedLineStealer)", "value": "70b17458360368805cc2b28bc4efdfa7", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986904, "uuid": "a48982db-0580-412d-a414-25fe98e27bca", "comment": "Malware payload (RedLineStealer)", "value": "2e46886b318ab8a3de4caf0e3b5df6b7ab0eb9d1222fe06c2f213a3d64918b59", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986904, "uuid": "5e6554a5-773d-4142-a91f-30eed3e7b6ac", "comment": "Malware payload (RedLineStealer)", "value": "44c69ee5d72f38ece367c525a4640320225d6e3b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986904, "uuid": "0e837b59-8d1c-46d9-aa8e-e3d48e2bf11d", "comment": "Malware payload (RedLineStealer)", "value": "863443924af3fb028ba0e2a6286111cd0d8c334706de57a4a60ff75f4dbe23a6e0d7cb1b9f27c7ff09b661147443d4ed", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986904, "uuid": "9ce76ce2-7d54-4da7-b8bf-7534c7661e07", "value": "T16E149D11B181C1B3C4B6157084E6CF395F6A7832476A95C7B7DC377A5E213D2A23A2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986904, "uuid": "3705323f-19ad-4e21-849e-c391d3edfd51", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986904, "uuid": "313f0d53-d104-4bab-946f-5586949b72b1", "value": "3072:jDKW1LgppLRHMY0TBfJvjcTp5XX7GmCMY7pdkG8WH/91:jDKW1Lgbdl0TBBvjc/KmWHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986904, "uuid": "d6a9ed56-d5da-47c1-82a0-54e2066dfb2a", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986904, "uuid": "b5fc2f11-952f-4c23-bd31-78385a02fc21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986904, "uuid": "278f8828-55f9-4b70-bc89-5ebb4bb9d6e6", "value": "DHL SHIPMENT NOTIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5eec311-5ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695978919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978919, "uuid": "f2009688-a228-49f2-ba44-cac8aadb949a", "comment": "Malware payload (Formbook)", "value": "14224847f3c3ebfbb06589e0418d1577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978919, "uuid": "85c66c66-4cef-47bf-9d6e-1dd167468cba", "comment": "Malware payload (Formbook)", "value": "2ea01def771f0e57b541d4819dd9a543c5adb3a4452c6f5c03eac2c49c542bfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978919, "uuid": "2bb14aa4-330d-4dff-a6a4-f760e35a2283", "comment": "Malware payload (Formbook)", "value": "de41acf047697977c93c64b72bbab6dcc975e5a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978919, "uuid": "000ef855-d94c-4210-bfed-1a3db2c3e0de", "comment": "Malware payload (Formbook)", "value": "916fe34881d3e3ea587b4651bd33d1d170a10892756e5713008703cf567a7adc6f7d3aa20de3e21ffc447f6e43cbda71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978919, "uuid": "da21f8a4-2355-4cff-8a7b-7d2daa56ae02", "value": "T1E9D4225CF5B64722DDD4233E62C8672A83717561E001F3AECA8E5ADB0E357581A60F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978919, "uuid": "487e4610-8981-4495-bdb2-a41de843c420", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978919, "uuid": "99034f6e-e888-4675-9117-5a7441f7d771", "value": "12288:la725xeBmijd1YkdxAk1LcxOYVVVSP0W46MyDM8w4Lg7L6OOhiF:LJaYkr9lyRoP0W46MYM8w4Lg7L6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978919, "uuid": "bfe91cce-b964-4396-8032-d200680da910", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978919, "uuid": "55e6e032-4902-4444-bc96-3d6f6d32d8a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978919, "uuid": "dc7da66f-2dbf-4fe9-8a80-773b8aa9633c", "value": "RFQ FOBPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735d62ee-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986538, "uuid": "fca4b76b-551b-4869-9874-94c387a50cf0", "comment": "Malware payload (AgentTesla)", "value": "c7d17f56b41044cd971c75500b4d73bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986538, "uuid": "ea56bc12-34e1-4cf7-b9b8-2546980e77ec", "comment": "Malware payload (AgentTesla)", "value": "2eb161f71d7d7661cac272f5a3906e4257c0d65bd70435c9aba8f4344c8e4b7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986538, "uuid": "ab46c22c-49e6-4c52-9380-9d1c33fe6535", "comment": "Malware payload (AgentTesla)", "value": "ba467cfa40a966551486d1413cd708aa802f7361", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986538, "uuid": "71410a4a-81a8-4229-bef7-a2634041e6a1", "comment": "Malware payload (AgentTesla)", "value": "a365057b46ade167eb69febe9259796828aa2d77fc19dea701a96b36fe533e8d52075c660b28fac889fc6730c954b326", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986538, "uuid": "9c3fba8e-a505-4c89-85e2-0e1a4d2cc94f", "value": "T1FAF423D9F3F946DAE2469A9D46C8E3F919F0731805E0C1C4B7B41E8D66B102D4F86B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986538, "uuid": "ffb7b94c-adec-41bb-9d1c-ac282239f7bc", "value": "12288:VUnW2yIJvmXK7FHb8vjIPuiAWrWegLRWQKvWb+s8YnVEKRCT7pic:GGXKBfyWr3pvRYnVE7TL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986538, "uuid": "bcfee478-fe42-4a44-b31f-7686350e3032", "value": 753225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986538, "uuid": "1f9f00d7-9799-4598-bd38-d30d64ec2142", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986538, "uuid": "1d8b4062-3120-47d0-9226-57b47d139eab", "value": "INQUIRY_10002044U.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59809fbc-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024291, "uuid": "b1a31d7a-86e5-4668-a108-7d3171980734", "comment": "Malware payload", "value": "b7c76551244eb8e857288a9025f29e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024291, "uuid": "3d3b2715-e64b-4ed9-bc6b-f661bcfbd853", "comment": "Malware payload", "value": "2ebd4a4462326f5fee96d74acb3d9db2335bb72d508dac81e5ea1dfd53ef7777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024291, "uuid": "bf9d79e4-32ee-4096-af33-a36ab9d0df78", "comment": "Malware payload", "value": "8d69d917b375cbc9d9cfffa8f9b6ccf2ae8f57be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024291, "uuid": "b188b14e-7149-48f6-a20b-b183af3e1c8e", "comment": "Malware payload", "value": "08389ebe3a4eab1895cb0a7f10acbf8b008dc59fa9260f70013a0650a9f9464d941165bec43e76c93155e8158cbdfe5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024291, "uuid": "267e48cf-bde1-4017-adb8-9fc1d03cfaba", "value": "T1AC34238DE9501D7D47A7A019E73958FDF0CCB871C4489C23130ADF3AD6A3972AA96B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024291, "uuid": "99d9ecdc-48fc-4e8b-88af-0c8144dc2729", "value": "6144:wwd8Qkxw87Ch5DJg/G813U36i1Ow61bIV47cAFmYs9Q:w2Ky8aVJ8G8xO6i1N2bMA8HK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024291, "uuid": "9944671f-df8c-456d-b6f7-9ea39f2f30ec", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024291, "uuid": "cc10f0df-3c7b-48a8-927f-ee731b25c170", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024291, "uuid": "9dacfdac-4fc6-4dd2-8781-fa7016c6c2e8", "value": "288319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275cea9e-5eca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695993283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993283, "uuid": "7d4dfacd-7462-45da-ad6b-bbb77f50cf86", "comment": "Malware payload", "value": "71471d6ba26a1046e49cc34cf9b1122e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993283, "uuid": "2d3c95f7-a2f2-4d1b-8fa5-8cefbc5a879d", "comment": "Malware payload", "value": "2f1180328bfc0525badfef32a5f0af741c57e34f8ce4ab6cef442eded34fa7b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993283, "uuid": "f416b70c-d9d3-4957-a375-0a00a779e8a0", "comment": "Malware payload", "value": "7a4540a4a7ac3b40959128752578af7abd972e87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993283, "uuid": "667e7410-3992-4391-9fbe-72246dd987f9", "comment": "Malware payload", "value": "686dfe80c3487fc2b208bc734ad6216b58fd455c33f00a49b55847e112985c22fd7af5dec3adf127c0972e89cd70877f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993283, "uuid": "a31e9503-54ff-4e79-a38c-0d35a26dab2b", "value": "T1833419459B5D4273EBBB2373B01211478AF9D186E495EB8F64AC28F22D82748ED4437F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993283, "uuid": "62bb40ea-1709-4386-bfcd-babd6cfc6dbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993283, "uuid": "0920ba40-093d-47ba-bd4a-2fed3b7a302c", "value": "3072:E3mkbM28z4KSKKhxYgvURgyVO7EjE/+WMH7pv2CWaQQBTKg68s0SV:328z4P9vfGWM1jQ2KV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695993283, "uuid": "aeaad850-cd7d-4137-92dc-8d228940f7a2", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695993283, "uuid": "62802f8c-380d-4e03-a475-553a2149307e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993283, "uuid": "1564583d-cb81-440f-8dcb-4083186ba838", "value": "71471d6ba26a1046e49cc34cf9b1122e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3457ded3-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024228, "uuid": "5b9534a1-e480-40b8-9411-4991a37fad23", "comment": "Malware payload", "value": "8879cc78ccae516e379f522edb812262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024228, "uuid": "c4356774-3e89-43ee-bd4e-31e5b7dc5d39", "comment": "Malware payload", "value": "2fa39f4c229f9c15ec1f54ca57fb4c6eaae7883e7ee44d2704563693967371bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024228, "uuid": "e3bcab1a-9cc5-4282-8a6f-b911a608e1dc", "comment": "Malware payload", "value": "908d5a41f573fa56af5995ac7090da38d5f3341c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024228, "uuid": "f25ae7b1-c3ab-4c72-bb64-3e438a7b5f57", "comment": "Malware payload", "value": "e6af5da1633c081eb71ff1e52228179665affccdc167efa07763a0097a238eee8dabab14cd6e1f50dc4f7f3948f71e73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024228, "uuid": "414d8f59-8879-4cc1-aaaa-7d26f3601c69", "value": "T11C3423EF18F23190BB97948779E3370BDCD1A4AF780A065D9BE850137C7DCA491B9096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024228, "uuid": "4cca448f-47a5-4967-9e39-b0be42344a43", "value": "6144:R68aRe6PQQUIDfx7gApY5bcNmB+fgsqLIL2HeFzxPeZH:R6fPv7gApYN3yzF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024228, "uuid": "84d99c7b-4e26-432d-83b8-6cb9e338c729", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024228, "uuid": "b230426c-8fc8-4cf3-9b9e-6f981fe9f12f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024228, "uuid": "9d4c6875-723e-4154-94c7-07eb6bc9393c", "value": "288311.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d9e501-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024464, "uuid": "92954fca-88d0-4c84-b6e1-c2914b89565b", "comment": "Malware payload", "value": "479d55e84c00b8921f1fbe5ff49683bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024464, "uuid": "5d45bce9-b306-4636-9034-875c9ab576e6", "comment": "Malware payload", "value": "30e017622513d627fb62264f7bf7b6747b81724795b0460d037a90ad92292574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024464, "uuid": "e737c015-2caa-4560-9733-1ab782c0dead", "comment": "Malware payload", "value": "14f2ffd6f854d3f4951347f4f1f2f2ee97a6a664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024464, "uuid": "74dc8e97-88ad-4237-b994-d2c278a83aeb", "comment": "Malware payload", "value": "78c37da9422602fc0af6e44bd5840e0ffaee27d03d9d1167a533bf476bfd1bbe025c3ba31a4c2c8d25ac43c8d45e11a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024464, "uuid": "08485f74-c17f-4266-a499-aed5ec3bda05", "value": "T1EC3423DDE7784310CA77A47355ECC00AA03B821259A670AB734664B7B6DACFC0A7F581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024464, "uuid": "d141bcc3-85d5-49cf-8ae0-f1eefce42c60", "value": "6144:LPCHXvDuXFgjRbrLZt3T/ySk6WlRYZEgoI1xVLfTgB92SRCkJj:T2vy2jNPjqkUcEPcnLkBwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024464, "uuid": "d70bd5cc-6368-45c9-8f0a-12fd1cfd2940", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024464, "uuid": "128e5309-55ff-4c67-9376-4f709a548dd3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024464, "uuid": "460c134e-dc3e-43e6-a359-1f92e6063bd3", "value": "288340.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77740e86-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986545, "uuid": "272183bc-a7ba-4566-b9b3-fce801564c74", "comment": "Malware payload (AgentTesla)", "value": "201cd0a2fc6a87d25d6aed1e975fae71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986545, "uuid": "f8fe1703-f4df-4fea-9d88-63d09bde8036", "comment": "Malware payload (AgentTesla)", "value": "31ec13333c42a317cbfb1309873e4c2e548fd43b4384d7fec3783ce6b462aeed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986545, "uuid": "b8777dd3-dc24-4f9c-ac2f-dc07a8fadbdf", "comment": "Malware payload (AgentTesla)", "value": "ceccbf7e0dfb69dda31c49b218989b8894f5b48c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986545, "uuid": "859e4a04-ee61-4a03-961d-46062cabc179", "comment": "Malware payload (AgentTesla)", "value": "954f4b041bd0f0d45a715185d49d66c4b4c3d2515c85f204144ddc5573037e7bb60dca501aaa20575afb54e5ec9feac8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986545, "uuid": "9982e848-1d23-4ae7-b4c1-a3bb59f03cdd", "value": "T195F4232B23F30364CB3269E5E38CEE4F82F9513049976C6AA591B69E14313824951FFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986545, "uuid": "b9dd754a-00cc-4276-b2d5-2077bf0a3fcc", "value": "12288:rblepfVSufnLqB+CodKtca2W3l/yWsGELZeylISzVpk7IidIOOKGTiUed66a3xBe:MpfwImBhowH3KWsgyDVpk7wO/X6bhBVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986545, "uuid": "d3ee46ea-5b44-4d9a-92ca-bbc2fadfed45", "value": 747215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986545, "uuid": "d6c8eb11-630a-4932-974b-41097b2ec521", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986545, "uuid": "465b0a1f-9c9c-498a-b26b-a820c790ca9f", "value": "Enquiry 09.29.23.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed38ea4b-5ee5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696005211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005211, "uuid": "c148dc73-7793-4390-9221-868a1de67f6d", "comment": "Malware payload (Mirai)", "value": "519b34e9e18344a745bc3694c8dec9e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005211, "uuid": "dcc63fa0-eb0a-4179-93a5-b45b4a371bfb", "comment": "Malware payload (Mirai)", "value": "3239c4352b6d74e044ee3f84e4bb96903c582f3dd184007e601943c2cd66552a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005211, "uuid": "37915e0f-c16a-418a-98c4-f65d011909df", "comment": "Malware payload (Mirai)", "value": "890a9cd06060e4d73c5e3fe4dc34ee6609279d9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005211, "uuid": "5b5dcce1-dfd0-4444-bdc8-6da7df3986bf", "comment": "Malware payload (Mirai)", "value": "b9568b3af1e92e0eb098d4e71b10a40b88853a9f787eb46cafd402fb8f07e6d0502a79b79d057bacca11a0338ca669c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005211, "uuid": "6daf79c2-4abb-4d95-a833-bdf6f7e9cb39", "value": "T15D230271890E8DF125303C76DA999753B6E12971C5673023D6290E3C2F796131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005211, "uuid": "9841d5f7-9cdf-4530-80f8-7e5e7b5a142e", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3J9q3UELbUXfi6nVMQHI4vcGpvx:DECFd+A6YHAx8LRQZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696005211, "uuid": "049ac266-795f-4ed9-b51f-1888ad7263cd", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696005211, "uuid": "c500face-4edd-469e-9f40-4e388ab5a1e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005211, "uuid": "ad7f05e6-03c5-4a4b-ace6-7d5686350943", "value": "519b34e9e18344a745bc3694c8dec9e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b27f33a-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977398, "uuid": "bb5d43c0-4c6c-408e-b2cb-67b8606b6b13", "comment": "Malware payload (SnakeKeylogger)", "value": "28480c8df9ed6744fde8cdc7baa68915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977398, "uuid": "4476f021-46ef-4b09-b889-4bb5540a14e1", "comment": "Malware payload (SnakeKeylogger)", "value": "32ab70a0b9837a3a959859ae34b2b8d5c195298fce995370f8df8ce0094279d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977398, "uuid": "c4c1f437-7dac-4345-8564-889941873740", "comment": "Malware payload (SnakeKeylogger)", "value": "6f7cc268816d029cd36f8672c7fc1521b0c09018", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977398, "uuid": "d0f72652-f933-431f-8b6c-dc562d51a113", "comment": "Malware payload (SnakeKeylogger)", "value": "b1e984aa5305033a1edef462bb383f09be1dd11a419da37bd87808a2aaebd8aec524bc0ae03398489a7e10548ede5b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977398, "uuid": "2ebdcad1-85ec-4a89-9126-d595fd0371be", "value": "T110D42358B9C08670EA9C1B38579C31574B717619E045F7AECACA25C78E363D42B32F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977398, "uuid": "4c879e54-94fb-4bf7-a2b2-6e89c304d9e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977398, "uuid": "baaecb0c-db4e-4308-b2b0-c382fdda9e87", "value": "12288:d725mCf4nvTZm1FGbpUqC6KAAk6aM7kWnghAoOdgMRH8lUTTCB7BE:kcr9m1Fkpm4WnlompHi7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977398, "uuid": "8ab7cdba-7754-49a4-aca8-d6b45dbf3cdb", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977398, "uuid": "5e032251-53ef-45b5-8cb6-aed2b6820a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977398, "uuid": "e46ae7b8-accf-47fb-b3c0-10fc9810754b", "value": "PO23-00016.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fb7e6d-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015909, "uuid": "b2b3b955-631d-42c0-85e5-dbd3f308eacb", "comment": "Malware payload (Mirai)", "value": "4b4b44b444602f1a28f56e68912384d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015909, "uuid": "dbff1fd3-5edb-4420-a91d-9209339ced6e", "comment": "Malware payload (Mirai)", "value": "32bdb63c8728d17f8dcee26b7368dd8eab5b4bc48b25b8eddae06c5571964461", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015909, "uuid": "17311b72-2ebe-493e-aa1e-6d7df24c33ab", "comment": "Malware payload (Mirai)", "value": "1c125539ae3f2b45ac3a67b8c74188b7b87d820c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015909, "uuid": "13bd1b45-c476-434f-b727-4feef344b287", "comment": "Malware payload (Mirai)", "value": "255f0eedd6cb7284948f2fddd22e529b088b499e00ac3e6db468313d7264b595edec3578612c818059fbb78d31293f07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015909, "uuid": "a30134b8-351d-400c-8887-aa7d39034bac", "value": "T192F3F856F8819F12D5D152BAFE1E028E33131B7CE2DE72129D246F647B8A87B0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015909, "uuid": "dcdd8131-40a1-4ffc-b7aa-1b861bf8461c", "value": "3072:F+9XraPTxGUqUZFiGXihG8rPIaIhza/YOWANhCSDtT22:w9JRUmGXCG+QaoNOW0LDFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015909, "uuid": "332bee68-2f60-45cd-8b8e-9e8a67bb2e6e", "value": 158416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015909, "uuid": "a6dad4da-a7e1-4e91-ba48-726f9d0a52c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015909, "uuid": "9787134c-4be9-4722-ba41-ac9f4cbbdaee", "value": "4b4b44b444602f1a28f56e68912384d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71dbe267-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024331, "uuid": "da776319-631c-48b3-9a2b-ca2ec7ad1666", "comment": "Malware payload", "value": "cd75b76658e8520b22bd7506f8ce4e5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024331, "uuid": "ef5c42c5-505c-4f35-b310-7b8ba7ca86d0", "comment": "Malware payload", "value": "3363c12239b17fceb8438541645374b7e250675b08cd3c9a16c353dae27843c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024331, "uuid": "0068f6fe-a04a-41e8-8b79-abd15153298f", "comment": "Malware payload", "value": "1ab25b22dea1e9761a547ad6bbf3ae0bea259997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024331, "uuid": "9ddd638b-a08f-4b49-ac93-6c3037cd8eb1", "comment": "Malware payload", "value": "89f4964f9e8fc54b9e91bd9c9b11c24c1cda9dc0de2b20d86638489c0e1a706d1715d992e30275f2511b6e7aaff5e66a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024331, "uuid": "233ce139-4632-486f-9c0b-16476e599d32", "value": "T1F134221AF26239DFFAF4C48E6055D296917BCB1FFC09A414A8826D49B1C960E8D907F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024331, "uuid": "af3ebb1f-e230-4f65-a169-21dbd30f7c22", "value": "6144:BCFOua/2QcVs6/75R/N80lh4d7Zapk0akO:Bnu82QcVs6/7VzE7Qpkfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024331, "uuid": "906994b3-37d7-463a-9619-fd71e450fe9e", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024331, "uuid": "cebfb86f-40bf-4080-81a0-0d3dd9f41076", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024331, "uuid": "dc64a84b-1ed0-4ad2-98b0-a08d1b40440b", "value": "288326.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e53949a-5ef8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696013051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013051, "uuid": "d6af735e-bade-4187-8ae2-ff8542379152", "comment": "Malware payload (MysticStealer)", "value": "688837d8552ac71f246d82673729c7e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013051, "uuid": "435ca8d2-02f5-43bd-b8d6-1977f238905c", "comment": "Malware payload (MysticStealer)", "value": "33a6d5ffcca32e81e27943c4b670be378e7399245fbf85231fac64d2fce43676", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013051, "uuid": "6ff3e9bc-db24-45fa-856c-3c4fad6fbcee", "comment": "Malware payload (MysticStealer)", "value": "d65015500906cb29d746466d26ed231c7803cfa2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013051, "uuid": "ea3751c2-a1a3-4c93-884d-79a343bf9e56", "comment": "Malware payload (MysticStealer)", "value": "5f747eb5c4cf01ac02388c01a578b9666aedb9942c5fe41f94d0956a0eeaf107052946ee4c3e07684040c40948826e61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013051, "uuid": "72b2db67-89b2-4037-89cb-40836b9cc9d0", "value": "T12E74CF1070E0B876CE3271365FF8D7B4F53C74B00F529B6B23A84B7E4E74281969A666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013051, "uuid": "f8477fe9-bd48-4ad3-b07f-7ac28aa1b8ce", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013051, "uuid": "9e81abee-7e6d-4804-b589-4eeeffaed138", "value": "6144:LeTeW/s5GqrO5aXnfEGIXWPvZAONyZ8iiO4c+z06azU8FVs0BC+:7mcGqrOk86x28iH4Xdkvs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696013051, "uuid": "57985d8e-4675-4b66-b35f-7ed6f8194dc9", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696013051, "uuid": "8eeb2e80-e052-4b85-a76e-98eb17def8de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013051, "uuid": "fdcebf37-e2c9-42e0-9a87-ef47fa61e1dd", "value": "688837d8552ac71f246d82673729c7e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe93d1d-5ec5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991465, "uuid": "b3e2937b-1225-48d5-bb5e-aa60689ef503", "comment": "Malware payload (Mirai)", "value": "cbab053b006995dc139a081de9fc8f63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991465, "uuid": "01865dba-0423-485a-a88f-0edefd9de75a", "comment": "Malware payload (Mirai)", "value": "344b6655fd0a36e178f28d460f09e1827f92498b06cac7aeabd1b7cede406404", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991465, "uuid": "b8b4cd6d-1608-446c-b0a3-61c82953688d", "comment": "Malware payload (Mirai)", "value": "f1f7d438a5623dbff7b9dcc863684ff29c81270b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991465, "uuid": "fef4b735-e6c7-4024-a873-695c4dab04d9", "comment": "Malware payload (Mirai)", "value": "305c7a2c927bf53a08b9ea5ff741e6bf12c0f1118cf7c32d3fa80cf94b52d49e36fea0c7c92f12ab086cc765c21a4049", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991465, "uuid": "762bd8bc-9024-4564-9b85-e0e2b841ea37", "value": "T121C2C07DE8A4BD4ACDED08388CDD13B8099D36C6B6CE4F9993161DC4AF6118B3C9A474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991465, "uuid": "57bda485-207c-484d-97cb-b25e5a1e5e5c", "value": "768:a7ddenS3j6Koolozxfk5JmsEzrtt3UpWt1:a7ViRzxeJmsK5t3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991465, "uuid": "eb3cb1af-8cd0-489f-92c7-cc7c2b1437e3", "value": 27252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991465, "uuid": "647c942f-3450-44d8-a9f5-d89b6b5f0dce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991465, "uuid": "fde0be57-c978-489d-a13f-a94ec7d324fb", "value": "cbab053b006995dc139a081de9fc8f63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6b30f7-5ed1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1695996541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996541, "uuid": "3caff301-3113-4ebc-86cc-f9cb6322c5e1", "comment": "Malware payload (IRATA)", "value": "973d477c147444b7dfeea7becc73d4eb", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996541, "uuid": "18e4639b-a903-4262-9569-ab6a6a0c19fa", "comment": "Malware payload (IRATA)", "value": "3480ec049c45dd8f9e0dcfed0dd5711396ee4f00dc84ada56c6e26ae1bb7a51f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996541, "uuid": "5cefa939-59dc-4fd1-b97b-d43b94fc68d3", "comment": "Malware payload (IRATA)", "value": "da85bacacc45d3fde6480c38e47ee91351a0efef", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996541, "uuid": "3efad9b8-47f1-4e35-a683-ca41bc4bee6f", "comment": "Malware payload (IRATA)", "value": "4cb113af7dd19aa4d2f2c0c46745466a64698e746da7ed9411c803e563289931a2fe2127fe5120e69d242987c49066c7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996541, "uuid": "b5d91d63-0b59-439f-b681-7d244e6cd7a1", "value": "T15BA533A2F325C413D8EBA63A1A1583C359FB2D624D038C8B38B6F77D25B6EF49751640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996541, "uuid": "d44a43b8-5580-4499-8a93-dfbfdcb6a7bb", "value": "49152:AE3d9ysCydl8V0NKLSqOf6UL10ZVV/nHhC50QBqktGRDpKVjF5:AaHrbl8V17OfRIVV/BWVokt0DQjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695996541, "uuid": "64d3cafc-2324-4e2b-b52c-c73435d79f1b", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695996541, "uuid": "ff78dbf2-c5b8-4cfd-987d-2820adce6c9e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996541, "uuid": "b2c9645e-99d0-4687-9387-760112fc6756", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053039ef-5ee4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696004392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004392, "uuid": "f0e28bcd-429d-4def-8931-abebf29fa8fa", "comment": "Malware payload (AgentTesla)", "value": "f82f969d6d77eb0a86acc15645eb66c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004392, "uuid": "ff3d167f-49a9-4b8f-9995-91580a786709", "comment": "Malware payload (AgentTesla)", "value": "357892eae7b1f63bbb3b803f5e1a72772e8cd4e1375ad013cd766b821ea4f2d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004392, "uuid": "58a05ccd-9f72-40cc-a81b-799aacc25f4d", "comment": "Malware payload (AgentTesla)", "value": "79a19e79e700595aa68067bc273c5119ec0e1f62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004392, "uuid": "456acdb0-e0bd-4cc2-9292-4866adc7fc8f", "comment": "Malware payload (AgentTesla)", "value": "e989eaf929b2e17a2452e7928e16119da6ffa38b5e0dfe40fff08e0a0b80275c5b09b4c7322d940a759ce0a25df4e377", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004392, "uuid": "2d86d2dc-32d5-44bc-a237-7425c7d7eee9", "value": "T1E194BF1035EFA48CF273BF531BDDB6E98F5BF7E12616915D2500030B8A66E84CE9A631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004392, "uuid": "0e55a69f-8246-4eb0-b15a-e2d53539593b", "value": "1536:5Q41aC1x5QTkGAtBGkuEBaRKdE9Hj+N2hGGkikGkFjGkikGkKEt0eEKU+kCKk70q:5Qgp1x5QTkGAtPuE8cdE9DE2hMkuj0n0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696004392, "uuid": "df97ea4d-94d0-4c26-a148-3d43f9086ea9", "value": 408014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696004392, "uuid": "73d39a62-87fc-4009-ad9f-3af860b33943", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004392, "uuid": "929d92cf-6b01-40d6-8d8c-31ddc93909b0", "value": "LUG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fea7ed3-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987365, "uuid": "2eb0bfed-82cc-47fd-b97f-b6dca41cc743", "comment": "Malware payload (AgentTesla)", "value": "9eedb0efb598aba84c00014eb76b4e9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987365, "uuid": "bf4380b0-cfba-4bc0-996e-617bab3326b1", "comment": "Malware payload (AgentTesla)", "value": "35f3bd46b2e5aae8b8ce493fa2b64fc091caaefc882a7b391dff4fe79eb73d14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987365, "uuid": "906bfa64-9e49-4f9d-a26b-70fae07670d5", "comment": "Malware payload (AgentTesla)", "value": "292fd4b1cefda0a90ce4ef3ad6aa000c7fda9403", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987365, "uuid": "d342ddb4-25f2-4829-a624-833f7dff7a4e", "comment": "Malware payload (AgentTesla)", "value": "d3b0020fd436fb7ab9d15a3b52d36dcfec2817b29ff70596c2a4b386d8fd0f50beb6211f51bcc98c669ba51910a79438", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987365, "uuid": "c4470cd3-57f2-4ace-bf43-e67f414bb174", "value": "T16CF40202AB9614C1F1BA62719AB5403203BB7A51D83ACF3D0DCC419D6FE7B61B950FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987365, "uuid": "52b37cc5-648e-4407-8c25-98481fa33552", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987365, "uuid": "06ab67c7-9039-4510-94ab-83fe8390e957", "value": "12288:ccHaAckj/17fcQ+F9F4XSdJpbeyBhJeDLjJTgp+FGRZBjL:f4k7JUQ+6GpNry++FGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987365, "uuid": "89f31345-a925-46b7-b217-6ece0021e553", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987365, "uuid": "14320dc0-b7b5-4334-a239-af6b4aa8a432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987365, "uuid": "571ef788-c6d4-4d65-aca7-dbbd43f36967", "value": "TBHD_773330900033..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33cbd2f-5ea3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695976821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976821, "uuid": "64caa6b0-1970-4e6b-a3a1-45ad03160412", "comment": "Malware payload (RedLineStealer)", "value": "31c3b0ab9b83cafb8eb3a7890e2d05ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976821, "uuid": "8ac09d59-1f5d-4551-8f91-780863bbd092", "comment": "Malware payload (RedLineStealer)", "value": "35f7e6ac149538b9ec2b1286dd43d4fb9e78aa78a4b74c64cd4194d7bc5cb215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976821, "uuid": "0adb2a47-794b-4a08-8b9c-19d76eca8c8c", "comment": "Malware payload (RedLineStealer)", "value": "5ae01358b1c88a6a0ef5d240abdc756835fdb572", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976821, "uuid": "14f751a9-22bc-4f7d-a47c-43ab609cec8a", "comment": "Malware payload (RedLineStealer)", "value": "3bb1423130260e4db95eb7c72184e484bf7d279abcd8dc0e423c46f7dbc9ec992e8d02d02dc3041346971320c932b49f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976821, "uuid": "c51ab683-5717-41f9-b824-195a3c13ac98", "value": "T173357C3038C9C169DED3107A42ECFD2885DDA0F01726F6D796881EEEAA385D166F3476", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976821, "uuid": "d913d891-5404-4f5c-b0ed-ce70a527eeb1", "value": "500aa68029ae375a898af1edb3f40b87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976821, "uuid": "95ceb0fa-d65d-4516-9f86-fcebdfcd31e5", "value": "24576:fMZThJqJAzoy99wI6DAnAia8gzRGK/6H1V:fMZThJqy99wIyAJWcK/6H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695976821, "uuid": "ea14f4e5-0517-47b0-89ef-51e761617009", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695976821, "uuid": "3d194251-a7ca-40b0-8ce2-6108f4ba82f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976821, "uuid": "a7dc457c-f653-40bc-b30a-22e06713ee49", "value": "31c3b0ab9b83cafb8eb3a7890e2d05ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba87d909-5e96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695971196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971196, "uuid": "e78d5eac-6bc6-458f-806c-032301608115", "comment": "Malware payload (Formbook)", "value": "733e39b98b5d9e34afd5feba60e74566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971196, "uuid": "e00a6626-1cc1-4e01-9c44-feaa2be11247", "comment": "Malware payload (Formbook)", "value": "3776d991080dd8cdf41d7b64315d1bccf2c09ed001058b9a28042d760f888163", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971196, "uuid": "fd7575f3-81cf-4704-ac48-5433c549e416", "comment": "Malware payload (Formbook)", "value": "33b76f208403ff4a41de8c0b59edf02ead600843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971196, "uuid": "4d8230e6-7567-4065-b32e-59ddcf737c7e", "comment": "Malware payload (Formbook)", "value": "fa99131d6c58123a6af06bf4f022d0d474405f6cf5cd858e8cf380203cd901f23c5538adb01c264caf3998563cdb2d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971196, "uuid": "ca86d376-d9f0-498c-a953-0facf26fd3f1", "value": "T1C1E4D43C21ED2A88F36596BCF3744EFF57D1796F91ABB8B7AC4CA59301A97C05502220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971196, "uuid": "e275c796-6406-4f25-b484-6210c34e91fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971196, "uuid": "6c48e83b-a0d3-4a9b-acd9-822c027233ef", "value": "12288:EuRr/TP5WypE15ZP5Lt35w2VM4k6yONHFs:Eu9/j0ypE15ZP5Lt35w2VM9ODs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695971196, "uuid": "8757945b-c598-40d4-b8c3-10a9a2d08df7", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695971196, "uuid": "185908df-c94b-4a00-9fca-5abb3348364a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971196, "uuid": "a9ae0a92-2271-46c4-8419-6e8b5c1d6e07", "value": "doc#230928330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88525589-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986573, "uuid": "6281e914-5dc4-4e28-869a-2f675e5386a3", "comment": "Malware payload (Mirai)", "value": "318b10fd66cbfb0832408eccf44f458c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986573, "uuid": "156f966e-4ff5-4f2b-8a73-4354a5b9db1e", "comment": "Malware payload (Mirai)", "value": "37a8b5cc53a18213e6651fd1b0da99bcb4657d5ebf3e1794c26c3e8bb0d1d6eb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986573, "uuid": "9328c58e-0ad7-4b46-917e-75c0959f48bd", "comment": "Malware payload (Mirai)", "value": "b26ab93a59ca5ef14852953a7db3ebbe9def5f66", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986573, "uuid": "502974eb-e37d-4459-b76a-69b6bb6c4226", "comment": "Malware payload (Mirai)", "value": "2cbd2326c51d95b3881afea5b4290a636b58479a829e546dc637b9dd2dfea061547ba34fd5b5d68ebec4b746af07b4ae", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986573, "uuid": "a551dbc8-ca54-43f2-a1b7-b0aed42a4ba5", "value": "T13CD2D0A980E7F6BCD0AAA6B5043D07C5ED76B216C21917B708E8647AEF570C40E30DB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986573, "uuid": "8adcaaf7-ed46-4557-8516-d75763155965", "value": "768:NYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBQMWSx0sl:NYJdJZiy1aBnQfTqBQAtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986573, "uuid": "554600e6-9a93-4456-9153-759efa5d8f46", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986573, "uuid": "0ddb9e2a-9f4e-40de-81c5-57f76d85bfef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986573, "uuid": "89027da6-c281-4450-a31c-fc63b2139c44", "value": "318b10fd66cbfb0832408eccf44f458c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8afc33-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695987439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987439, "uuid": "d2ec4d2f-43a6-4914-8e36-24f56698aeda", "comment": "Malware payload", "value": "1181c5dc9d8e8667f095329a37b489b0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987439, "uuid": "75166098-9f0e-4266-bd95-68b2a0b498d9", "comment": "Malware payload", "value": "382b06fb51f50d0165f77f84a76838f39c85f74081cca24c395a44884dd2d4be", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987439, "uuid": "6e20e305-bdd7-47ea-bee2-ac555ce7b6df", "comment": "Malware payload", "value": "c742472eff2156141e0a5d80b275e3871e03a865", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987439, "uuid": "dcf67b64-c3c4-4517-a044-175996c45963", "comment": "Malware payload", "value": "2c1952025215126a2de46cada1c13645c489165d4a3f65951363671c2fb534e6c2cb083fcd2e4144fbc74ab3d8b3ff7c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987439, "uuid": "bace5711-6488-47d2-867e-a9cd8a585529", "value": "T1D004123059460747EAEF09B4B90A9AC0B142A211F94973802FBAF2E9F7D2DBF47D5146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987439, "uuid": "a1cd8acb-4bbe-49ba-85fc-56eee527e502", "value": "3072:GJ6Df0ZFivqx4ja1/WFKW6vh5KabwkiXEswvH2QMHSu1zgLI0HWf2pTyz8elCXTh:uWf0Ovqx4jm+KW6vvKUiXV2HxGS8gLI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987439, "uuid": "09e20add-1652-4e20-8625-9958aae19ab9", "value": 179466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987439, "uuid": "56d44a0a-05de-466b-815e-0ebc06d7e5e8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987439, "uuid": "725e2129-94d3-44ee-8ac0-dc32545c6d4a", "value": "New Order 4658 Sept 28.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e273c155-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1695986725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986725, "uuid": "1eefd58b-8cfc-417e-a45d-fe8faa2d26c1", "comment": "Malware payload (RemcosRAT)", "value": "babe1890ad4fd7c930ed7597731af200", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986725, "uuid": "7d5cdefa-dbec-4400-b5fa-97223078a3c8", "comment": "Malware payload (RemcosRAT)", "value": "38e0af644ef980b21487b6e16dbaf21119014f3364c2d23ded1f52788b88421a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986725, "uuid": "228a0e21-6c52-4e74-be90-6fb1b7147a12", "comment": "Malware payload (RemcosRAT)", "value": "e09d80133802b67d4f8fb75e33aeaba3d6490c4b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986725, "uuid": "94fde0e4-3002-478a-8992-e531cab7ece9", "comment": "Malware payload (RemcosRAT)", "value": "b2dca39d23005e8560d259b31ea6a3a034cf208295b2f7f9c2480560b41ce2e34515424ab814216c7799727e6ba72b47", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986725, "uuid": "0e6d4f2b-2dd3-4b26-b344-dccc8d058ae7", "value": "T1B535D865431BC41607C46346DD984F89222DAE867E6BA23C339F1ACCD769360F41BADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986725, "uuid": "1f7c5faa-6d74-46d3-867a-3b14cdab223e", "value": "12288:H+VwTRAsUiSCywRckyI9eY9NMTRG5HswskHL/bZF7C4g4LYyAKRI0IumIm2QJeM:HMwTSRiiCO4sWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986725, "uuid": "70cccf1c-f622-44fd-bbc7-456a56fd436a", "value": 1067983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986725, "uuid": "b2bb3caf-c2f0-45ad-b0eb-28b505eb1eaf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986725, "uuid": "5445f1ce-140f-44d3-b561-86284ae4f4d5", "value": "2425252246__booking reservation .vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3a33d9-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986558, "uuid": "db8bcad8-f4cb-412d-855a-2fae58b0874a", "comment": "Malware payload (AgentTesla)", "value": "83f699d7efe46c48df712af7dca36ed1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986558, "uuid": "0df7ee67-046e-413f-abe7-8e7d7095510d", "comment": "Malware payload (AgentTesla)", "value": "38e70d025ae72c8671bc64c85954ccfd6da68c45cc8d490c318cfa4857390e0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986558, "uuid": "ec722545-48e0-41fe-8d0b-a5aeb30e6528", "comment": "Malware payload (AgentTesla)", "value": "d7e8f543ddc5e6dbe4dfc8e52f29dc9c3101b506", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986558, "uuid": "4d1bbeef-4025-424f-830b-01727dea7e7e", "comment": "Malware payload (AgentTesla)", "value": "92702f440951f3fca80af243a30114ff85547bac2df17be39f3defba5d88e752d1dfa9eecc240cab24344a86e66e9226", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986558, "uuid": "a6ed3fe3-cbba-4260-bc59-5b1cf7f06b96", "value": "T10AF42391851B3D0E039775123E64FA96C332F42D57261EF86D462EFF4AEEF4412226E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986558, "uuid": "ec303f84-e003-43bf-a7f6-3cee5882d72d", "value": "12288:xECvhq0pniDwZWvOzmi4VXNKaHDbwEybVwVTvC0PgGcNEMnzOiy+DoieLK:xbhq0piC+OEeaHDUEybVWPiNEMnzOi5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986558, "uuid": "850e667b-152f-41f5-83e3-05ae94b426f4", "value": 754479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986558, "uuid": "aaf69116-9f66-4c0f-a6ca-81352e847aee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986558, "uuid": "6125798c-afa5-4d31-aa0c-b58f401fc930", "value": "230284 ADAC.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be370dff-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696010286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010286, "uuid": "64ebcf36-fda1-494f-a0f3-316e5b64774c", "comment": "Malware payload (Mirai)", "value": "bb8c1510a54b3bcb088c7cd411c0cb54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010286, "uuid": "af5fac02-75b9-40f7-9e85-581f44b8d882", "comment": "Malware payload (Mirai)", "value": "39279ed160c4fa58431414d25a6c04024c490c70573f4eb4ca8bccfa34056f14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010286, "uuid": "83a3e4ac-4716-4841-92c6-d097fc5058ec", "comment": "Malware payload (Mirai)", "value": "3c9abcf9a0111b22ddd1a390e510593f95b43904", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010286, "uuid": "32dbfa60-94c7-4cac-b5d5-81331c5d7d98", "comment": "Malware payload (Mirai)", "value": "b253b975c7bd2dab7f1db534e03c95e239d26a60d273e7e85fed4e72f6a52a9614de419cd29c8dcbdbf5ca44af515351", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010286, "uuid": "1875c363-3e0b-4015-9d08-34494fe4e1f1", "value": "T113232B25B9761F17C0D1A8B521FB4B68B6F106CE26E8CA4E3DB20E5EFF619405503AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010286, "uuid": "3c7529b9-4709-4543-bcf9-71fe2719fc0b", "value": "768:nxoZ6yf3xx1DEmtrBy1ZBJcI7s8yAIQjCO+AW31WwL:nxEjf3xPjrBy1/JcIA8BIQjgjBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010286, "uuid": "0cd39a98-83aa-4ba9-befa-6beb93b691f9", "value": 48856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010286, "uuid": "6c62ba9c-51ba-40a9-bfae-69e5b3207eca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010286, "uuid": "9320e3c1-9ba4-4a55-a0b0-29dab78cc4e8", "value": "bb8c1510a54b3bcb088c7cd411c0cb54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f363db64-5ecc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695994484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695994484, "uuid": "cb5e9ddf-3518-4859-ace7-7a28baa484ed", "comment": "Malware payload", "value": "2fc30cc0fdae154a2847aad558875d1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695994484, "uuid": "be025f1e-c93c-4fca-b410-e48bff345c81", "comment": "Malware payload", "value": "39493f5883593ffdd429e94e916dab73a17857d6a8c304c76e29501eac7091de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695994484, "uuid": "4acd8507-fd55-4de2-a752-8bf4ec6fa9fa", "comment": "Malware payload", "value": "27f5f4858ab5a05147e0a1b1a4a42c5ff256c307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695994484, "uuid": "1791ba0f-23b3-4a59-a02b-b844b2ace3db", "comment": "Malware payload", "value": "d037f292c9cac536b08dc3d0d3e75ec04e4ecdf884ce7335ea0f7181005630ed013701ee6e1865a958f9a1deefc79ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695994484, "uuid": "61477729-bd39-4c8c-94bc-df7524325343", "value": "T19D945A15254CC44EF6CDD97A81E6CCB54E626926E3A4429A21F920FCCEEC3B7761720F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695994484, "uuid": "05d794cb-ed1b-42bc-9e1a-52ad6528a8d6", "value": "231ae748dbc4fa94aca4a2ab6a3f3a91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695994484, "uuid": "285215e3-3956-43aa-a15e-5e4b6524acf2", "value": "6144:UTdS2CJscHaVpGKOlOCxjAa9c+kIfBCInzwA7SsOi47VjxqQYT47h0s:UTdhHcHaGnxjB3BRnzwA7nOZ7GXRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695994484, "uuid": "f9de177f-9e3f-455c-b32e-a7699320c2d9", "value": 417281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695994484, "uuid": "42d9ad6e-8050-400d-9d28-3d87ba6e0550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695994484, "uuid": "dc2313f7-f183-45ab-bf6e-c9f27f3b69e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1eeee00-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024439, "uuid": "eeb1ff46-e7b3-4477-bbb7-d767cecf09bc", "comment": "Malware payload", "value": "af7807dd620c8c2a7f633a94c4e7fb0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024439, "uuid": "acbe89e3-6d52-4db6-8502-e460d0f1daf4", "comment": "Malware payload", "value": "396032121a7f26bbdb31fa2a4df6d966211ab17512a4822dbae935cc27a8d0ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024439, "uuid": "0b182c55-9d92-4dff-a182-ef4f303c9c86", "comment": "Malware payload", "value": "a217b3a74e71184b91dfba8756437f05ab3615ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024439, "uuid": "c2847196-fb36-416a-8266-1e674f7b9028", "comment": "Malware payload", "value": "3ca9976439244795655e2576b317b8e07ae8d1fc6a8697695386888e9f0cff3a7be8d8940d1e09cdd5e6fd5d639eecf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024439, "uuid": "2560d617-f18e-41a6-993f-616d3955f29a", "value": "T1453423A97D7ED57340E80EF813396B13694D6EF219ECA471338CA645746A882FA0F4B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024439, "uuid": "cb20876e-ea0d-4fae-90cb-04f645193d00", "value": "6144:ReKhh1HTHGl9fRxaswllLOWKauh25Tlq289M02W7yZ:ReKJK9f7wllLtKa1e289Mi+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024439, "uuid": "fa1f80f0-ca7f-47c4-9f7b-93f273319538", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024439, "uuid": "425c6c2b-71c8-4e25-baab-986d82c5c362", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024439, "uuid": "6f92fb90-72d0-4498-a223-840236216dad", "value": "288337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82273e8-5e83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695963004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695963004, "uuid": "e39426f9-ccf8-4970-9e14-65693198e6d7", "comment": "Malware payload (Mirai)", "value": "faa2541de770d3ffb300bf973976f945", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695963004, "uuid": "4876015a-76c4-4e58-adfa-e61552e96e6d", "comment": "Malware payload (Mirai)", "value": "3acd70bb41bb7108b1fa982a4cc86652017d00bbfbdf74964689498c3818cc89", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695963004, "uuid": "17ae87df-77a9-4a6d-89cf-396db672fdaf", "comment": "Malware payload (Mirai)", "value": "a616be43f248b07c7952e5e4e2d17ceff2b85632", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695963004, "uuid": "16ae2ae1-277b-467a-ac59-0b436a3b85f3", "comment": "Malware payload (Mirai)", "value": "f7a9bb47a383eb13db9d21c0d06885f4c40ddbd7e35354b13a44afd601035d83257656749be5aa21a9ffd0f97202c107", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695963004, "uuid": "b9cbfd08-27a2-4665-b2f1-919d313bda0d", "value": "T11F3302A2676E29E251B05377BC33AC1A66AC17B99C6730DA2CF05615B7C58024FF2382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695963004, "uuid": "fea2d1ac-6546-473a-9233-50dc15da5716", "value": "1536:69O/ZMAXIxNUk0GLcPqF1aBexo4opKZb/:69O/ZNKyKLGqFUF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695963004, "uuid": "15fe503e-535e-45eb-9019-3472b045af97", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695963004, "uuid": "b7097370-fc70-492e-9571-2b48aa2e4f05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695963004, "uuid": "278468bf-8e70-4122-9140-d177bbb00eb4", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5530b54d-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987347, "uuid": "7f83bb87-a64b-4e81-8e43-9d01bbf4a718", "comment": "Malware payload (AgentTesla)", "value": "157c416f294a63caa7fd269d8b62563c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987347, "uuid": "4fbd40ee-5820-4cfe-8f34-6d01007a3fb7", "comment": "Malware payload (AgentTesla)", "value": "3b001d6df03ebf0af01aaf30c6e29e27fa84b04c29e100d5c21fe9929cfe467c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987347, "uuid": "36a4e657-0ec4-4fff-af7b-d1efb1d05a15", "comment": "Malware payload (AgentTesla)", "value": "48b72eaee1e0c4c50318b92e868f308b3a03b25f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987347, "uuid": "1a48c34a-b511-4263-bc4a-507ab87ad57e", "comment": "Malware payload (AgentTesla)", "value": "842a14fd9b395cd11afddc91345ab9ded575836e61bded63e8e45a9efa7af77c9849548ee47cb3241883d8654704011f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987347, "uuid": "0a2e28ed-794f-47b1-9e0f-fc0fcf8f5586", "value": "T1F8E41297F60509BAD1AE15FE84C11D1D43F0C783E67EE3889AECD6EC64862F28D1125B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987347, "uuid": "a40415d5-3f3b-4e47-b91e-4e4363f525f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987347, "uuid": "1e8ee81b-7c2a-475b-bf56-0e62f2617814", "value": "12288:HQ7xZoj3Es7j3EAckjhFQq5GBAeaEZynx/uOjt+2SmC2QXRE+5ahOCJW/RhyoQqY:ckVFQq5GBTaEeGOjt+2SRq6aQCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987347, "uuid": "790ce81d-1d00-4a16-a644-f51d289e2acf", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987347, "uuid": "da4adba6-0985-4a39-b7bd-7d01ac2e51c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987347, "uuid": "b3718077-6331-4c33-b269-475304bf96ea", "value": "Quotation for labour charges - SSLow Fin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7353618-5e72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695955809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695955809, "uuid": "ba3304b1-9e93-4080-a2b8-6f9a02dbf556", "comment": "Malware payload (Mirai)", "value": "b40c233df9ad1b25f5ba091f65568ad1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695955809, "uuid": "8b72809c-3285-4f14-a220-cf2d8aa6daa5", "comment": "Malware payload (Mirai)", "value": "3b6c903644d93d7cf8018c66e660fca4accddd155bed1373ae01334c2fbc0363", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695955809, "uuid": "4bb3bd2e-5a14-49fb-9877-2004047f40be", "comment": "Malware payload (Mirai)", "value": "b646e094a4385c5d63db41f92dfc6dd79b3eb8de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695955809, "uuid": "af43684f-7735-46a6-a122-a2bfab74322b", "comment": "Malware payload (Mirai)", "value": "46d2196646eeacf88bdb3fd1c0771f5cb4ce9fdc81fa0b851c46c4a1e06f74b5e574752e47cb1152fb1b7963e117aca1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695955809, "uuid": "59b4e9bd-9a0d-471e-b2e4-2cfabb0130cd", "value": "T19AA2E11572632D55E3DD1C3DC96AC317F9A31BFC90F632767D415620C94E24A3E38A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695955809, "uuid": "7c311869-6369-4c07-89f5-407731ab6cb5", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj4thymdGUop5hT:vvQn4j+ZO5fKAlxkts3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695955809, "uuid": "386e1e08-62c9-442f-a5bb-9b472c2a20ac", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695955809, "uuid": "02f31ee2-8cc2-46b3-bc87-d4a11c1c99d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695955809, "uuid": "598d5038-3e4b-4be6-8a3d-aef5f54b000f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbc7a8a-5e68-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695951394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951394, "uuid": "898f92dd-de02-4b64-8507-48c2604d651d", "comment": "Malware payload", "value": "4cb268cff8a86008eb4c2390bd50f6e8", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951394, "uuid": "3b20d60b-afae-4ca9-9c18-03e3d6447308", "comment": "Malware payload", "value": "3babf9f9c5a1f30b147ea236f619a9f93e640489546d33f007acf2a4c3c887e9", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951394, "uuid": "634a3eca-1417-4d36-9ea5-00b78f24577f", "comment": "Malware payload", "value": "983857a6898fc9bb00e1e6e9ee304de77ae84671", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951394, "uuid": "2deacfa1-ca48-4714-9855-62a1e14c18f0", "comment": "Malware payload", "value": "4791c8cded4d2b3d2ca16fee12e0ea6a0fa641cd505a8e866c099d22bc25e1ea63eeb89f1bed793791d21169e3666098", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951394, "uuid": "6f9f920c-7c72-493c-a3cc-ccce35e58ea5", "value": "T1D073F1DEB84A6042C1F544BDCECAFF333A483059D0518F5F39996C63448998F8B6DB8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951394, "uuid": "32a97423-c179-4614-ba3b-9d85ebbeada5", "value": "1536:enO1jz1+Gzsd/1BkQwNofLbUvDPUMJiEe8IQMpEKOL6SRi8uGuV4:eY9+GzQDwNyQQMJPe8IjpERRtuGuV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695951394, "uuid": "0f94b6a6-ff3f-4dca-862c-add44e381226", "value": 77463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695951394, "uuid": "25a6bf06-a704-45a3-ae1d-9b51c5d22364", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951394, "uuid": "f2c374c2-3a56-4c3b-9fdb-f79dce8ab219", "value": "SecuriteInfo.com.Heur.29955.3309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7da814-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024220, "uuid": "01142729-c9da-49aa-8d6c-07822ccf8f8c", "comment": "Malware payload", "value": "a9ff1c57794d33b09b8683ec37662441", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024220, "uuid": "5e1c937a-5440-49ac-acf6-c1c26e2977ce", "comment": "Malware payload", "value": "3bd6915cd07beca4decf6fc3ac52903490d29b0004ebc37401c938dd845b5981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024220, "uuid": "b0aaee6d-ffa0-4335-8ead-99b4d0d7eea4", "comment": "Malware payload", "value": "2f8ce04f4800f150852520b1cecd7327c42f73fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024220, "uuid": "d3dc402b-6810-4f9f-8a72-b30c37f7fb42", "comment": "Malware payload", "value": "095ef3b37845f8b2971c390e68a2bc42b38a77561b155e2560ccd5d51dcabe4d23aab8b76a2b8f3d8bb49f4307fe9b34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024220, "uuid": "9b42174b-b471-400d-98d7-09fce0600d79", "value": "T18134235E59200273406E9FE78FA12B0FFFAA04C6D01AC6C9A9D79119320FF25939BDC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024220, "uuid": "ac1ddf59-f02d-4647-965e-72294edbfe59", "value": "6144:pDVrIPYaSbuVf0nie2PDipz8PNLWbqhhjhJTkZn3owB4+:dVkPYaSUf0nie3JCNLnhrA3ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024220, "uuid": "069d0fb9-aedb-43a4-9285-8f486ef807fa", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024220, "uuid": "081c3f07-c328-4128-a2f9-6df512515e6d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024220, "uuid": "f866c1a1-6823-4613-8661-455dc5d8d081", "value": "288310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf19b35-5f04-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696018468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018468, "uuid": "c3ebb4cc-b2ed-47e5-ad2f-766724c951f1", "comment": "Malware payload (Mirai)", "value": "0309bdcdd2c18e5c3158f26dd1e2dae0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018468, "uuid": "a026da33-85e1-48f8-a417-735f6230ee6c", "comment": "Malware payload (Mirai)", "value": "3bf17ab1e18de27dbf6c4bd403f6b4b5f77f4f612bebc25ece52099e96fbb9d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018468, "uuid": "e53919da-cacc-49e1-8841-0ba4c8e9004e", "comment": "Malware payload (Mirai)", "value": "c51cab236331adac8cf2735bfcec83d3f1df81db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018468, "uuid": "9d32c9ff-8a30-4167-90e2-afdf54fcc4af", "comment": "Malware payload (Mirai)", "value": "f0e92812a05f9aa7d4684e51a5668b4111e8255c751b717e14ba24c28751930fe6b810c0041a81e14b3c1793ac642de7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018468, "uuid": "ab314d1f-782e-4981-8bcd-8c27d55ad19d", "value": "T187B339376251C97AC08342F526EBD5729C13BDBF0732229A33947D60AF368DA1E99F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018468, "uuid": "46a2acb7-8217-4df5-a027-859a8ef9d770", "value": "3072:uirMUYZMo/QJLRZDsqtxqLX5I/uJiouM2yd1m7FnVqfJXoebNb:SKo/O8qtUbKqbm7FnVqfJXoebNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696018468, "uuid": "810a4024-c592-4f2c-a716-715dca202fa7", "value": 116760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696018468, "uuid": "6d74f851-6101-4e56-b083-297e2b27250e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018468, "uuid": "351650ad-7421-430a-8fac-33d0d91d0073", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9179af69-5eb1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695982723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982723, "uuid": "c33e5dec-cfb9-4460-b40f-ae3e9f76fd8a", "comment": "Malware payload (RedLineStealer)", "value": "b3adbba953e467827124b8d6c23361f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982723, "uuid": "e1f7043d-3f7b-4e07-90b7-d47bee43cfb6", "comment": "Malware payload (RedLineStealer)", "value": "3c051fc21ae98fa10313b0e6099c3dd297b65d2223b6c24ab22b7627a8ccc6a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982723, "uuid": "3ae3fb4b-09e1-4f1d-8caa-842c8804431f", "comment": "Malware payload (RedLineStealer)", "value": "cb77e26ba1073957bc43dc861552e58c98aff3f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982723, "uuid": "6441c427-e0d9-4d55-9a98-1b9e62672485", "comment": "Malware payload (RedLineStealer)", "value": "235a8189f2345c8ca6846de635bb3433308aa0113e4dc6d4e775038f0872bb53cca9095948a592068af757655ff46fbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982723, "uuid": "51f47a35-0971-4f10-8f2c-041b2f0e24d8", "value": "T1F2848C40B2D1A1F1D87311B69EA097E83F7A6A104490AF6BDFFCBA5D0B703D3A4D1661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982723, "uuid": "fada1689-2f03-44d4-bc53-90f341395741", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982723, "uuid": "267070f4-9072-40c3-a019-7cd77e2b86aa", "value": "6144:iY7nMrb5oXmTNmeePExIXx7vZAORokR9WqOKsMZ1GgGVs0BC+:rAloXmTUPJxftjWpQ+gOs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695982723, "uuid": "6148698a-667e-4f1d-a519-675699ba2bba", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695982723, "uuid": "34cb4d38-91c1-4c5f-815a-d6e9707f5ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982723, "uuid": "e4a7246e-7295-4b66-80a4-3c0d1320d5dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051fe0d2-5f07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696019425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019425, "uuid": "d16d3a19-6cb5-408d-8b3f-162e7f2d2e72", "comment": "Malware payload (RedLineStealer)", "value": "00304daad986944c62e3bdc85217e16c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019425, "uuid": "14ec1a76-843c-4c9f-81d2-7a8d8e0b3501", "comment": "Malware payload (RedLineStealer)", "value": "3c06b888fa64e1994ad92bda806599ea9cc2af64aaa33f7f77ba9f3e6f29c811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019425, "uuid": "82a1c5f1-d9e4-4a09-8c5f-4e321e0799dc", "comment": "Malware payload (RedLineStealer)", "value": "ff3d833bd13d915a5ea4517bf56ac4144480170a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019425, "uuid": "f8b5cd8b-0c4a-4167-ae83-9c44485a4132", "comment": "Malware payload (RedLineStealer)", "value": "b3f07fdec00aa884af697432d4f09377201584804ff1f90b8e582a5240bdec14e4ffdd18d090f2a92493ffe1d3ca8fc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019425, "uuid": "6ea91839-f4be-4a0d-83db-4311d104a44c", "value": "T140352303BBE90971DA72133059F212E31A37BDF15E68926B1B525A6F0E33790A53533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019425, "uuid": "8055b9b9-b3e6-4e3d-a12c-736acab86dc2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019425, "uuid": "700b8fb0-3aae-4b66-8b11-ffe0b8a14ea6", "value": "24576:myhXYARBQdLar0HTXm6/wLwSLOFSP+AcNMaLKW:1hXYARmLdyIAOFSP+/jLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696019425, "uuid": "15560f0c-f12e-48c3-8ccf-1b0707e87334", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696019425, "uuid": "d4b9272a-4036-425f-ad9c-e359e9589b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019425, "uuid": "80b8911d-da67-49af-a118-c528b57b727f", "value": "00304daad986944c62e3bdc85217e16c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a870f66b-5e90-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695968588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968588, "uuid": "72f45f58-6f6c-427a-9333-d0fea5d0f15b", "comment": "Malware payload", "value": "a399c5a2ab79be8f5587718d289ce4b9", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968588, "uuid": "487c5cf0-7138-48c4-83f1-daf6233cf009", "comment": "Malware payload", "value": "3c55da148b9e606e0f5354603e2bd1d6e217360751394a50e2d527975c90e969", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968588, "uuid": "8a25ca2f-e0b6-422a-9e7c-45838ad98a25", "comment": "Malware payload", "value": "93e0a92f407364d139cb087748812f7510169326", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968588, "uuid": "1b381dfd-34ac-4754-8654-847324cfa50c", "comment": "Malware payload", "value": "20ed88953cac93eb0acd6460304ff2dd4b7d4f09a4c1a1c848a134dd30619d75b8a3dac218b56855f32dea07d53eabaf", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968588, "uuid": "4bba2bd6-20b7-47dc-a94d-13f30a5b0c14", "value": "T17B21EB110F7603AAC3BA4F38A5E76333E361BA04FF8067A6614895104866E11FCA0FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968588, "uuid": "ebe5a09a-6fa4-426f-be9a-3a5e2a6135b2", "value": "24:8GIMmP4aaDvTwCKGIWNOAJBWM/+ul/4/fm/HQLULX:8Grmga0VNBJ/VgnzAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695968588, "uuid": "7a1ddf2c-b40f-49c1-9ddc-1c10f3d4a266", "value": 1183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695968588, "uuid": "ae604485-2bd2-4711-9d61-650a17e4a4ac", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968588, "uuid": "696f3f0f-f5b7-42ce-906a-ba96f093d51f", "value": "Project.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e82a1c4-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987362, "uuid": "1bde6fa9-c89e-4ae6-a7b4-2263b7a14b7b", "comment": "Malware payload (AgentTesla)", "value": "dc9cde2ad579040be65335f921aa9f98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987362, "uuid": "0e6bf643-9614-4541-b86f-7111df6d868f", "comment": "Malware payload (AgentTesla)", "value": "3ca46cbfdb8930e476e9452091a56cf37a28f848a88435463c6b08c787ea59ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987362, "uuid": "f31f243b-dbb5-4fc5-99b2-411cbd3c39ed", "comment": "Malware payload (AgentTesla)", "value": "669f51b88ac34c10eba38a75465aee3cf708077f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987362, "uuid": "6f7c0735-3ce8-44f1-aabf-6b09679edf21", "comment": "Malware payload (AgentTesla)", "value": "ff43475a3453ead4a95c833344a6d1545905b17aa9db30c38388cebf405ee68059168b3db4738a1d2fae0b3dd9c02693", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987362, "uuid": "2a8cf3ac-38b2-4b8d-bf43-5d398fb2ee1c", "value": "T173F402039B891292E1BA62756A71013003BB6916DD3ADF5C0DCCA48D1FFFBA1B554FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987362, "uuid": "e9a54f00-18f8-495d-b9de-723980e2f09b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987362, "uuid": "e72b0061-1708-4db3-bc52-a20f2e441bd9", "value": "12288:ScfAckj5sVCwE25gCufGVu+k7ygadFCFy7ACwJSk0/FAa8P9q2l6nDk85W:fkeVzz5Efiub72403wUk0/FiPEtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987362, "uuid": "d0d6eec9-347e-4031-b936-6c3183a584b6", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987362, "uuid": "13b06847-5289-4fb0-b2f7-0bf5124cb5c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987362, "uuid": "5ef8521d-a6d9-455a-b4d1-2830da65f164", "value": "PO6738223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216dad6c-5ef8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696013030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013030, "uuid": "2ae1cfb8-9e51-4706-947f-55cd241738a5", "comment": "Malware payload (Mirai)", "value": "3e6c222853bf882048e4ccba16fd31fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013030, "uuid": "080fefb0-7dc6-43f7-8100-ccfbea21e002", "comment": "Malware payload (Mirai)", "value": "3cbd41b183e5cfbed7b3ea3dec23411010a779f35c1ca05066116bf1a9f67f1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013030, "uuid": "b73716bb-d84e-466a-9f4b-42426cc9a0ca", "comment": "Malware payload (Mirai)", "value": "d37cb92725d2b0529e51e5c5ef79588e22c2e13e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013030, "uuid": "43df7f33-6d16-4702-b957-cc653dddcf01", "comment": "Malware payload (Mirai)", "value": "5d30ed54b78bb20028df8d19bdfe4e60ae51a7e68e76eb18e186a1159fc8b78547b2427dde0a0953918fa03987e7d167", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013030, "uuid": "bca14370-4fe0-4744-b35e-61b024389076", "value": "T1BE330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013030, "uuid": "0caa45c1-465b-4889-8c7f-03c00f73d3eb", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oG/:r/hqaJMDg9eqK806MHdkfQX6HuC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696013030, "uuid": "77e18c06-357a-418e-b5c8-06b2ecbbe8e8", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696013030, "uuid": "25a25ea7-86f1-47b5-933c-bc0a1cce564e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013030, "uuid": "59844ecc-4359-4107-989d-89b7e599a78b", "value": "3e6c222853bf882048e4ccba16fd31fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a79ead-5ea3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1695976603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976603, "uuid": "3ec87353-97c1-4d0d-ba0d-4d9223981855", "comment": "Malware payload (CoinMiner)", "value": "d381d9db9cbd1b60afdfb4f05e52a775", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976603, "uuid": "c8f07fbe-c9e4-4343-b55e-dfd1da1f2b12", "comment": "Malware payload (CoinMiner)", "value": "3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976603, "uuid": "ddaedb65-0c8b-46e8-8172-24e84e848dbd", "comment": "Malware payload (CoinMiner)", "value": "d59c52583ca791e07f3e6aec2ee2590ab9bfd67e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976603, "uuid": "f71e78f3-c139-45b0-bbe8-f84cfeb77ba4", "comment": "Malware payload (CoinMiner)", "value": "7843b1aea8cf1b2f105f29c90819bf75b558c82d30e121e0d64cfec3763900df6952957123d97c49138b9106932cfe96", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976603, "uuid": "72088861-354d-4c2c-9e16-383cb517bbe3", "value": "T1AF46D0B0B221E2FDF6C20374ED4914DC5B39AE3C0F4A85A9EBF1F08D65E06115B6E646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976603, "uuid": "720fdc2c-e29b-474a-8ad6-997de9780be7", "value": "0fdd3d21d2193b717f076a70dfaa659c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976603, "uuid": "5c8d0caf-cfd3-47fa-9738-d393174fdfd0", "value": "98304:Qp4L/JhqnNKIjRFlrDlyzVd/dCR36YDAbJC5kZne:QeL/JhqNRrhyXCR3FAbfhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695976603, "uuid": "37a6c7e8-606f-45e5-9629-08d430a44e43", "value": 5404672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695976603, "uuid": "14710135-fe13-4b10-9b6e-db7e1e4e01f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976603, "uuid": "b55c3a90-2f76-49ca-9bc4-caa663fde55d", "value": "d381d9db9cbd1b60afdfb4f05e52a775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1f6ef3-5ee5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696005181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005181, "uuid": "83a3adac-2518-4452-9c1c-9c06e84ffbb5", "comment": "Malware payload (Mirai)", "value": "0fb73a0844fbe8eef03f116e01e0a074", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005181, "uuid": "93bba9b9-0c5c-44ca-8d1d-2c101c17868d", "comment": "Malware payload (Mirai)", "value": "3e9ef463c07c0d907bc041c39b99f75d8d1e244a3c6d1ac110156c7da9a1338b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005181, "uuid": "31675417-5414-45cb-b10d-5bee126ea851", "comment": "Malware payload (Mirai)", "value": "7fcc4c0e1ac0d093a921271aa1a6e8471d01407b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005181, "uuid": "f485c753-0d63-4a5c-8ef5-85cd70f86cea", "comment": "Malware payload (Mirai)", "value": "b16faa58bed9a8d29564a5ad9a8a90eb351ea553bae0927f9cd30de51d266bbc3d1fe9fe4b763602d55a51ce7c51b56b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005181, "uuid": "0428e234-3c5a-455b-8a8b-65566c83937d", "value": "T17A336B36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005181, "uuid": "6e121116-d5c9-4acd-9e5e-0806dafdd501", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696005181, "uuid": "1327b6c2-1b09-489a-91e2-8e0774571089", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696005181, "uuid": "4b327914-6649-4654-8bb2-4b4340b6cdd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005181, "uuid": "294ecd85-af5b-4c91-82d8-48f73d1f7f8c", "value": "0fb73a0844fbe8eef03f116e01e0a074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1458ad-5ecb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695994072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695994072, "uuid": "282f29f3-d855-43b3-96c4-f10c954d8dd4", "comment": "Malware payload", "value": "3859e60645ad4dafcbfbe6169ae9fca3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695994072, "uuid": "f3f6918b-7cf1-43b0-99db-d0e2ef6fa84e", "comment": "Malware payload", "value": "3f5156c2c68df840dfd73392bdb419d4e0dbe8952eb89672eef25ca9a6f816ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695994072, "uuid": "585ec1d0-411b-4be9-b1b7-c1cda1c88995", "comment": "Malware payload", "value": "0cd2a9b29e8bfd5709f4f63270ac92ea38cfe139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695994072, "uuid": "7d788c6c-aabc-4b93-a48e-c5aa61ad5fd1", "comment": "Malware payload", "value": "353d88f169be405709ae226427373231ff824a85470b5845695028e136d55318ebbd53d4695d1a31f1097979c8c4e74a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695994072, "uuid": "9eb4e42f-08a6-44af-aaa2-433751a57ff9", "value": "T16434AE0252E2AC63E7674B314D2FD6E43A6FB5324F69677732145A2F18701B2C26B732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695994072, "uuid": "ba9b478d-af2c-45c8-a407-9fdcf7cb2bcc", "value": "cceb1c098bb76547116fd8d11380b21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695994072, "uuid": "de3ca9da-c4f8-4fc6-b942-f6c23bb1da3d", "value": "3072:qXj7RdOXK8IXIYUSPbYUU0+W2bCkaDus75+h5mEEtutpDz1Tvskt:KB+YXIY28KbCka1lUpDhTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695994072, "uuid": "571c0868-722c-4d09-8005-c199753064a5", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695994072, "uuid": "8ca3606a-084f-4838-8d4e-21ef16771a5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695994072, "uuid": "81893bb7-271d-49ed-9356-2a2fe0b0009e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352122cc-5f20-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696030243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030243, "uuid": "4eefc328-46fe-46b3-9be3-6af769720a17", "comment": "Malware payload (RedLineStealer)", "value": "6fe47cdf23978732c9edebe55a137fdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030243, "uuid": "dcb62645-3f7e-49d9-a3d9-5d15bf67673e", "comment": "Malware payload (RedLineStealer)", "value": "3f5cb0eeac53c01f4258f91f34a7e84e27e3d6aa9d56be8bbe781dff8aff63f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030243, "uuid": "190ce9b3-a76c-4152-8e36-13079e853ecf", "comment": "Malware payload (RedLineStealer)", "value": "2393ab0f73ee6c80d79a17675e77e11c11e12365", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030243, "uuid": "c5c1bf7f-c17f-45fe-ac1b-400ebdeb2e47", "comment": "Malware payload (RedLineStealer)", "value": "db293161c286c0b7034ebf6d48dcb84a1741b5c495548b0071dbba0b46d98d35e238d161c21da4ff221d3f2f5e660474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030243, "uuid": "e0073bdc-d6dd-48e3-81f7-070813602757", "value": "T1DA35221BA7D59432E9F817B01CF603830F36FCA08A784B2F5245999B1DB1285B876B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030243, "uuid": "ad61e237-7a22-4cdc-ad00-0f7873537efc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030243, "uuid": "8a48893f-6600-4e85-b689-93336ae2f821", "value": "24576:NyeunRKftl42pw7uuzE0jCl+jG7Hz01ef1/CwNr6yP6/:ojnof342pw79EuCUjkI1AhCwNeyP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696030243, "uuid": "f5575f1e-fd32-42a2-8835-ed7882002d4b", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696030243, "uuid": "30c3de04-4c02-45d8-95c7-cd8cfff5d6bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030243, "uuid": "3dd565b6-fc8c-4d3b-b50c-c59520ba2d61", "value": "6fe47cdf23978732c9edebe55a137fdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0edb180f-5f0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696021159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021159, "uuid": "21837800-d71b-4c46-955c-dbd0b31f0e37", "comment": "Malware payload (AgentTesla)", "value": "018ffd0a27e6516a47d04f9b3c5bdd3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021159, "uuid": "26d0e9f8-9040-4eb2-8524-123ca0a71cba", "comment": "Malware payload (AgentTesla)", "value": "40c5a3fcc214c1458b2540d2f5bea07a0cddd0995dfafff23cbdee8d6f422d2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021159, "uuid": "0969bf4f-a27d-4cb5-894d-af5824835722", "comment": "Malware payload (AgentTesla)", "value": "442bcecb8a50905472efd5b6fbe6192ab08f0c73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021159, "uuid": "4cfd6f15-1b60-4403-8a05-7c6b30ca14fe", "comment": "Malware payload (AgentTesla)", "value": "7c98ebb4b2edf12ea072c85a1f6bea9c5e69ccaa45f991aaa7bdb94b6e31a0cbc04f3122b6ad851165c8551ed65b6a70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021159, "uuid": "7f4f8633-23f1-42a0-8081-6418596effb2", "value": "T1F6F4015641919B9FD4240DBB34606F153BF37EBD282CE20DCDDA3DAB5638340A683B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021159, "uuid": "54ff955f-f70f-43b9-b8f7-d4e57f9d1e65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021159, "uuid": "14a54d48-6f72-4de8-bec3-d89352a363a0", "value": "12288:JNdL6yiRJU/WcfnOycRxozzY/UPYBd9wBy9kzFY6gnvDZo+sc+e76m8m++afQmYy:vJBFeKO9xov6sYv2ByoY6K8Jm++l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696021159, "uuid": "f19118d6-b0f7-4b81-9610-c19407dd910c", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696021159, "uuid": "d69509ee-bb77-4406-898b-c6c7f2ad01c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021159, "uuid": "3cc49e6f-9352-4d58-bdc0-64adde4066eb", "value": "swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbb5b67-5efd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696015518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015518, "uuid": "378b726f-8aef-4871-b4ca-cc7d27e5a7e0", "comment": "Malware payload (Amadey)", "value": "badb8a1fe2697679c6e714f855f7e3d2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015518, "uuid": "231f700b-e2da-4e17-ab20-86fa66ad5e71", "comment": "Malware payload (Amadey)", "value": "40e6462c4b45d7f081b00cdcd7c8106ee6fa786e4c06bcbaae181b19e20a994b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015518, "uuid": "c0e17dde-1334-4a59-bf8e-c5f5ac62fd9f", "comment": "Malware payload (Amadey)", "value": "891999759c2c5752a2def858cbca33cb13a63dd0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015518, "uuid": "6c9b7c19-d3de-40b7-a717-3316e922b631", "comment": "Malware payload (Amadey)", "value": "40b3cc4cd8fa299d29038ebcbb3633e96d0094138bb80e1891bbfb6704efe3862380e97ff9b934fb65639db8852a9849", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015518, "uuid": "341212c5-2ce1-4640-8703-d37823c49fa1", "value": "T166352322F6E48577DDB23B7219F602431F317DE0AC79972A365AA84B8CB0580697173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015518, "uuid": "ee40f51e-4cf5-4d63-86da-0c5af32f0b15", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015518, "uuid": "17e49147-6985-4aa3-abbd-344e93cd542e", "value": "24576:WyCHUD206M94Y/FY3ZQAZehWY+I+zofr:llvBSXQ1+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015518, "uuid": "6374187b-3fc7-4533-95f6-9f132e1aec9a", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015518, "uuid": "e71cb520-4bb9-4021-89dc-3b259dd34a0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015518, "uuid": "13df821a-883d-4eed-9f5d-7b0cbfef1780", "value": "badb8a1fe2697679c6e714f855f7e3d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c73b4f-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015829, "uuid": "b0ada576-770d-43fa-9cd7-8f85ec47e99d", "comment": "Malware payload (Mirai)", "value": "621a74aacd2df97e1f52efccfc00885c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015829, "uuid": "b38e64d0-551a-4345-8e23-7f376ca31725", "comment": "Malware payload (Mirai)", "value": "416da4877eefaf7c5a5ba4adcd06e3ef6c08704c255a4dc5bab6e1ca204e4b4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015829, "uuid": "c2024032-c8e4-4db0-a77d-3969eabbe3cf", "comment": "Malware payload (Mirai)", "value": "bb0c0420eb87281454aee9ff98dddb98cadfa1e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015829, "uuid": "53854da3-98e1-4f4a-8b64-e03a99dad195", "comment": "Malware payload (Mirai)", "value": "0408f1cb1bcf7f5fd7575083567ab5d146b7ac8ed9d653d2313f1de54f5c68acde38434baf9c5f94c65b4edcb7e302d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015829, "uuid": "a2496d9a-9246-4dc5-893a-34ac683b4d7f", "value": "T1CD338CB5C579EDE8D1144A78BE248E749723E000C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015829, "uuid": "b620633c-289b-4d64-afde-2362d638a2ad", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvZ:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015829, "uuid": "b1b853b3-0ee3-4660-82a9-ead3020c8e64", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015829, "uuid": "94bf181e-aaa0-4d2e-b679-c347fceb48cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015829, "uuid": "e2b37e76-03e4-412f-aad3-2393491083ce", "value": "621a74aacd2df97e1f52efccfc00885c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92502e1-5ecb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (frp)", "timestamp": 1695993957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993957, "uuid": "f54f37ba-f439-4b59-a3f5-bcac7a04fab2", "comment": "Malware payload (frp)", "value": "bfb19191dd597483389f6faf50aeaac4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993957, "uuid": "0a43828c-2dd0-4744-b09a-0b4073ac14c9", "comment": "Malware payload (frp)", "value": "41aa4aeb4102c60ed7eae5472a1c6d830a7850d9983d0a4dd36ce238bc922047", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993957, "uuid": "206b9913-34f3-472f-bb95-59fb202e7f68", "comment": "Malware payload (frp)", "value": "12e3567a591028b0e68bb0d1ca6492d63236b679", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993957, "uuid": "a9647960-17b8-4e94-ac51-aa10241b10a0", "comment": "Malware payload (frp)", "value": "d48c60afbe496a1d98e47e1974af7d5dea4b85faa6010bcb3207a2d38069d4faaaf65a44cffb97da5828350a4c4a7dfc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993957, "uuid": "02853e54-e3fc-4f48-b7c3-7b51a7ca75b5", "value": "T11816187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993957, "uuid": "64dd3dbe-5429-48c2-ab2f-2cd63753bece", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993957, "uuid": "c4ca268f-7042-4922-963f-44f0648b765f", "value": "49152:Lgh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWqjXNO:Pa71fGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695993957, "uuid": "8994e785-2a9a-4f1e-928d-e5e6e4a7493f", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695993957, "uuid": "2bde37a7-e1e8-4379-8cd5-58d315debd49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993957, "uuid": "6c81fcac-286d-43db-9273-9012f86071e7", "value": "bfb19191dd597483389f6faf50aeaac4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24902b6-5ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adwind)", "timestamp": 1695988442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988442, "uuid": "0c2555f6-31bc-4076-8711-88fe2a398cb1", "comment": "Malware payload (Adwind)", "value": "69af19645c425d8869a0e36eba374b55", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988442, "uuid": "d1920b0d-2a7f-4d66-9924-9fdf68e5f41c", "comment": "Malware payload (Adwind)", "value": "41cccd7bb27dd8c9e9c738737172211b2170988fd9de1dbe368de8079efbd289", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988442, "uuid": "f650048b-1ec5-4230-9d84-751583d666fc", "comment": "Malware payload (Adwind)", "value": "828c57ea900acb3a6cd259ada53be1c9b9deaab5", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988442, "uuid": "64c9e0d2-d880-4fe8-a63c-0bdef86208d8", "comment": "Malware payload (Adwind)", "value": "606400d32b4c51a4bf8578e7647bb527afc0824a3e76de972f96adb50a9dedcd50292461ebe69cb7294543ab13c7bbe8", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988442, "uuid": "f7e61459-0794-4531-8d40-25bd42e4fcb9", "value": "T14E04122B63D6EBBBF4F0D1B6DD6381B47F8098B2C52E29BE0673621175879590839207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988442, "uuid": "f9558dc3-b1f0-4197-89c3-a115da734260", "value": "3072:Ff/+UK6CXh23+QskcT1/O8aDB8CB0wzkKswCVUC3VGQk5bSPnmFBMUlPxz:xK6CXhoskcT1C6pwVswBC3oQwSPmPxJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695988442, "uuid": "98c1f99f-ba7f-42ba-bb4c-5b394ba772c0", "value": 175419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695988442, "uuid": "33bb155c-63c7-45de-b4c4-0a8eecc5a133", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988442, "uuid": "99cc6223-3581-49d2-8bbd-c73894a24441", "value": "28.09.2023.siparis_listesi.docx.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1601e17-5f13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1696024841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024841, "uuid": "734cf6c4-6341-4688-9437-9e565a0b1089", "comment": "Malware payload (RiseProStealer)", "value": "228e4f435e98f3ce574544461145bf64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024841, "uuid": "b31fd711-ef03-47ec-a47d-2653a624b204", "comment": "Malware payload (RiseProStealer)", "value": "41f21bb6755547afa75c267056810f788d623e821cac3f35cc3f229f70846191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024841, "uuid": "5a86d682-46d6-472d-b78c-e3a4945ef83c", "comment": "Malware payload (RiseProStealer)", "value": "e7a9958c172c863d40fa3d7e7c689a329989899a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024841, "uuid": "ac4f8167-9fff-4a7b-8395-f0930ed459fe", "comment": "Malware payload (RiseProStealer)", "value": "2c9c7b209bb004c6e2a71819bd7bd7f4172755f30c4949d3babc90e2dfbb99a77d5b1a5a98509fc3d7359ebf0357d2cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024841, "uuid": "ea45229e-55d8-41cd-b5bc-7c8982b1ec00", "value": "T1BD34AF11BDE1C072DC7295360AE4DBB9DA3D783009A15AAF67E40F7E4F30281D62DA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024841, "uuid": "f5a7d3e3-4de6-48c3-be20-23f21a6429d2", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024841, "uuid": "d68e1e1d-5a33-4de2-aad1-c91fcf441c95", "value": "6144:Ufz4SHy5uoBMFGV5PEkIXEHvZAO4QYp1+KiVs0BC+:xCmuoBMUOMxmQ01+Kas0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024841, "uuid": "452121eb-a3db-416b-8a9a-cf90e73e4f64", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024841, "uuid": "fec42d33-b1ce-4e75-8850-7c0d36f58ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024841, "uuid": "4bd96b36-8fe8-484f-88aa-f8be81b3574f", "value": "41f21bb6755547afa75c267056810f788d623e821cac3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6955caa-5e96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695971189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971189, "uuid": "75b1e28c-26c6-4112-b203-56c44c748645", "comment": "Malware payload (Formbook)", "value": "43360a45e1cc375a3713b1e6da03d3b9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971189, "uuid": "e2df9efb-f0a4-4d07-ab03-3b50aee26367", "comment": "Malware payload (Formbook)", "value": "426980b07d9a0a12c01090402c67576b346cf4905694afe983c9b370b1290e84", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971189, "uuid": "9aa43e04-cd5b-434e-b446-69fbec37088b", "comment": "Malware payload (Formbook)", "value": "00334098da3bd43bf2dd23d03e6b3837e744d934", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971189, "uuid": "423555e9-e892-45c5-853b-81c46c642f70", "comment": "Malware payload (Formbook)", "value": "c583f21200c3e9e82d9c91550007013551e8bcf9a199e2826f97317095a8e521363d45f24cbb9b2d8c0268cab4bc1f4f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971189, "uuid": "9f81b979-6512-4d92-9773-8eb98bf3081d", "value": "T155A4235A87BBEF2F9F6E19CC0FDB07A560D35549B190901C9147EE2A632612FC7821E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971189, "uuid": "f7e94d51-00bd-48d1-8c60-32b4743b10b6", "value": "12288:XP8K4PXw5+GjpibjYMTolhjQSH3cyeBkNfPF2zEp5f:XP8y+G0j7TajtMyeBkh92zErf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695971189, "uuid": "71ad542d-20fe-4d2d-a865-80de958ace0d", "value": 449841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695971189, "uuid": "14320314-97e5-499c-8830-8738ceb4d13f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971189, "uuid": "37527667-6d6e-4ed1-bd3c-d480d88f94f9", "value": "doc#230928330.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a7648b-5f03-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696017919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017919, "uuid": "ead80e0a-6706-452d-910d-a605ae85524c", "comment": "Malware payload (RedLineStealer)", "value": "da56b4443c27cbd9e3e1ba19b4a2e8eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017919, "uuid": "065270f1-1c12-4e7d-ac6f-67e7cbe6dd8e", "comment": "Malware payload (RedLineStealer)", "value": "42b60a994ed52d36d56ac579bcab08db2041892b5c6f2ac29f4f9f1adf084382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017919, "uuid": "ea012ce1-8cc4-4a3b-ad72-4e0cbe2b46dc", "comment": "Malware payload (RedLineStealer)", "value": "a4637e9e1953d0b11fd48f3a6a7dcc26f5dbe3c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017919, "uuid": "36334d10-d643-4544-9589-d0ddfb717345", "comment": "Malware payload (RedLineStealer)", "value": "06ef2efb57046bb1762f04340c4edf6487d97d2119c4a5d53ee29a21c9d56c7e8dd847a8663d85b3318d0baa1bb6ad8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017919, "uuid": "db42d3fe-d6a9-47a0-bbb9-9b9e51f2d8da", "value": "T1A735234297FD9037DFB517B59DFA03730A397DF1AA708B672601D8584CA7A90A03272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017919, "uuid": "2fea7421-ed66-4607-bd53-8d0c40d90b3e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017919, "uuid": "341a7330-5d6e-40f9-b41d-0d54a334e0fe", "value": "24576:9ynY+7MhwEa7VMX7N9asGuGnOhROYcFVLc2l:YYmESmnROYcVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696017919, "uuid": "61e9e70d-ab0e-4098-9132-0c859f7721f3", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696017919, "uuid": "ccf10dd4-358d-4e86-900f-5c86675accac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017919, "uuid": "db63abaf-6426-4629-a080-9a46c610ed9d", "value": "da56b4443c27cbd9e3e1ba19b4a2e8eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93561abe-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695986592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986592, "uuid": "f7262177-8724-4899-a417-7524effada4d", "comment": "Malware payload", "value": "91a1baf49ff333b4bf26a160be2aefe7", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986592, "uuid": "f3c80846-b652-4b2d-a4d1-8a8d54ae31ec", "comment": "Malware payload", "value": "42ffd6fe0c78d3fc0723196da87ea5e0b1e32b1f2141eaba58c6fa772d706750", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986592, "uuid": "7a40917e-d5c1-4c69-97b8-7b0b34e87eca", "comment": "Malware payload", "value": "7b12c0943a0f7a9e32155b4c4a92ce81d698e53a", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986592, "uuid": "b22e6b75-bc4b-4404-b23f-20140bbe6f56", "comment": "Malware payload", "value": "f0a94f7a94a282d3cc96233a11d0f8d4499147e06bc91566bc7d7d843bc3cc84dbe90ff0158b934255ed08aba6c3f755", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986592, "uuid": "f61b7319-405f-41bb-9842-514bcde11d23", "value": "T1C3D423EE2CC2E9C5E5CADCA73C32B8BC2B10FBAF1059F45C34676E6617512426BC1625", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986592, "uuid": "c186e03f-3ab8-481e-acca-24b567beb044", "value": "12288:WtK3E8PWKofUzCnJqdY+kPiBykptUVed8xdG/uvJPQSJFQNbD2:H34KqwW+kKPptzmx5vJYoQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986592, "uuid": "51c66607-bbca-418e-aeeb-15fbbf2e0a65", "value": 650733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986592, "uuid": "5ced1300-b661-4150-9534-65987f17f6b1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986592, "uuid": "b628f73b-20d7-4cc9-a173-1c58db3b2fa1", "value": "RFQ 27-09-2023.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0458bfa-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986614, "uuid": "4aec6466-7666-475a-af51-79a9a68146e2", "comment": "Malware payload (Mirai)", "value": "6110bde3d72d49e4a9fa415bcde76d62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986614, "uuid": "39c534b7-332f-4960-b927-aaaccc6ddc8f", "comment": "Malware payload (Mirai)", "value": "4337f9292abfd093a26a800c0b852f79e1b761d823f0520a974919aafcc7550e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986614, "uuid": "7d49fe42-ec8c-4dc8-adbc-0f7443e30217", "comment": "Malware payload (Mirai)", "value": "62358f5503bfedfb4752b8eb666c333de94c258b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986614, "uuid": "0d547bfc-f0ad-423e-a728-a1fd8e78da19", "comment": "Malware payload (Mirai)", "value": "a6fc19f9eccc61f74b623c67cfa6387f12ae98c27a6f715f403e1280b33400381c03993ee23cd4ef2667f3ab574a430c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986614, "uuid": "3ce2b656-4249-449f-857c-2e5f67a4e6ff", "value": "T1FF631A49B9D19A12C6C1517BFF0E038D772B139CD2EE7303D9159B6237CB5AB0E2A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986614, "uuid": "8a88106e-3d97-4a88-9e03-94bb425e81dc", "value": "1536:60XGdxOo949y66y2lgL7yEOK167ME72Nqv2dWCwY:fXGqoSy6zMgaEOo6r3ITwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986614, "uuid": "8a99f8f1-b1ff-4636-9f7a-14f2f550af85", "value": 66856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986614, "uuid": "633ba3a0-3070-4b2c-a4b9-07e7e4b7743e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986614, "uuid": "bf3bf6a1-8c9f-4f30-8cdd-74ea6345842e", "value": "6110bde3d72d49e4a9fa415bcde76d62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8db8f41-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987487, "uuid": "2360fbea-581b-455f-b2de-5a38421d6be0", "comment": "Malware payload (Mirai)", "value": "ac3cfbbf06e4ffab71ed9aaa186e4b2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987487, "uuid": "0daf1424-bbdb-4f33-8307-8cb8db9df34b", "comment": "Malware payload (Mirai)", "value": "434796c435671353e68190d4a2ff944102829a3988f8905ec928c6d6409ad13a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987487, "uuid": "de72c497-544e-4a4e-886e-5153045e442f", "comment": "Malware payload (Mirai)", "value": "ad1048e45af05b327e2a928272ab098c195a5e5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987487, "uuid": "ad6c5d69-1304-4702-8d62-927fa819773e", "comment": "Malware payload (Mirai)", "value": "1c4521d29c3e24caba04ec6eee92975749fb73b27c91f62d2cbb42984c51fd25d7fe8321f46313200a28f67cf2c67f06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987487, "uuid": "d74958af-84fb-47cd-b72e-53ce98515ad4", "value": "T155C2E193A0B9CD05C472423B6E1F159B21282529134DFE1E373AEFDC62464F4917ADC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987487, "uuid": "df6a7608-2a5f-4af1-ab1c-b924b88bb4ff", "value": "384:MRSx9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5dwapDyCTYHHJC8oytPFnAqV/LlFv:t5+Kcrb9VDJe5FLTYTlPFnz/rgEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987487, "uuid": "af9f2569-fe00-4bbc-9a5e-07f701e0a070", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987487, "uuid": "e8731d26-d514-464f-a623-02670bf61574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987487, "uuid": "aa5a2a39-2082-49c3-8b66-9cb127274914", "value": "ac3cfbbf06e4ffab71ed9aaa186e4b2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a593c48-5f10-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696023433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023433, "uuid": "272db33a-1338-4e09-ab5b-26b24a75879c", "comment": "Malware payload", "value": "58d5ac00182428d45734ac75d9a54419", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023433, "uuid": "0ce03ef8-0748-45e8-980e-93c78db507ef", "comment": "Malware payload", "value": "437b5b5a29a74a2400616e2e8edfcb6a0f31261ec9e7fb5c1fda5f71d388799b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023433, "uuid": "57d596e3-b686-43d9-9f70-fc0aad6f8578", "comment": "Malware payload", "value": "24c4954a50ad561a5cc96550c225c0f9d042b501", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023433, "uuid": "dfc2f4b9-adb9-476a-a807-488b4630bca6", "comment": "Malware payload", "value": "484496af6aaf72746991b9f30f9f1a1007c611ed86c0da5d3c48e89d3f1223786e93117e0b04c98f8e8919b6767a205b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023433, "uuid": "eb821209-fbf9-405e-ab2b-b803af909c1c", "value": "T1EFF4330DD57E01CAC7CCBC7DC22E5E8AA78AA5E3A4E5846B5E8BFDF846F90558C014C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023433, "uuid": "5e4677e9-d3e8-449e-b643-f84fe10cfdbc", "value": "12288:nyZmG2AbYbHEhF/8Cw0oJUBlbICOeTySbA2Mu6SkqSmFkKFGXHX1eu:k2rsNw0h5xO85AjD5qSYkK8Hz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696023433, "uuid": "8477c760-b9e3-4b21-b264-919c103ed8da", "value": 733248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696023433, "uuid": "4f57c5b4-b1e7-40ae-bb60-533c399aa67e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023433, "uuid": "66821883-cb1a-44c6-abc2-293266ffe851", "value": "@08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b7d3f0-5ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1695988334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988334, "uuid": "500f1512-b73a-4656-a826-2abadaef6e28", "comment": "Malware payload (Stealc)", "value": "fb811d00b4e801dade0a6070147a0899", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988334, "uuid": "20eb63cd-594c-47ef-887e-2cd9f8fe8521", "comment": "Malware payload (Stealc)", "value": "43844da8f4da61f7fe42fa03ed3ff4a7db86300d228d02ba6ede9c6ec34a1f1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988334, "uuid": "d9fd5307-9405-452d-afff-16ff8dcc0101", "comment": "Malware payload (Stealc)", "value": "e5b01bafc932c3139263bd772c5f146d0348e3bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988334, "uuid": "97c4512e-16c9-43a0-8e61-9f22603666ba", "comment": "Malware payload (Stealc)", "value": "afa124b8db27f34514e8222ed3cd8d9b5d1fa73dbcdd17e496652366833bceaad7600998a1cca883087f6f8ccb52023a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988334, "uuid": "fd1efe64-5a65-4338-9c3b-60331b9186f3", "value": "T1BE34AE0252E2BC60E96346739D2EC6E47E3FB5714E69676B32145FAF0B321B1C663702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988334, "uuid": "2a501cb0-a79f-4afc-b6db-3b43313d4dcc", "value": "da3059b9961b3b780343599f0bc04a8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988334, "uuid": "02f1874d-e86a-4038-89ec-4089f39c3a5f", "value": "3072:mXj3bHCzQdd0bCSDiVT0WuaiBT60P/t5Us1rW4635mWcPylpDz1TKskts:O3/d0+SGKciY0X7UgRlWcPspDhTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695988334, "uuid": "bdb067e0-7bc2-41ae-96b5-54517d5df23f", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695988334, "uuid": "67f5cc8a-fe16-441d-b91f-a0b77338baa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988334, "uuid": "952af554-8928-430d-b337-eb3633ad1706", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a96e8a8-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695986980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986980, "uuid": "bb87d0b6-3d9a-4da3-a5c8-69694da20652", "comment": "Malware payload (RedLineStealer)", "value": "4a15326415a91eab5b1d920340c890fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986980, "uuid": "dc0b83ea-22fa-4b5e-a757-0884b24d009e", "comment": "Malware payload (RedLineStealer)", "value": "4395f20cb7181a9117515dc843698ae57e92f010068c3f7561f754b5c617bc1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986980, "uuid": "ca4f01ce-90fd-49a6-846d-e320a3a56b4b", "comment": "Malware payload (RedLineStealer)", "value": "0c095724d8bfd5638967466ded4eb647bd2165d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986980, "uuid": "69de9119-8df7-478b-97a5-fc30c7e32400", "comment": "Malware payload (RedLineStealer)", "value": "609626ab3562dbca1e141a7df96442ef9a59a48e45714ce3dbef945ef7d3bf6af1806b1ae4c3a18ea826eb76ffda5109", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986980, "uuid": "82463240-4dd6-41a8-9765-537c70a640ec", "value": "T177152342D7FA9422ECF9677418F902E30B3A3DE4AE74C3573781AC5E19B1590A871B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986980, "uuid": "46a3f951-c26b-4d55-9b95-1439777027c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986980, "uuid": "1299e46e-3c8f-46ad-a216-904122b0b037", "value": "24576:kybdJJ8UeFJFdrpDGhKTZc0abSQus/sH:zE1pigTZcrPus/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986980, "uuid": "7326971f-eb90-48dc-9fd6-f4e6cf5cb8d3", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986980, "uuid": "7f26ba3b-f322-4ad1-8f61-176d0d819536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986980, "uuid": "3fcc1e1a-360e-4f34-9a35-de5c095dbaa3", "value": "4a15326415a91eab5b1d920340c890fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4774aa3-5ee1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696003398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696003398, "uuid": "b2661886-5b67-41c0-999a-e125d7b60a4f", "comment": "Malware payload (RedLineStealer)", "value": "275de4a83bb189b2d20569ea0cf6272d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696003398, "uuid": "d022bea0-b512-4aae-8306-eea2c20a3276", "comment": "Malware payload (RedLineStealer)", "value": "44062cdb9843749590a84a65764e5429c0e0dbc68e50d63254354dd84bb81637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696003398, "uuid": "18af79ca-02c3-4fd3-9df3-1220e78e1e7d", "comment": "Malware payload (RedLineStealer)", "value": "d406843e74ff065e8a35a5498ff02e5030ce22be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696003398, "uuid": "ec30ea15-d141-4cb1-b753-2005984b9989", "comment": "Malware payload (RedLineStealer)", "value": "f86974540a81792a0da7dc61d9612e081755a70d34126cdda593f9e1e328fe40295db8fb8fd577f48a0d567782193dc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696003398, "uuid": "c20efb1c-6cdd-4982-a1de-544d9536df5d", "value": "T19D34AE0B22E1AC61E66746718D2DC7E43A7FB7618F796F6733185A2F08702A1D263F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696003398, "uuid": "3dd292e2-c766-4d0a-80ca-7f6fc406b411", "value": "04b413a231387eb973c8024c0a5e8f4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696003398, "uuid": "7f24dfd6-8b98-454b-9e25-d6e9cb19f952", "value": "6144:SEs84um7uoC1sLatLoxq95E2kUfNmq9YT:SEF4umw11tLHtkS19I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696003398, "uuid": "a53b6953-e1cd-4a91-8e47-6a6045339532", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696003398, "uuid": "3baf35ad-c043-4824-b5bc-293070a7e71c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696003398, "uuid": "d1b9d639-9b70-4486-8720-0664042c39b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7942163-5ec5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991458, "uuid": "a3bdaea6-035f-4dbe-afed-889116c6ffa5", "comment": "Malware payload (Mirai)", "value": "68428c0b01dd55d1f8c1be82de2563fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991458, "uuid": "69b4bd67-d647-49ea-be14-e85c4f416941", "comment": "Malware payload (Mirai)", "value": "4464fc3c575562f5991f9be76098c285fd92cf1e9a56deb0d7570e72362898a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991458, "uuid": "10ae9401-330c-41ce-b986-dee6d5b37e9b", "comment": "Malware payload (Mirai)", "value": "8ac411d10d91ef6aa2cbce77b200c8e6599b6545", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991458, "uuid": "2fe2e0e5-f54a-4a6e-9d8c-09a833f192ae", "comment": "Malware payload (Mirai)", "value": "019296ca59f5e2451331618d7c6d69c92756dc09f848cfa50b172a58e0d91376bfb999ac4719f60c0038318f09ce33d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991458, "uuid": "cfcf460c-bb20-4ebf-8516-243e333052b1", "value": "T14B231942721C0A47D1A65EF0393F0BE093FFE99010F4F5896A4F9A568636F321586F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991458, "uuid": "e6d49d02-0b2b-4bba-87c5-bc03cb9c9b28", "value": "768:y8yWQvT+P1vNc2ZSRakEbf1ir7DrqCaRa9RiV+KfL+XA5yA/:UWuCP1vCkSwi/vDaU7peaX8Z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991458, "uuid": "6ae93bc3-1f3b-41e0-9449-a6b4908b7bde", "value": 45988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991458, "uuid": "0f82dec5-8c1e-42dc-903e-c47852b8cb8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991458, "uuid": "ef55aaeb-a9ee-4389-b723-efc6cde335c6", "value": "68428c0b01dd55d1f8c1be82de2563fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1e170f-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986954, "uuid": "4357dff1-69a8-40aa-9974-10b81aaa764d", "comment": "Malware payload (Mirai)", "value": "8d035da25ae64c14ebe7f952b0b706de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986954, "uuid": "7388a0f3-f119-4268-b4d4-d9b0e12c7dc3", "comment": "Malware payload (Mirai)", "value": "447be344f092eb54e35a5b7760dc2f5c977cb363dd372cba8d865d9935b9a6f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986954, "uuid": "ab309326-b750-4dee-8d6f-546b7b92d25f", "comment": "Malware payload (Mirai)", "value": "36224c52395bc8fffc49ed255b7a7e7a5d3e45c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986954, "uuid": "007cf0c7-1632-402a-aba3-ce40a44c6017", "comment": "Malware payload (Mirai)", "value": "23ad2e27f829bd1aebb053bf222589ba1f5ac8a88b10fb8a1c491b2ecc51abcf3edc4e2af5cac2e6395c6089fd2acb49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986954, "uuid": "da9c69b3-6bad-48a7-a802-fe9d4aa6ec3d", "value": "T195D2E18976D393F6CCC98A7EB31E0039309E74A9B7B19363B305D8530775181E651E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986954, "uuid": "b6cdb628-de5f-4f2f-b77f-401e642beacc", "value": "384:Mxd/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BK5TUQKTxNV:WlxKd29WcxEns+V6IHE4RlY990gTSTCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986954, "uuid": "4f868a31-b8a8-4de5-9b9a-685363889c52", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986954, "uuid": "ed73871a-2422-4c9a-8e00-92c9683cb147", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986954, "uuid": "41128159-ba4c-45bf-8cc4-f643a82ce9a4", "value": "8d035da25ae64c14ebe7f952b0b706de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640a210b-5f1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696029033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029033, "uuid": "d1053587-c6c4-472c-aa39-81a2548ce6c2", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "adaf9acb38d7f8d43d5ddcb02f3b9a60", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029033, "uuid": "83ffdee1-f0f3-4bd2-8dd7-6d694fb72413", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "4481569bb063b5a3bba51ba0300af2cbd69816b50b464cd7c90a883320b02edc", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029033, "uuid": "4532cb7f-70eb-4c4a-9f4a-13a673fbb150", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "75633b157c88b2cc2409c3504fdb37e1452293d7", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029033, "uuid": "71c12967-fd79-408b-bd8d-9f4d28c8c463", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d7d2b61afc88fbc931b083c4d0a36627c7950c5c67917f211dbed9be4f228de9db0bd25191a2211d5c27457092291d67", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029033, "uuid": "19c04831-9ce9-4816-8a8b-e697e09c31ff", "value": "T16644AE01B4D18472D47211320BF4EBF69A3EB9314B659AEF67940E3E8F707C1973266A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029033, "uuid": "2cddedc8-434a-459f-b59e-f2fc9a08c285", "value": "8ddc982ec86bc15061e6b2eab1424dec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029033, "uuid": "f94a9d7e-5996-4de2-b510-b20901c64ea3", "value": "6144:pR1hrJ+j+5j68KsT6h/OCy5U9uAOcAskW9VJSrcqw6:pRrN+j+5+RsqGGuvskW9cw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696029033, "uuid": "c626a5e4-a907-444f-b833-baa37860430c", "value": 277368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696029033, "uuid": "33410167-7740-463b-971e-ea78a3eeeb8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029033, "uuid": "386e3a0a-e78a-46b9-878d-d82b82bc9405", "value": "adaf9acb38d7f8d43d5ddcb02f3b9a60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8313d28e-5f0a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696020924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696020924, "uuid": "a249256e-f731-4e09-9cf4-fbc1531fdcd1", "comment": "Malware payload (Amadey)", "value": "8eaf57d1a220c028a4cad696bd9715bc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696020924, "uuid": "d0cc055c-3503-4326-9683-0761fdbccdd6", "comment": "Malware payload (Amadey)", "value": "45ede1ad7d5fa517ca0f5b0234466a6aed3488d6ed6e4d452e8dbba5fe99da3f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696020924, "uuid": "21174376-ca92-48e9-85ef-e0398c190ee8", "comment": "Malware payload (Amadey)", "value": "34818d7102377c1549cbd4381e94f68a45aa59c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696020924, "uuid": "5a55cab1-d449-4b9f-8630-1116571726e4", "comment": "Malware payload (Amadey)", "value": "ca17e34adca1f0e9e6dbb762d3998eb2868b1a8c2c3d072da950371075a2fa2196e89b6b6fd593a7eb341c5d955769f5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696020924, "uuid": "135d2ebe-28b9-4a50-8b19-8c07ae613fbd", "value": "T1CC352266BBD8C523D8B85B3064FB13831F357DE69E744625239E954E4CB3A80693233E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696020924, "uuid": "9b593c77-cf4d-4812-9497-725c1cc294be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696020924, "uuid": "fccd2338-3937-4d3a-abba-c35b4ff106ef", "value": "24576:ryPVTH+7s4HTL/9EC6/NqBUoGhpA8DxH2VB4HOZ3tVpOOzkwPYV9VR3A:e9KNHThEC6/NIGHV64idVppwiYlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696020924, "uuid": "d281bd25-db5a-4e9b-987d-fb3f7257f55f", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696020924, "uuid": "7b6a25a4-97b4-4bbe-9500-036a056d487f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696020924, "uuid": "9be403f8-1ab6-479d-af5b-febbe2705ce0", "value": "8eaf57d1a220c028a4cad696bd9715bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b631d81e-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1695986650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986650, "uuid": "29124102-4871-4f19-81a7-41a1b16e6742", "comment": "Malware payload (STRRAT)", "value": "fdddbdbcf75e4aa177d7802aefb414ee", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986650, "uuid": "2e6218ff-caae-4790-907c-33fe656ee050", "comment": "Malware payload (STRRAT)", "value": "47279e112e960198ea5f57117437b46a83902d9f88d5a4a8bb075beb6df26de6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986650, "uuid": "1234b85b-7b2f-4154-a79a-2b54c44065b7", "comment": "Malware payload (STRRAT)", "value": "d712d52203af35aecc8894a56b1192edd61cdbcd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986650, "uuid": "110460a9-59be-426a-b071-2b759c490dea", "comment": "Malware payload (STRRAT)", "value": "f034ae907a4056721b56fb0e2ea301cea18c4361bedd278c6db0ef39f37d19a9478220ca5a76448ba8d1ab2fb5c9b336", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986650, "uuid": "9d717b35-a445-4bc8-9881-bffdddff4f67", "value": "T102D423462DB824FCEB1B18B6F5C13907C4F62EB5734C5C2D89EC7DA382548E1AE816B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986650, "uuid": "818387c2-2dff-4dbb-8beb-cb136b9778e8", "value": "12288:FaW8OtNb/9FiTVcJsjbdjqjOJUn/7Cy0O/16px2a0T:FPzLaB8NOJ2Cvx0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986650, "uuid": "5501ea10-9e26-41cf-ac7e-c190ea7a3243", "value": 610053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986650, "uuid": "277e292d-d682-4883-88dd-899299b68881", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986650, "uuid": "d43bbb62-a8e7-43b0-9551-0929c61a8160", "value": "Open Invoice.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6263ba3c-5e9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695974054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974054, "uuid": "79aea869-fa4c-4bf4-935d-763ba6ccbf67", "comment": "Malware payload (RedLineStealer)", "value": "e715cd5af9cd0ce2c09b84f1012e05e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974054, "uuid": "67af1d1b-379e-431c-a865-7f5d0d50e99b", "comment": "Malware payload (RedLineStealer)", "value": "4795291e454bbbbc7d6f06c86e0ff513a0031c648b11c07a9400e532a422e1a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974054, "uuid": "80c37716-489e-4727-a206-bf5dfbab02f9", "comment": "Malware payload (RedLineStealer)", "value": "f017304a5fcfed9a564e78fd7f3c06d620830e09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974054, "uuid": "bd2d30bb-3877-40f5-b6e1-25f120ace8b0", "comment": "Malware payload (RedLineStealer)", "value": "33811fe9d86f6746b049bbe92100048ec05d6f6a9de552658d1f853c448213ede44c08a932eea86a97274a041e71a982", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974054, "uuid": "1c44cc90-d9b4-4ba7-a6c0-7dda96537a76", "value": "T11094E10391D1BC70E1764B719E2EDBE03A7FB5714E652A7B33181A6F08B02A1D663739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974054, "uuid": "9baf7270-18b0-45d6-a744-bc26a37917d5", "value": "bb3e0265f6d3c51a35d3f2ea7c8ca6ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974054, "uuid": "6688c617-533f-4958-aad0-2b2154ea3ee7", "value": "6144:sXCVr7UbFqIAeL2dsyJoRk2xcZT1YdtiAgc+rFpDhTx:sXmrAbF97645xQJrnDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695974054, "uuid": "d4ca1cf9-50f9-4b03-85ec-5cbddc7fc362", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695974054, "uuid": "84ee2548-70e3-40e7-9082-5689662907ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974054, "uuid": "d3dec6c4-34d3-4131-b70a-ba2fb8f0b77b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbdfee38-5ea6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695978097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978097, "uuid": "6a15effe-4d9a-4096-8794-41684504841a", "comment": "Malware payload (AgentTesla)", "value": "fbe862d68cc52922c978169e50cbacaa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978097, "uuid": "9bf6a276-f703-45f2-8d0c-62d3cc3883dc", "comment": "Malware payload (AgentTesla)", "value": "47dfb65b3426e320eb7e9ba01ab8fe1e12bc00ffc217f148676638823978c350", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978097, "uuid": "27acee9b-1aad-4c74-b16e-776d2c82ddd1", "comment": "Malware payload (AgentTesla)", "value": "0af017a37033903380ff0ab7484126e4d19383bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978097, "uuid": "fc373811-cd7d-4376-9ea6-6701e209f0dd", "comment": "Malware payload (AgentTesla)", "value": "6446b6572e81661bd16361d22251e31b3a5f288d066eebdb5952ddd1981f5156004f2f28e651accfe274863faf33d37c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978097, "uuid": "aa4cfe77-71ba-4c0a-a559-3240933cb32d", "value": "T152C4139876D28329DD8C93791AAD25354370BA58B801E37D8ECB35AF2D3131C1D66F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978097, "uuid": "67735c2c-5e03-4001-a862-f292577667e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978097, "uuid": "f9eb769a-7dc3-4057-af31-1bd7343ba92b", "value": "12288:nQ725+mcHJURrh17yAvFYaJCoLEWnTskwjBrAlBB6XPHCD1XlT52kR:LQmcCyAvJJCoQkwjKifCD1X5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978097, "uuid": "a5562e03-62ce-4014-b371-f0339f26b90c", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978097, "uuid": "7e63a5d8-57d8-4600-b17a-dfb1c9922ee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978097, "uuid": "d8bda6d6-7ee6-431f-af4a-34a3c3e02a0f", "value": "PO Samples00956.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f03199d-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695977055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977055, "uuid": "53e106f0-175a-49a9-9bfa-83c62e0adebb", "comment": "Malware payload", "value": "9a01552b844e6bb4cfa7ebff674c6b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977055, "uuid": "f26b4fb0-3fb2-4f21-8a0c-d9faf067d24c", "comment": "Malware payload", "value": "482e01379bf2a1b740a615f0784ad0c6099614b3abb221a74009656b5ea04865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977055, "uuid": "f1ad64b8-8b9a-4463-89da-f2973ee820bf", "comment": "Malware payload", "value": "914112d355951bc80cac2f026fcc27f9dee2771c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977055, "uuid": "d6e538b3-8bb0-4a53-8aba-ed40c340c7b4", "comment": "Malware payload", "value": "a3075933fe27467f210e6b8b73e396d1428e39868ac902f0f02e30b35c20495400be162c278f8dbfaae393c8230c918f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977055, "uuid": "7dbad6b2-6839-49b5-95ef-1f8a23a4b61e", "value": "T116B502D3C827E01C08664B359F0C9D147428856CE8FC97466B6D9BB1E738FE2467AB87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977055, "uuid": "23d799f5-f138-44af-800e-2590a03df876", "value": "49152:BC59YOPSwdwKRakSJV2ftJD5Y7Y2CFjmpBURy+Kc69bfRjWS1PCw:BqbZdlRakLa7Czy+JG87w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977055, "uuid": "5d1e8985-9438-4e63-a7ab-62b07dcf01fb", "value": 2375383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977055, "uuid": "b5a05a89-40dd-469e-b096-a43449a35da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977055, "uuid": "8c971aac-f57f-43fc-b2a0-be1cd3d9381a", "value": "9a01552b844e6bb4cfa7ebff674c6b10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0ffb38-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024406, "uuid": "1f82cb09-2927-497b-9834-b3fcbe0a165e", "comment": "Malware payload", "value": "f498e929ee8557f5e8d17aa48613d8bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024406, "uuid": "6f196a0f-4aa3-40d8-8686-74a514d3a039", "comment": "Malware payload", "value": "490fbba6b24900a648091b91f605241bae641341838ad53b51f86a0aa3d87455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024406, "uuid": "35c5c16c-58eb-4ca6-999e-2b3f9756620f", "comment": "Malware payload", "value": "5d0e10b8824cd5cf019d7bd519f546bd69f4db51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024406, "uuid": "bb52f807-8ad1-4c43-8865-c6ca1c17dccd", "comment": "Malware payload", "value": "170d19b02930509942bcdf762f66e4412734d250bbb5334958e7e12677ce78cf1146e44808cc75295a7eca732ddf6a12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024406, "uuid": "b526f258-3ba7-41c3-b68e-1c940d736c85", "value": "T1D3341242C67D9332B93D1628C8A6F96168A7B118CD9D0D50F09E796D023F6C2C797F8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024406, "uuid": "518913e8-dc09-4a80-8381-92c429817378", "value": "6144:8jEFMp1dGPGVzZpwfUvHjSxUNFSv473gH4oU4FjxhlBcHhDlb:+xp1dGPk46HGxUN9oU4FjxhP8xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024406, "uuid": "7151cd4c-1ba7-4190-89c7-effc5f305259", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024406, "uuid": "610d20ca-a9d7-43e4-ae1b-4c639364fd96", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024406, "uuid": "b557019a-ca1e-49be-b2fd-dff05ce07585", "value": "288333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78651138-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987406, "uuid": "f40ddc3a-da16-4b23-b196-aa767b645af1", "comment": "Malware payload (Mirai)", "value": "a21d4a45817f07d5451adc143a455878", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987406, "uuid": "cd629745-3f86-4eb3-8a50-4046d40fc5bb", "comment": "Malware payload (Mirai)", "value": "49a905fa6fb4fae4723c95e1d4977de02d3f9e14ecec5955f7a4f1cefed88e4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987406, "uuid": "a33dab69-5634-4eb3-bf11-7ab034d7f1c5", "comment": "Malware payload (Mirai)", "value": "af469b3ea19c74cb19f5655ac22ef6054fe3e3a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987406, "uuid": "f5443903-e958-40dc-8213-a52e1d51ea53", "comment": "Malware payload (Mirai)", "value": "abe89c3358a994d8f76639b491757d2c707a037568a8b42da9c8c2d2a0c001b9f3723630358f509f43782151488468b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987406, "uuid": "5f0747b9-b68a-4810-8fef-335c23bd245b", "value": "T1BAB2C01AC0AE2E74FEEBBD355945E2817B615A9F3E61CDC016C15B110622E2C1F9CAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987406, "uuid": "e70c8b6e-0ed4-481f-a495-aed38632c306", "value": "384:EA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoMymfM4uVcqgw05V1:KApCdvwJr69VJoA8FZtxCo8h04uVcqgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987406, "uuid": "5ad2f664-e27f-4f35-bcec-b0ba222ecae2", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987406, "uuid": "132a3b86-8434-451a-baa1-ce76f544c168", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987406, "uuid": "02d1c1de-bdc1-4332-af85-89dff6817b70", "value": "a21d4a45817f07d5451adc143a455878", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d964b20b-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024505, "uuid": "356a24ff-18ba-43ec-8ec9-baaf963edd5d", "comment": "Malware payload", "value": "5dfc979f709189335e20c13a8f83a7c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024505, "uuid": "6204efc1-14ab-49e3-88ea-aecf1b8227c7", "comment": "Malware payload", "value": "4a230dda8a1c9f5eb66bc3ab34bcbf56753d91778edca24e754dca6cb8bc96d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024505, "uuid": "ad35cc34-9efc-474c-b20b-d2e6f46e70d6", "comment": "Malware payload", "value": "bfed97810b463981ebde1b9607fc27ffb10f200d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024505, "uuid": "27ec1f9d-0b49-41e1-84d2-682e7234c970", "comment": "Malware payload", "value": "de1bfc8d9c9221400cd6466dd3356fcf666ba85fbb11c861b48cd2130716ee05b0bab7062cec3b40b30e602594af70d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024505, "uuid": "de730252-f2ff-4a0c-9729-9174f3cc266b", "value": "T13334233EF0B05F12ABF3875325E49A039A3422622AD29A93DD0A5F85C7910C366F1D5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024505, "uuid": "cc727573-a896-4046-959f-0906fca514ae", "value": "6144:SdMem0KsPoMpaHYj6e39opGP8/+W89kLaIDR5Tvx+FdEZ3m:2MvLsPozCtopjuUF5Tvxjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024505, "uuid": "42cd1ab2-f66a-4c17-b9df-4e5d4c7d3575", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024505, "uuid": "580e8b58-5164-451d-adcc-e81734c0414e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024505, "uuid": "29ada834-06f2-4ba9-8847-4f814fb2c79f", "value": "288345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d650f6fb-5f1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696027936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027936, "uuid": "de1cd417-b183-4606-9e19-7d2b6ba997c4", "comment": "Malware payload (Stealc)", "value": "025dd1c2cd5c3322c76e8cec0cefa8a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027936, "uuid": "8555f521-9390-43d9-9d70-359ea2590c21", "comment": "Malware payload (Stealc)", "value": "4af0042985b8bbc60007268c0ae6f929df7fc1415cc059e400acd6dde22f2e02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027936, "uuid": "95baaed1-a262-4137-9bf6-1de7685e4ed3", "comment": "Malware payload (Stealc)", "value": "87368bacbd4d98fd9cb71ab5058def6cea438c56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027936, "uuid": "75e9a35f-f9e5-42ab-9f08-df4e6d031576", "comment": "Malware payload (Stealc)", "value": "4f85144cb31450dcc3d0c250d5f8c1de8b422d987972cc427875a5475bbdf471c21c169f71960d419e4225fb16eb3137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027936, "uuid": "5332248b-e252-4e5b-b6e1-d450938daf3e", "value": "T1C4349E1A62A1AD71D9174A318D2EC7E4363FB461BE79EF6B23156F2F08701B1C262713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027936, "uuid": "25cab04f-e451-49d0-8f61-5b21f84e2869", "value": "18690df0ed1be01972dcb3dc78c42692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027936, "uuid": "7fdaed98-11f7-432d-91fe-89954afbe3ab", "value": "3072:g9XrjC5t+tqTKozQmpcmlWWNiBZYkz9sf9Zy20ybdM6QKbg52BTYTq:wa5mqHmmlWFBak2ZEaRpYTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696027936, "uuid": "f7a92fb9-f559-4fb5-a2b4-66a075a84337", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696027936, "uuid": "8d352d93-cd08-4f60-82a5-17761a3d50b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027936, "uuid": "0e865e41-fd6d-422f-835c-36671804ffda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1919723-5ebd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987931, "uuid": "b7975c89-0ece-4356-be10-3383f410418e", "comment": "Malware payload (Mirai)", "value": "c5a610c8bd34c4f4b69d2566d9ae3e1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987931, "uuid": "20d1a92b-e1d1-46ba-af18-63c5e2232fa9", "comment": "Malware payload (Mirai)", "value": "4b2ff5e85a7faf9b1f1b996f1f8e8a586d985111deead0c3814a31491ad01f65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987931, "uuid": "01002f3b-3787-44c2-a1a7-0f2d5b0ca831", "comment": "Malware payload (Mirai)", "value": "f82d6b8a4a2a656cd7d886942288277a87bbb8ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987931, "uuid": "17546e09-83f4-47a4-808c-cbacb57fdd08", "comment": "Malware payload (Mirai)", "value": "388f5e1e168e0d0f4dfb7e9af845d9b63cd29d6f334787a8510d3013e4382abfbaf2681133a5814418fb8c2747f2c6c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987931, "uuid": "7b7d9cdd-06ba-4ec4-845a-7712ab24e696", "value": "T12CC2C07DE8A4BC46C9ED08388CDD13B80C9D76C6B69E4FA9D2261DC46B6118B3C9E474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987931, "uuid": "6d18b656-5aad-4187-84c0-83bfe7fd7c18", "value": "384:PmWTv+78AdGa2nS3xbjJUFbviosPlozhfbIAawprR9gICSk3kImQ0KnEzrEcftwR:a7ddenS3j6Koolozxfk5JmsEzrttnWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987931, "uuid": "fc0e966b-db83-479c-b140-c97fad45fce1", "value": 27252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987931, "uuid": "507e8643-5b52-4ee4-9cb8-957d3e3a63dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987931, "uuid": "11ae3163-5026-480c-ac0b-66cd667c1cb1", "value": "c5a610c8bd34c4f4b69d2566d9ae3e1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d98bee-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PureCrypter)", "timestamp": 1695977622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977622, "uuid": "d880838e-7c97-4067-abd0-a0b4bb47e0ca", "comment": "Malware payload (PureCrypter)", "value": "e416dceae6981f686ceb3512fb9257ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977622, "uuid": "0bee20f7-d6da-4dd1-8d24-4865ba066709", "comment": "Malware payload (PureCrypter)", "value": "4b6d052e0cd9a90f541d02c4b7e4a1ac9ab5f0a8d15912a90d3b73f7d0551ab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977622, "uuid": "76843b32-a985-466a-9ebc-dd7c742a021e", "comment": "Malware payload (PureCrypter)", "value": "80e6b4c52c237a38115ed66d411666b5eb386f5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977622, "uuid": "baf5b73b-3744-42cb-907a-97aa151cdab4", "comment": "Malware payload (PureCrypter)", "value": "4f8eb6a6f30f423f4b0e6e0a186dfaadc48652f8c73c03cf0fb3d815160a6e61662509236241625027d533a0ddd5fa15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977622, "uuid": "547c9ab5-31b0-4c3e-b908-8e5d26d4c700", "value": "T1AB03090A733CC921C452B679DC5B9674232CDAB1DA12FA1B3BF5BF061C723D98C92156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977622, "uuid": "cc030fc1-be72-4fea-8847-c0f5e987728d", "value": "384:F9d//WyPvQGb5bKIYuVIyCHzR96L9HE7Uai8kh51g8PxlKCDmmlUh:9zb5WIYuV5O4N26HpQo92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977622, "uuid": "4380f553-ba9f-46c9-a2b0-2fe41e958736", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977622, "uuid": "d400380f-7e1b-49e4-8880-af49f54acc1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977622, "uuid": "27209617-1ae4-4ff6-a256-8a8bb7ce5e68", "value": "Cogmz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f74f36-5ebf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1695988576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988576, "uuid": "473160ac-1044-4bf6-ba58-ab8bef8c6189", "comment": "Malware payload (DarkTortilla)", "value": "1def66d61d9e9ef7d54fd2ff792d7f76", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988576, "uuid": "7dd25e36-6792-4dd8-8671-d008529c1090", "comment": "Malware payload (DarkTortilla)", "value": "4b8cba6509caf0a37330216d090e8fd3e4bb823ce628725b0deb70bd72a8c8ac", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988576, "uuid": "175c9baa-4cbc-4a79-ac3d-5218f9efb59c", "comment": "Malware payload (DarkTortilla)", "value": "3391d653364e6371654f1d936184150655cf86b2", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988576, "uuid": "e770fcf9-63a2-4829-8bb4-49b43135b9c4", "comment": "Malware payload (DarkTortilla)", "value": "442f6fc0a6200a2af34021979618af7c45e5a7ae75bda3e9708278eb7594562e8668bdcdba164ee104dca59210d598ba", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988576, "uuid": "62c70535-7f92-4c0e-90a6-ef9a27a8ac45", "value": "T18905F07EDB04BF92DC3D1B7E94121494A7F0D8431272EA4A1CC463EB66DA7478F6221B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988576, "uuid": "58e6808b-1a67-485f-8b3a-d2030dde9d84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988576, "uuid": "efe3dcf9-16f9-43a0-bea2-6d7561f9bb08", "value": "12288:5v4p7xPm2B9K4ryZUsvqdnzBS1faviBohSdAk620NX1r+:5wp7xeGafaviBoSdAk62gX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695988576, "uuid": "8a65eca4-af51-434e-873d-a13d9697a15d", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695988576, "uuid": "e49a0c3c-f34a-409b-bf70-b256d4860774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988576, "uuid": "8aefc0da-5696-4881-a85a-41cb7fb9ff1c", "value": "MILAHAJOBFFO2308200014BLONEYSH3AK1112700DOCUMENTSFOR40222PKGSAND5462000KGCHAINLINKTOTAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40440741-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987312, "uuid": "48747374-8a15-43a8-b8a6-9d8d022e5bea", "comment": "Malware payload (AgentTesla)", "value": "1125a6938ca315a3d2941acbea768668", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987312, "uuid": "29094f18-4f40-4076-8729-2106d785f41a", "comment": "Malware payload (AgentTesla)", "value": "4c961daff50dad3370616039b805d29166e24172f67f152a291f9327ad39625c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987312, "uuid": "3070b54b-652a-4bcc-82ee-e6fe9633c3ce", "comment": "Malware payload (AgentTesla)", "value": "403da1ea408aa00dd03316b8f0ff091e10ad2e96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987312, "uuid": "8b2e003c-393c-46fe-a07c-0a22558f055d", "comment": "Malware payload (AgentTesla)", "value": "e8c6cf7fda044f17f8bb30c401661f53e1b090dc76cdd1151a656b9b09c16a1e02dbc7ee0c980d65d08329ef3ade91b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987312, "uuid": "8f9def6f-b999-4b23-aaca-0801a9a6fb32", "value": "T1B7F4024797845680E5BF22759AB1103017BB7B558C39CE1D0CCC60CC5FFBAA17AA8BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987312, "uuid": "9a22f599-d965-4fa8-9584-461fe14a853e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987312, "uuid": "2dcc1a70-0a12-4a0c-84b3-f7410f0969d7", "value": "12288:DcUAckj1YawMCWpvBlmGC12nxqR5BHnbaIIgtLcEAIf53PoSg9PFDsYJ77e:vkIM3p2bUkRrn+sBbN5Pd0NsYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987312, "uuid": "af933429-00f6-46ed-aed9-c3b56f0d7239", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987312, "uuid": "ccbcbc86-0766-4aa6-8819-d8117def91f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987312, "uuid": "936df2d5-5661-473d-8c48-a89f05e28e18", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2431a6be-5f1e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696029355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029355, "uuid": "4940ac6e-7d76-4308-b5eb-5a9f2f2162a1", "comment": "Malware payload (Mirai)", "value": "43deaa2fe1742dcc18f53f31657d7e31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029355, "uuid": "748a9b8e-1350-4129-900c-7cb94b66abae", "comment": "Malware payload (Mirai)", "value": "4cc61e2aa345b97de325049881b38057ffdcadc9c66f5cc07750d2ceb409b64c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029355, "uuid": "ded40179-c069-4b8b-b154-1094699f6157", "comment": "Malware payload (Mirai)", "value": "5015b58c7690f999292b09440e172dbb96fde046", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029355, "uuid": "104d28b3-6432-4bac-86bf-5e7283a70873", "comment": "Malware payload (Mirai)", "value": "33d304a2c4dca71e290adbbef55c37d72de7c7d21776be393411861ebc2fb174598ce9e025a5a47f50ac3c4a0f6f7a52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029355, "uuid": "af099797-db62-48ad-8380-95c3eba197ca", "value": "T1F9431925AD792E26C0D8B57E11F78724F2F2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029355, "uuid": "f2dc3ce1-d309-4692-96be-10a9b6d59911", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDt:eL0AxvSHfymp0xgunvCkV6vTMDaue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696029355, "uuid": "7532c6a4-b0a7-4743-84e6-47be002e1fde", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696029355, "uuid": "6691e608-15c6-45ce-b790-f921f3bf4670", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029355, "uuid": "c103c777-afd6-49f5-b2f8-9be853a8ffd9", "value": "43deaa2fe1742dcc18f53f31657d7e31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d37d00-5f10-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696023447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023447, "uuid": "4e91eb45-8927-4ca2-8671-c291ca4b7805", "comment": "Malware payload (Amadey)", "value": "e913b0d252d36f7c9b71268df4f634fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023447, "uuid": "f7f1cb8a-331c-47e4-9452-c08bc220080c", "comment": "Malware payload (Amadey)", "value": "4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023447, "uuid": "b43465e7-f523-4a37-bce6-9996040d5941", "comment": "Malware payload (Amadey)", "value": "5ac70d8793712bcd8ede477071146bbb42d3f018", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023447, "uuid": "fe693d95-3ac7-4f7e-b15f-8d93fa2caa28", "comment": "Malware payload (Amadey)", "value": "86430b2673798f73da8bf9971966d157f684b75247ce246d53dcf35d71792c68f30ba4559b49ec14be547a5bed5493f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023447, "uuid": "46773094-5180-408f-b7a1-7d3eeb6693fa", "value": "T163936B1030D2C071D97E55351878EAB68B7DB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023447, "uuid": "afdf8f60-0657-4d5b-a499-3091ed252ee5", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023447, "uuid": "88a26e28-b442-4c49-912e-c744cd452374", "value": "1536:Ro4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU19aB89p:RoUCWbBNpplToUs1uNhj25LJU/aB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696023447, "uuid": "6f38c918-911d-479d-bbe2-1a562e9733fc", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696023447, "uuid": "cd9dc711-6d49-445b-be77-7d106af796ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023447, "uuid": "d6399099-9b07-4d80-9bdd-a3eaba7e74bf", "value": "e913b0d252d36f7c9b71268df4f634fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ad83fa-5e9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695974919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974919, "uuid": "9df0466b-c755-4875-94c6-b912ba3367b4", "comment": "Malware payload", "value": "7bccb8c82cb4e5a9fa8abb9d01147c84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974919, "uuid": "846a65ed-734e-47de-806f-a27e0e73cb9d", "comment": "Malware payload", "value": "4d1ef869c4bddeccc318939ea2651ce5a3fc2e369ba44a2e24cb9b102ef2be19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974919, "uuid": "3e237c6c-0d4d-409e-8c68-768aec6dfc1a", "comment": "Malware payload", "value": "15ec48c1f7f1073cb0e39ba9e64ac7e18416f25c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974919, "uuid": "292a9da0-8fa1-4cc2-b6d1-58e74636aaf8", "comment": "Malware payload", "value": "3c5a5533b2bd71c324be82aeba5cb42014eec7063d91c3a41221170236380c8e49c91aed69269f908ad8e97e50e366fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974919, "uuid": "9528ebfd-0503-418d-924b-5f42e1dca51d", "value": "T1FAF54BAF6E2A80B1D896F13C5AF28911F1EB319B1E1733DF2548443589670A1CD6CBF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974919, "uuid": "0ddd64cd-1b76-4bdd-a33a-a5c1561f5442", "value": "e701e8ef4e4dc8123b85c54c8532abb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974919, "uuid": "a0b9edef-5e99-4a9f-b6c8-e064059883e6", "value": "49152:Kc+EsyI9HTm5uNIQoF0EWe2LF8P5T708bYOGg:Kcx8x00EWe2J8P5TI8bYvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695974919, "uuid": "0f290ff5-8958-4454-9729-6ed5f0326af4", "value": 3432709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695974919, "uuid": "38fbaec5-8879-454d-8e6f-41e76ae76cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974919, "uuid": "e208c056-1d95-4b7e-a9f9-4ea4acf6ee50", "value": "connection blocker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a02da1-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696015939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015939, "uuid": "4f69ac21-0a8b-4506-8ab7-9bdf07ea9f0a", "comment": "Malware payload (Amadey)", "value": "b92d22f90c717cbebe3792c947f8b521", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015939, "uuid": "70f0a378-f21c-4a2f-b42d-09155e7fb5f7", "comment": "Malware payload (Amadey)", "value": "4d49c58bcee8f8ca85b8912a2d75e128144d28b97f9cad4dab9b15961455ecb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015939, "uuid": "125435d5-dc27-46ea-9e51-c358d47d5ad0", "comment": "Malware payload (Amadey)", "value": "542e2dcd9a83d2e0e623f103ef0729fb04721c78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015939, "uuid": "5daee0bb-9e25-4644-b5a4-c79583f8dde0", "comment": "Malware payload (Amadey)", "value": "8256b27d67cfdf839ecdf5f41f826fd793e39c82c6d3fb7b874012f0a83bb19ec06ad5cfe6f44bc13447a0fe6ce6d486", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015939, "uuid": "f59b6342-84b0-47d1-a404-ed46a1bbccbd", "value": "T17E34AF11B4D18472DC7225370AE4DBB9DA3EB830E9A15AAF67E40F7D4F30280D661A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015939, "uuid": "97529a25-01ab-4444-a5de-d2d2d3f584f4", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015939, "uuid": "6c12c872-bd2c-4a23-99ee-92f543357f95", "value": "6144:wsz4SHy5uoBMFGV5PEkIXEHvZAOSPcd6Vs0BC+:qCmuoBMUOMxxSs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015939, "uuid": "298d91f9-d3c8-43bc-9ddb-f5f54234b526", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015939, "uuid": "ad920b51-1c7f-413e-bca7-ea7223de209c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015939, "uuid": "3983039f-61e5-4181-97fe-cd7063d6ea90", "value": "b92d22f90c717cbebe3792c947f8b521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c814d4cd-5e92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695969501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695969501, "uuid": "a8a5c616-bd91-4c4a-9534-a2870ad5d30a", "comment": "Malware payload (AgentTesla)", "value": "72382c50f31c8916e747a15310028f18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695969501, "uuid": "595dd625-08d8-4bef-bf40-d87bb92645a8", "comment": "Malware payload (AgentTesla)", "value": "4d90b646a2076b8428d52c2975af86c02c27440aa871170bdefb5b5befcb3fa4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695969501, "uuid": "c7a2c900-fefe-46f0-982b-c8139af9982d", "comment": "Malware payload (AgentTesla)", "value": "5ca2ec0013998696ce1e8da325826a15ca3170e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695969501, "uuid": "23d8de2a-1dd3-44dc-8194-23175c8a0cd2", "comment": "Malware payload (AgentTesla)", "value": "0240c4c8470f71bb58587cb9284f4d4f87e7def8398b332d476054d03bf53b9a177fd6a539b6e0a584b18c8457961b66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695969501, "uuid": "889db26e-770c-40f9-b701-c1f1db2cdd07", "value": "T133C423B25ABC6C4F3D16BE1A40CE6E3975C92F18E45C07B3212326BAFEDB1404B9E455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695969501, "uuid": "f22b6bf7-ac97-4d6d-ad19-27ecc330cef2", "value": "12288:Z7CA1D5irXJmFVI+om9DrPpaIOhLdZx/TsdsWzclT8bJWB1ju5LAcZ+:ZmA1tijsFqNPhLBTsd754K+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695969501, "uuid": "45284953-aa56-46b4-a2ce-262980124cfa", "value": 583120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695969501, "uuid": "877aa723-beff-4cb5-86a7-321c85aefed7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695969501, "uuid": "fd363862-e933-474e-b56d-2a8c605bfb5f", "value": "EURO 387,226.pdf__________________________________________________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67eaccc-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991000, "uuid": "f0c35c22-3b98-471e-b47a-c922007dcf05", "comment": "Malware payload (Mirai)", "value": "553f4c27fd463a32a4519612513c2df6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991000, "uuid": "d048780d-e910-4c76-b552-a50880f77019", "comment": "Malware payload (Mirai)", "value": "4de9b8cbb297c50219067749d1b0262ebb9e8ad24f8d590629c5be25d90a16dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991000, "uuid": "da1dd767-b5d3-4150-b250-a28a29b114c2", "comment": "Malware payload (Mirai)", "value": "c4fbf15b81d080a93524928d9cce4c00c0ccdd0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991000, "uuid": "7442b65d-a32b-4a23-94e2-59d2bc7a86d5", "comment": "Malware payload (Mirai)", "value": "d036a4708b927845853529af93955cf43c5893ad0bc904d76e4217cc1373ef12ccc70c05fa8acce731d131a5de0bee2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991000, "uuid": "5699f86c-de9f-4160-8f3b-e8edb7018515", "value": "T1AF333BD6B902AD7CF98BE6BE80270E0AB53123541053073777EBFC937E321949956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991000, "uuid": "66fe15cd-d5ad-4755-a55a-478223a6d379", "value": "768:8CeKEfhe5Xdrben4I1fN5KQnaodgFHx+iPuvWeffpqmUJT6r6Lu380DZ:dsfIBZeXl5nKFx+imvppqmUJQ6Lc8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991000, "uuid": "5ab189ab-211f-4103-a936-5fe83d868407", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991000, "uuid": "18e3aa85-0478-4c77-8e4e-095f2c647766", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991000, "uuid": "fcd7b849-1438-4db0-843c-c4c33f7cbebc", "value": "553f4c27fd463a32a4519612513c2df6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcfb787-5f07-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696019442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019442, "uuid": "d01da8e8-c74e-48f4-96f2-0e87230f33b1", "comment": "Malware payload", "value": "7338b79f61005228fea8d2283499824b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019442, "uuid": "c58a9905-7a68-408e-9764-1fcf9a2dff49", "comment": "Malware payload", "value": "4df77205dd62f484937e98b74cfa14d79b60708f33d80051ff064adcc8bc3b1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019442, "uuid": "c6394c31-5b59-4425-8017-d9e85cb748db", "comment": "Malware payload", "value": "ac96b82f393c20b616d48e543e4eecae6e945e43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019442, "uuid": "5cd97ee8-74f7-475f-b6fe-0dcec45ef89c", "comment": "Malware payload", "value": "4ad932bb325db35fffa657654ec70d95140d1b673c128ebd253f5a59aa4e53678c39e9f701a8ad8e176e9540a3ee8781", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019442, "uuid": "380e5bac-932b-48d9-acb6-de5d59ae5ce6", "value": "T161556CF3F3929503D0535EB48C1BA7EC2D2ABE111EE8678766A43ECC1B7554138376A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019442, "uuid": "4c6766a9-bd68-4178-a16b-162a1288ff03", "value": "24576:jVTj3eiMW/AO4zqNWnRteDmeUwYhC4oCWDfwxfeIOT0:f4YyyDmeUjC+QIOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696019442, "uuid": "755e440c-b1b4-4a28-a8b7-5b47cb16cfb6", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696019442, "uuid": "8c2be468-4d7b-4835-8df7-7a04509db60c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019442, "uuid": "31e6aa0a-cd1e-4fbb-9c78-596261d94206", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.6442.17070", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7421b784-5eca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695993411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993411, "uuid": "f6eb9e93-c843-4bf3-8ef5-eb2b12bd27b3", "comment": "Malware payload (RedLineStealer)", "value": "d3fa902c162d588394a794a4a5ac954e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993411, "uuid": "28d7878d-8fd5-4b08-97f1-817273d39c04", "comment": "Malware payload (RedLineStealer)", "value": "4e328bff8cab61cfaa601d85686ddd0631f8e230cce3126a6c7524ba1f642049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993411, "uuid": "e0e54c2b-af89-410e-b1c9-dea123dec619", "comment": "Malware payload (RedLineStealer)", "value": "dc247f3651d11af9d32a80d5acae96f5a1e49c59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993411, "uuid": "f4b88146-316f-49b7-8937-6ad306d90ca1", "comment": "Malware payload (RedLineStealer)", "value": "9727361baf38d206039c6c931418aa2971a2ce929d0586145d3b11c1850c4653b60173baf11fe0217025fb90ff51471f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993411, "uuid": "4737c17a-3ae9-4c9b-a5ad-87758d4ac07d", "value": "T18684E102DEE2BC71E5664A319E2ED6E4772FF1314D596B7733585A2F08B0262D263332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993411, "uuid": "d3c93312-56cc-4336-b54b-61cb15edb0cd", "value": "cceb1c098bb76547116fd8d11380b21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993411, "uuid": "1d83ee61-0417-4142-a9c4-9e91cb161149", "value": "6144:3W/F+EOX6PbhCX4Uowi0EUToFnUiO2lRQzODLpDhTH:3W9+EVbXUowi0nUFJrv5DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695993411, "uuid": "a2ffe4bd-cc0c-4a84-8736-9bd91aba5cf6", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695993411, "uuid": "b51d3657-ea07-496b-8fe7-3b2f706cebd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993411, "uuid": "0d2401bb-8f40-4eb1-8573-c70b2830bea9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34aa5be6-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695986863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986863, "uuid": "ae95ace0-c0e3-4b28-b826-446f2f19c1e7", "comment": "Malware payload (Formbook)", "value": "be581b483cc7452d59e1f246615911a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986863, "uuid": "ae7a3838-af81-4bb4-8bbb-bdd33f6f3ca5", "comment": "Malware payload (Formbook)", "value": "4ec1ead75385f684740372f0ba6b5ca891cd89fb17b92904b9b3592f34939ae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986863, "uuid": "f648aab3-e441-4247-9b5e-48ec7afa6a06", "comment": "Malware payload (Formbook)", "value": "8fa2767e25635a8225f422d6fb54dde7bf80186f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986863, "uuid": "ab5c133c-b3a5-4673-bbba-be9fcd49fcab", "comment": "Malware payload (Formbook)", "value": "fbb9bf709e694c4a14a412829262fb0d78e450d616769cbe6af6586af70e49dac29c2e091611b12d7b7c348a13ee332f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986863, "uuid": "1893c8c3-c674-426b-a22e-41908e06663c", "value": "T1A3F4BF1571EB1812E37BEFBB87ABF944C77EF2A0226B721A505602C686D3D02F602575", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986863, "uuid": "c9a54f67-4e96-4021-abad-6b052d52ac4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986863, "uuid": "e964aad0-d602-4258-9c5b-fcff5e1731a1", "value": "12288:aQp+Uw9MMMDMMMrhjsOsAvExgOI4br9rAHWKd3RXPWy25ttyYVQCU:EMMMDMMMrZsfTxgANraFXPr25ttyCQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986863, "uuid": "3d384eb5-58da-4ea9-9781-19dde6d7c382", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986863, "uuid": "2c446429-f40e-42ef-aca0-ecd0626b34a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986863, "uuid": "990048a0-d545-4111-9290-d3c74df0b4da", "value": "Yeni siparis eklendi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53a1878-5e9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695973818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695973818, "uuid": "fc89f942-a246-4819-8a1d-33dfe70e1d43", "comment": "Malware payload", "value": "ddf3389a6ce4fb7014b8de077576044b", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695973818, "uuid": "d2e63c9c-e3b8-40c0-b837-2a54bd48790e", "comment": "Malware payload", "value": "4eef6bdc05d9c77baeffcd85c1d00dd648fd5017357c3ff528867f0816cb01d6", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695973818, "uuid": "a7df0139-9cb5-4ed1-b019-88061eb0b574", "comment": "Malware payload", "value": "647299080b0f7c2bc39f69e67b11eb2ee7af47ef", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695973818, "uuid": "bce1bb5e-6be1-4692-b3fc-2932d1cf9eda", "comment": "Malware payload", "value": "b90d63e414050ec821f72b4466b81fa8cd2279932c1773df8b88d4bc04dd8ad14642b109af2a9059dcc11ca116128415", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695973818, "uuid": "19977efc-0179-4dab-9ba4-5c6f56fefc7a", "value": "T1B6653338FACDD28AEC6444ABCA0AF546D42FF4FD79659F93E4C49726421870209CCDA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695973818, "uuid": "bba48f02-50c3-4cee-9fcf-1cdb6a9e40a4", "value": "24576:rPWxQfcIB3g1g0/9mUsJQewAmuyf8/QknH4aF9Xbs0jTJpoaWcUBqsiP64iRiSz:reefcIBwj1HMQemtf8/4afLsIoZhi4/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695973818, "uuid": "f3c701f9-56b1-40fa-8171-814af357bd07", "value": 1462561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695973818, "uuid": "ebd83040-a384-4d2c-96bf-b6900d5cc0ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695973818, "uuid": "1fc4b0a9-42ed-4270-a9ae-994624169f41", "value": "01- run first.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15b8d4b-5ee8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696006453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696006453, "uuid": "20f56cdc-d0f1-4b23-93f0-e760ca49f38d", "comment": "Malware payload (RedLineStealer)", "value": "c0dea0924d9a8360e4fefcb307758b30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696006453, "uuid": "00d736a2-259c-4f30-a8ad-341ac1fce934", "comment": "Malware payload (RedLineStealer)", "value": "4ef6fd3c5fd743118d469ad010376137608705283c29d6fc69962a22c68a439c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696006453, "uuid": "ebb0cdc1-dfac-4355-804c-6e8fdc7a4fe3", "comment": "Malware payload (RedLineStealer)", "value": "a6139dd89cbf42c29ec260dee802685c49597468", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696006453, "uuid": "82443574-3712-41bb-b524-3f6e7e9753c4", "comment": "Malware payload (RedLineStealer)", "value": "35fcdd1e34a3a4d46b0a3a3391bf69767bbef2fa257868d8c410b88ece78a916aad32f0e4dfdd366482063af407d63c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696006453, "uuid": "460ada7d-5e8a-42a2-8bc6-520cdb408783", "value": "T14E84D00771D2BC61E6668A714D2EC3E4373EB4614EA93E6F23246E6F18712B2D673701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696006453, "uuid": "128ef9cf-1b97-4dd4-8e7b-d9a9302ab48b", "value": "04b413a231387eb973c8024c0a5e8f4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696006453, "uuid": "9152d672-d6ff-451d-b2dc-d2c1da5ed5af", "value": "6144:zsLHC6LvbehdMunOyLhyjRgLhREI5MUyrKktZh/x1xKm98l4vYT:zs+6jb6dfnOyLWoRWrvhQEvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696006453, "uuid": "91b6cc8b-8746-4702-975a-b8d1c9e8fff8", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696006453, "uuid": "16df311b-123a-4b6a-9622-456ef51843f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696006453, "uuid": "804cd5c7-569a-4130-84f5-de18341e549a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702de57c-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986533, "uuid": "53c91df3-083d-4069-920f-a3139ae1f601", "comment": "Malware payload (AgentTesla)", "value": "2ef819b388f942124287072ae2cd891a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986533, "uuid": "15461ffb-0061-44e9-9011-fa837ee1ef92", "comment": "Malware payload (AgentTesla)", "value": "4f38930a1792837415ec289bd653ef533af14793ecfcc3464c73265a02d5ce20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986533, "uuid": "18dc72eb-fffd-4d34-aed0-99ff6ffb1aea", "comment": "Malware payload (AgentTesla)", "value": "cd35545969425ce2626e5a3826f79719ba992597", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986533, "uuid": "25a56ac1-0d11-49df-9c49-48ffe2046200", "comment": "Malware payload (AgentTesla)", "value": "50e9fb898b249a258f3d9fe7be822c3b584dd4c85904e9f61fbf24d11741acb2f99aa8f3277550fbacbfdfde55425ad2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986533, "uuid": "e3aa6c43-ac3c-454c-bc6e-5e2c58748389", "value": "T18072194EBEDDC563C6AC0A7D58921B4943B5DB2FB842E71F4CDCA57A19233C009D01E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986533, "uuid": "600771ae-ddb4-49f5-8235-e7ec310cf87c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986533, "uuid": "5eebc904-c342-46a1-8eb4-aa3f03010881", "value": "384:2UJZKmRR9ujsLUZVpGh5S7DzDDEekOaXYs1xFLSt:n86RY4LMa5S7DzDDabgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986533, "uuid": "03874aaf-50f2-466c-ad8e-4efd4b85e3f4", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986533, "uuid": "3991438d-4792-4445-be3f-f0d96f16a8d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986533, "uuid": "69db1874-b2b7-4d1d-8a3d-8c9a2afdbc67", "value": "HSBC Singapore Payment _Swift_copy.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93749d5e-5eaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695981868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981868, "uuid": "e2199679-f056-4dbc-9b5c-be9d15e11795", "comment": "Malware payload", "value": "cba61d984ae8339c72be6a7e979d9d5f", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981868, "uuid": "1fd25c76-d0b7-4d05-a5ec-93f14ccb2746", "comment": "Malware payload", "value": "4f4d7aaefa854a0540e992bf81817a622e3a68c5a5a1d6d15caffc48bbe44cbc", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981868, "uuid": "dc689432-937b-41f9-bc95-d8b7e439a3a8", "comment": "Malware payload", "value": "dccc8755c2427194debea84f45e81b5c6cfad13c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981868, "uuid": "08699e1c-5d6a-4050-b78e-faa8c4640e0b", "comment": "Malware payload", "value": "6f6b719b2dfed307813df3c0ca7fcb40779f9b8c989428966a0e026c86409a90f1fd33eb54b824fed1cb643ce162f095", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981868, "uuid": "a9bc17ed-5090-4ab3-88f8-3f28a564ef7a", "value": "T1C245DF0FA804CB86D50D83F47E1369D80A0D7F19EBD569DB24927B8F3E316A219CA1DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981868, "uuid": "9d940702-cec8-483e-afc5-1cbfe5e2282d", "value": "24576:oWQmmav30xnZyHw6VdW4iZypw6VEWnyjbvXEovEJ06/IwNx:9QmmQ30PL6V2p6VufXDv16AS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695981868, "uuid": "252d5a7b-e629-4128-9e10-3db6309665b7", "value": 1209344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695981868, "uuid": "4210056a-2e91-4790-b065-798e11da8853", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981868, "uuid": "9233ebcc-439b-4d84-95ec-1b6dcb689ed4", "value": "Shipping Documents.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf9588c-5e60-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.Amonetize)", "timestamp": 1695948116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695948116, "uuid": "61e918ef-48c0-4955-a606-bf19e502d5dd", "comment": "Malware payload (Adware.Amonetize)", "value": "3bd2bc1fb2ed7ce223505556ee150890", "object_relation": "md5", "Tag": [ { "name": "Adware.Amonetize", "colour": "#E5C072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695948116, "uuid": "cdff33f1-1294-43aa-a4c5-61b7102cc75a", "comment": "Malware payload (Adware.Amonetize)", "value": "500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37", "object_relation": "sha256", "Tag": [ { "name": "Adware.Amonetize", "colour": "#E5C072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695948116, "uuid": "153c6aad-e316-4511-a9be-26a2e7d85a46", "comment": "Malware payload (Adware.Amonetize)", "value": "4cfd2d4f3c8c7359164eb79cf0830480d4793f1d", "object_relation": "sha1", "Tag": [ { "name": "Adware.Amonetize", "colour": "#E5C072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695948116, "uuid": "a580606a-1f20-4170-83ca-44df4318f611", "comment": "Malware payload (Adware.Amonetize)", "value": "b0f9ad2d621d32d06d0bf078683755f84ca7f5498fbcf4bb64475d0a9c06d30c9cd379c141f635198f2250ae45398111", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Amonetize", "colour": "#E5C072", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695948116, "uuid": "bfcbd01c-6363-4f4c-a61f-3af6c6eaf7b8", "value": "T14EF4D053368BC4B5C5541631984BC67125A2AEA2AF9390CB77D2BF2F3C745E0A2973C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695948116, "uuid": "2d4c9310-65af-4bbf-a309-d5647eb7c0dc", "value": "3cdaadbae9cafb1eca0462d45093824c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695948116, "uuid": "523bf7e9-4820-45a1-af1e-eaae89e18a02", "value": "12288:TcTn6DzlAr6n1X+R1vXAMk8Bm+r7uobOJ6+ShsoaqEkgOsS5:ATn0e6gA0w+3uVzShRag2S5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695948116, "uuid": "9d68aa2d-a53f-4867-8676-6547a4712356", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695948116, "uuid": "f1de104e-b49c-4e46-938a-041f4605d54b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695948116, "uuid": "e86f64b1-59ce-488b-9a5d-49301c0999b1", "value": "500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03dc4b75-5f07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696019422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019422, "uuid": "69833b9e-0d52-4480-b085-91467bf50436", "comment": "Malware payload (Amadey)", "value": "0bb7646c703fc4d4c5e71f275b3c8ea9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019422, "uuid": "691b2702-9a4e-48a2-9a79-e0a5c4dc3ef4", "comment": "Malware payload (Amadey)", "value": "501325f6ce5a12397e48ac75b9e7c16cacfef3eeec57c57387ffdaf2d407df75", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019422, "uuid": "2b2e7382-b9a4-4377-ba1d-0f468928f739", "comment": "Malware payload (Amadey)", "value": "d40b31a2b0f3dcb56d7aa1333439545b58e12a26", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019422, "uuid": "924c846c-e55d-48b4-9b30-ef2301ca602f", "comment": "Malware payload (Amadey)", "value": "c892d31937a412a260b64a31e2ef15222c4f5125087e4e33190d3af34789072353c8cf41ae9dae65314002c94d2c76f0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019422, "uuid": "de0cbbe2-c3b5-4662-aa84-95d16f4b9d17", "value": "T1DE34AF91BCD2C072DC7225360AD4DBB95A3DB93009915AAF67E4CF7E4F30281E631A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019422, "uuid": "22809a7a-434c-4c07-bc25-0ab88011e8bf", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019422, "uuid": "84e76b4c-c119-496a-b2c0-86be2dbbcff7", "value": "6144:KWz4SHy5uoBMFGV5PEkIXEHvZAOKTO5Vs0BC+:6CmuoBMUOMxAS7s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696019422, "uuid": "d40447b0-1077-494a-bd4f-8ec34014b5b9", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696019422, "uuid": "8ad397f5-5312-4f73-aeec-1dfa74abc1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019422, "uuid": "1dc68822-5bda-4f6b-9aba-fc02bc7898ec", "value": "0bb7646c703fc4d4c5e71f275b3c8ea9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c01bd3-5f18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696026730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026730, "uuid": "4cef6000-1403-47cd-9263-3eb1bd1f1084", "comment": "Malware payload (Mirai)", "value": "3476dfc5bd1499acdbc683acd6359238", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026730, "uuid": "acb4e31e-ee5b-4c13-b909-a66ad648841c", "comment": "Malware payload (Mirai)", "value": "50580f113d06e0346bdccc04a40797c8dcdd8e09dd59d3952c9191a04196b0ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026730, "uuid": "46607612-c74d-413e-a403-f5e8cfb477e5", "comment": "Malware payload (Mirai)", "value": "132b9c5b87d34027e8e8ab6219cc18a66e88f19b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026730, "uuid": "e1e38fa4-8a92-49a8-ab50-0ef55deb0202", "comment": "Malware payload (Mirai)", "value": "1c279f3862139f16c06729f26d67c2b1bbc58403c50dd7e609b328996e7586e3085af305292cce48fd85d49bd32c05d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026730, "uuid": "14e1f85b-fc3b-4a46-8528-6410e031a126", "value": "T16F333BD6B902AD7CF98BE67E80270E0AB53123541053073777EBFC937E321949956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026730, "uuid": "1e65ea13-097b-42da-ae3c-ba6a94131dc1", "value": "768:8CeKEfhe5Xdrben4I1fN5KQnaodgFHx+iPuvWeffpqmUJT6r6Lu380D+:dsfIBZeXl5nKFx+imvppqmUJQ6Lc8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696026730, "uuid": "6719f441-3c4c-484e-8871-e5ff2c2e6ecf", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696026730, "uuid": "3203a546-0056-4e47-99bf-4b258b6db4fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026730, "uuid": "0ea07bac-0d03-412a-a127-11a366a83b74", "value": "3476dfc5bd1499acdbc683acd6359238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d27bf2f-5f0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696021156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021156, "uuid": "4f030402-fc24-44a0-93a3-1d2534d488fc", "comment": "Malware payload (AgentTesla)", "value": "b5130d47db14c2c6976a19aa3f2531b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021156, "uuid": "94b3a144-8d5a-4357-ab64-7c871494bdd9", "comment": "Malware payload (AgentTesla)", "value": "50c3c605b82972fb905212b4d7f4f20007d1ba399ccfd91baf339db1a12bf54b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021156, "uuid": "4f7c0570-0455-4e7d-bb2c-dbc3df7e66cd", "comment": "Malware payload (AgentTesla)", "value": "8120ec9a5caf58ebd1f2aba7f1b7ff30ceb71b66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021156, "uuid": "5d7d779e-7656-4daf-8a7b-e17ae1202f10", "comment": "Malware payload (AgentTesla)", "value": "c18b9850e0f53cb337c97c7ea0847f30068dd8e1e9c1baee7c50ad332e90955185a797a60e2f643e812d0008f4bdf9ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021156, "uuid": "1314165d-ef44-4765-823d-9e9b7571f68d", "value": "T160B423D9ABA43271DF0CBE23DF1F56E209E8A0C5015377244E4E7A658D3389ADDC3992", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021156, "uuid": "ffae455f-e66e-493a-8ef0-3daf87f09580", "value": "12288:J2S2YkQvoLhT38an31xl2BYRTr8vdsRW3L5+M9JwUnFHwkW:J4YkQALF3Z31RTr8viRSj9Z5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696021156, "uuid": "9f63c4b1-a6fc-490a-962a-2d6b2a2f18b0", "value": 542105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696021156, "uuid": "0cb88cb5-d6d3-402b-b835-80f911c36bd1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021156, "uuid": "a2f7aa75-c46d-4902-bb1c-d096dfd32bc8", "value": "ORDER LIST_SEPT7FIBA00541.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554b1a39-5f10-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696023425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023425, "uuid": "96269a50-acc9-4428-b0e1-9922d148c300", "comment": "Malware payload", "value": "e6a3847905a6739eb62f56db18c95a22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023425, "uuid": "fc6282d4-315c-4eec-b414-bbdaf767409f", "comment": "Malware payload", "value": "50edcfdd3a3fd95930f3d4bb1bd59cb95b48832dcfe42fafc452e9099963dff4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023425, "uuid": "8fd2d52d-f7e8-4223-a792-786d558d6cf9", "comment": "Malware payload", "value": "db41a44ef61cd02f96216a6cecbcdf236dc6783e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023425, "uuid": "73ad4630-6569-4ffc-98ac-0fc398d4a34e", "comment": "Malware payload", "value": "b11ee15a87ec5c2439e91812d1c4c354f00e6587c7f940b6026f00fc9fd89e3324f56a71063372814b78aea2df666815", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023425, "uuid": "38a28a5b-0d22-4598-b5f7-0effc5639a49", "value": "T115F423CE24C4106C86CB0EEC1549B4797EBA37B7B9519E6C9C8456E804B877D0B81FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023425, "uuid": "20c60e24-b851-4a38-a76f-015c0ab2fcb1", "value": "12288:/zIqo7i7N7ZXv9JZJEfqCK+5O5aZJxXjVFhpkFBbwF2hv1R/QQuozi7TbLdWeJun:/zIqouN7F9JZJkqp+5tnj4BwW/hul7Xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696023425, "uuid": "0dccc147-2743-407e-886e-f57445c8f89f", "value": 733248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696023425, "uuid": "c8fc1a69-9827-48d6-9d01-10af536adb44", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023425, "uuid": "23ba5cf5-382f-4f23-bd7b-023bec082c68", "value": "@07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d69bc5-5ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695978914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978914, "uuid": "94493cba-c6e5-4a08-99fd-0de6a940b1bd", "comment": "Malware payload (AgentTesla)", "value": "9d5f95053636f68bedf3ae4f71b92ef2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978914, "uuid": "b697b1b9-ca87-4100-8b49-2ab250ece0e5", "comment": "Malware payload (AgentTesla)", "value": "51126123452b3b2387713de84f1ec87592effe0ba5dc70c4a24a63e68e35e3c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978914, "uuid": "0c125340-9b3f-4abf-8dc0-f3a85989a369", "comment": "Malware payload (AgentTesla)", "value": "091615e09ee7b39ea6e056fe90fa5a6e9f7559b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978914, "uuid": "c99f1ba1-f5f7-4b14-84c0-30b7a424f1c9", "comment": "Malware payload (AgentTesla)", "value": "8d9f23c62a6bf11bf84c336e66141948cf1c0e99e5e66744058eaadddaf53b6d61b2db81117c08958ed190c806b70c90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978914, "uuid": "61b10d64-39d0-4e54-897b-30a34abfff13", "value": "T12FD423DD78A14A78D99D037E229D21130370F625D912E76CCE9E78FB0935B286632F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978914, "uuid": "b4ba4671-e976-414d-a00f-9f6e5269da5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978914, "uuid": "45067ddc-1065-4090-8981-61d0f04c2541", "value": "12288:b9725P3YdFTQasJAcowzr9zWpxn/UZcxK3oqAOSnOmZ:QRoYlJAcowHwP/UMR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978914, "uuid": "81a78240-a647-467e-a5a9-c5c1e94ef9a7", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978914, "uuid": "ecced7e4-0ceb-40cd-b49e-72f5a4fca00f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978914, "uuid": "df5c882b-84d2-4fca-831d-191f8af239c0", "value": "\u91c7\u8d2d\u8ba2\u5355_PO-20-2675_VSL_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f044d6-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695977584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977584, "uuid": "580a9fb3-994c-49e8-ad95-3dc99836efff", "comment": "Malware payload (AgentTesla)", "value": "6adb4394ebf71351a80306d0bbe502e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977584, "uuid": "0d25bdd3-3783-418f-a00a-6da73b46fc77", "comment": "Malware payload (AgentTesla)", "value": "518f9978908ed3b16dc50aacf5cd9c749202ed43c6e86c687471586ec2175093", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977584, "uuid": "c3e8bc10-0931-4bc1-8127-606ece86c270", "comment": "Malware payload (AgentTesla)", "value": "164d782940bfda3043dd18604652cf7460202694", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977584, "uuid": "836c4dbe-f5ee-449a-835d-f2a22391797c", "comment": "Malware payload (AgentTesla)", "value": "2171335729cfdd6d39643efb3d6f3c745a615d91f9149042eba8eda2462285121354642ca6aa48937ad9d31b7f8108d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977584, "uuid": "74e45968-7ca1-4b4b-9415-4bdfcee70ea6", "value": "T18C25E04C3201758FE967CC7E8A942C58BB14D4720B1BC353A66716BCC95EAEF8E494F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977584, "uuid": "58e91e1e-1d58-4fd0-8a84-88ddaa02a433", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977584, "uuid": "8ec5a2f1-3b28-4ffb-82e6-0c5484b6f8a1", "value": "12288:X0gQ89VsBaf5OrD6DWBJt7ZgVffrXiA1+Uefuo6rkG/dlwp1Utt3izY6TIuUvH3B:Xq89VQafuDMOr72FT71Euo0kCw4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977584, "uuid": "d8361fe2-24fd-4c2c-ba81-dd6f078c6f46", "value": 978432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977584, "uuid": "50516cb1-7f09-490c-a58f-d2decb8e6eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977584, "uuid": "8ab304dc-8da9-4e0d-90d8-41c26bfc3587", "value": "Invoice_423890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b0012f-5ec9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1695992795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992795, "uuid": "f4da6d8a-0aee-4fa6-9161-7920c1d12691", "comment": "Malware payload (Stealc)", "value": "105b53a3a5459b36aa60a4ae0e5b9526", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992795, "uuid": "d5862518-036d-45fe-a7b5-56c7760744af", "comment": "Malware payload (Stealc)", "value": "526b89f054032eed966bdcbf4787a162cc2431401c6271125155a5ce4fc350dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992795, "uuid": "683c34dd-abf7-4123-b891-9757495ed836", "comment": "Malware payload (Stealc)", "value": "506ff4a2f1f8a44161d533c6a1981c7a734e0c03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992795, "uuid": "e1e39855-24ee-4c44-a698-989438cb72c2", "comment": "Malware payload (Stealc)", "value": "90b5bd0bb6e53f1f62c12fc18f60c7346609ae3d630b28262be1a630930a4da26898bbea7ea8005bf9d7cf1c9210a242", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992795, "uuid": "7a48a255-5b1a-438c-a98f-d1a72ca66c6d", "value": "T15A34AE13A2A2BCA0D5E746718D2DC6E47A2FB4728F59676B32145A2F38701F1D27B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992795, "uuid": "85904e36-7130-4304-b938-3c9691513988", "value": "cceb1c098bb76547116fd8d11380b21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992795, "uuid": "0f72bd30-31bd-457b-9cb0-ffcf8084c6f8", "value": "3072:oXjFnAtJTC7niqob3INOBrM6dht6+Blrs8p8YHbxgPGIhpAh5mqP+pDz1Tvskt:81Ae7nPnINm4llp8ymhDjpDhTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695992795, "uuid": "4594d779-2721-4aea-85fe-acd239d3c477", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695992795, "uuid": "50031cb2-dd32-4324-aec7-a237ffd90e64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992795, "uuid": "61b825c7-0bfe-4578-b5c9-2305030e8437", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b99060-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986541, "uuid": "5ee50f58-e879-422d-a978-f55b2bed63cd", "comment": "Malware payload (AgentTesla)", "value": "b33296017fda84df4ed4eb572d597956", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986541, "uuid": "02670b9d-46a5-47dd-9765-dfcd8af0e8ac", "comment": "Malware payload (AgentTesla)", "value": "52d948e1148ad6801afe4669db47fced0d7a2eaaf75fca2b0dc663511d00d51d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986541, "uuid": "7be0b8e8-2a3d-48b9-b14e-6f2a8a82827f", "comment": "Malware payload (AgentTesla)", "value": "80ee387c79fc26753c3eed2738edbe21b4a93b5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986541, "uuid": "d963dc8a-3a48-47db-a124-6da683353a76", "comment": "Malware payload (AgentTesla)", "value": "99eb70708a223cd28cddd7cb607f0dae444e292b6278223857b185fc02b225d2fd45603e9867ae3e84c90c69bed390b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986541, "uuid": "1d071f39-a83c-42ff-924f-9da871b07507", "value": "T163F42356C7F9B8017AFC2C33465122634B598CBB1E6A0B41D6364D2C6DCBD829BA7DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986541, "uuid": "bc32e59d-87fe-4932-81c4-b633aebc3440", "value": "12288:G5ZeB1WyfLpd//H+DGaSf2gzda6kSeXuhRq5+Nnc7Zowtj3VfnI+D8d3PFd:e2nLjv+ivda6kZmJNcGwtj3pnIimL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986541, "uuid": "408ec6ee-dd65-42b1-93d3-bd5d80989529", "value": 740214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986541, "uuid": "2dd7ef86-07ff-4750-bad9-c429a860cca0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986541, "uuid": "453991e9-d4dc-4582-ad8a-a796f2dd661f", "value": "Novi poredak_HR-WJO-28-09.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51abab6-5ea3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695976824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976824, "uuid": "de3824ac-1213-44a0-8c35-c7754fb9aab3", "comment": "Malware payload (RedLineStealer)", "value": "ab42dd45f0015269d23c14792397617f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976824, "uuid": "37f97136-765f-45a6-9cbc-c4b36daf9489", "comment": "Malware payload (RedLineStealer)", "value": "53bc1e571f46bd27d5eb5130efb564ffaa9644d1f8b5bb23e24e0f1d006ec14f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976824, "uuid": "bac1218b-4a67-4267-88fe-89cda52f6d22", "comment": "Malware payload (RedLineStealer)", "value": "0d6a95083466527b58b87fcfa2ba182758c534b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976824, "uuid": "08d2e8b7-7e45-4f44-8af3-1273af5fe101", "comment": "Malware payload (RedLineStealer)", "value": "c3e86f6cf818c4272c2f2f40e906df0081a93ae1baacbaaf29a92fcd6010c69f1135634e09d8b3794cc4520d023fe192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976824, "uuid": "ad365ddf-9f4b-4518-bdc4-8489f13094d3", "value": "T139944B25244AC95EE6CDC97A81E6CCB56C326516E3B442CA21FB20ECCEDD397791730E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976824, "uuid": "e6dc6e7c-b681-41d5-934a-dcd8fc379bbb", "value": "231ae748dbc4fa94aca4a2ab6a3f3a91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976824, "uuid": "a6b7415e-9ac4-4808-a183-1ad3f0642960", "value": "6144:p2CencG/N0xbSOWtEabk6FUSsmdTblRLzwAmcQOE47VqxqQYT47h3s:c7cG/N0NZab1USs2zwAmNOr7hXqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695976824, "uuid": "5441f72b-a212-482b-8022-219006acb442", "value": 417281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695976824, "uuid": "4b4fbd47-1b8d-456c-82b7-573325589894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976824, "uuid": "b886c307-286e-47ee-9ea8-95135c16672a", "value": "ab42dd45f0015269d23c14792397617f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e349e458-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024522, "uuid": "2e0ad8e4-a81c-476b-bae8-a10afbf4f142", "comment": "Malware payload", "value": "11189c8ff8ad7b86c8456fa016574663", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024522, "uuid": "2a2bc39e-247d-49f0-b0fb-2f1692bf5828", "comment": "Malware payload", "value": "541bbd7faefd4c98e077b59058bed330ba9081eaeaf10ef202abea99c5afb498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024522, "uuid": "cd3a7d56-0f6c-4d03-b04b-0b656e0581d2", "comment": "Malware payload", "value": "381ca79d8f3f6481aabeef03c1b3e10fdce8b782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024522, "uuid": "5f4d701b-3975-433c-9f93-6b2803866e15", "comment": "Malware payload", "value": "ed3378eb8ce5ea77161a9e432dc70bc12263879646293c5a3697e0937369d5361a3427f7152fec9559f837a69f693b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024522, "uuid": "ad570f4c-ed49-4d00-92f4-6257d978ba5f", "value": "T1AD3412D509A778084B3DF48E4B3C3257A1E9400671DB62E7E3FA57AC442158B2BCDB9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024522, "uuid": "abef7cbf-5f33-4a6b-90e7-2d8a8fd62c99", "value": "6144:nZOCnqkduzYyjcXOkfK6yRkjonrjmgjWym19lAAcRsgDM6sdwtmX:DnqkdfyiOeNyRkjorigjWTJ+ajX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024522, "uuid": "9e9fd7ed-56b7-499f-aa8a-4acba515bef5", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024522, "uuid": "ee7ac011-567b-4829-ba59-208a820a4e52", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024522, "uuid": "94d80d52-9419-4142-8cd9-251735786cc1", "value": "288347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48042e0-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695987158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987158, "uuid": "3d712f6d-aacd-4a0f-9954-cfea2e5ea61b", "comment": "Malware payload (Formbook)", "value": "3c7ebe1e242ff26c729ace86a057f728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987158, "uuid": "76429ba2-0ea4-41e5-ae2f-4fbc8886d550", "comment": "Malware payload (Formbook)", "value": "5452d5591e734d9e447e2daac94374327b1f81fd48c111b139f0bda6ffad2fc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987158, "uuid": "8cc902a6-adfe-4b73-80dd-4a5a34ab8f85", "comment": "Malware payload (Formbook)", "value": "38e2b316bac97abe7a889de7e009791b478ac581", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987158, "uuid": "9f744ffc-6533-4b2b-9b0e-a19ab1614134", "comment": "Malware payload (Formbook)", "value": "31ecdfcdbb01bdf9c8b1e0b0c50866d1c7f0fc29da721d40846543733a2813f05444294324cbd7d04113c244e3374042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987158, "uuid": "50da23cc-2be5-42c4-9e64-92b8e7c056e0", "value": "T17DE401425B5526C1E6BF5275AAB6117003F76A52CC38CE2D08CC21DC1BFBB91BA50FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987158, "uuid": "c9452efc-ae34-4f85-b74d-1e95961ff7cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987158, "uuid": "e1832f15-993a-40ae-bfbb-27f2a2c6fa53", "value": "12288:7cLAckjb4TZ/N01+tDZsMjJt5tTNR0FbeYQdGwb3y79tlw+GfB:MkH4TZqgtqMjnPTNR0F6pzo3nG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987158, "uuid": "2199e226-9ce3-489e-883b-c5c29883bdd2", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987158, "uuid": "963adc2b-67d2-499e-9e83-5e13eae196de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987158, "uuid": "dd06a1fc-fc45-4626-a241-b10c05286365", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7440ddc9-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986969, "uuid": "8ef87006-b365-43e0-8cd4-f49c11e3b082", "comment": "Malware payload (Mirai)", "value": "6d6eeb52bac3c2c0e63273a621b83d8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986969, "uuid": "2d231efb-1ab1-4df2-8b15-e47c334afecb", "comment": "Malware payload (Mirai)", "value": "5477cdb1723db54c8d823bfd53457635d44172802c0e78c0caeb46d280ec4ca9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986969, "uuid": "11b221a3-f80c-4a83-9943-828b68d72dea", "comment": "Malware payload (Mirai)", "value": "f685ff046885c0b39a8c1bcd646eeb3dda2f9609", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986969, "uuid": "00c65171-a2da-4430-b82f-695e9062bbc9", "comment": "Malware payload (Mirai)", "value": "e2899eb2908684d1c2fdc56d9bbe8e01a1d835eea7eda2b92b0a335ff30012d3e11b6e281a87abf5fe5cab9ec67506fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986969, "uuid": "b3615dcd-8912-42f6-8d9f-4d7ebc4e4a7b", "value": "T12FD2E12CD99C7945D9AD3DBE51CE56F6294C70C0A35DAACD17338408BA27B87FC0B0A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986969, "uuid": "103b364b-7834-411f-96f1-cb570fb787eb", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KN/CJbiWUo:1bDs06t4BEub4sU/MbU/Cmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986969, "uuid": "91095762-6bba-4c5a-a3c8-16adf29a1c3b", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986969, "uuid": "2e5987d7-39d4-4568-9b6c-75f74b191636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986969, "uuid": "669a8e36-25a4-4906-9cbf-f3b1bc7f58ad", "value": "6d6eeb52bac3c2c0e63273a621b83d8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62c35fb-5ebf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695988798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988798, "uuid": "967914ce-e057-4a9a-a548-56d2ab1ccb31", "comment": "Malware payload", "value": "ab5a9ceb028ca3c1d63eecf4d9b47415", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988798, "uuid": "f9b61f45-a244-4945-8b0d-f8c5f866d0af", "comment": "Malware payload", "value": "548eaeac3e283d9c96ea90426c852f303f9ba0c3a47d173f6eef109182a228ad", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988798, "uuid": "7647bc64-e09d-4999-a292-c87001c9aad5", "comment": "Malware payload", "value": "1797fd5c239291c3f825a9664d08687607a5b854", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988798, "uuid": "dc49cb2d-ed64-4659-ba9b-cbe9de51ee79", "comment": "Malware payload", "value": "d80e6040356f00a532450ccee109575bbd77e393f21043b67683e0e02ee65a76ebbc22d960f3fd92e97f8951a6f4628c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988798, "uuid": "dee0d6ed-e3ed-45ee-bff0-12b25063243d", "value": "T1D1239D7CDEC20C23025EDB174E79EBBC067325D68A40779B82B5FE4A5189F37855AD08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988798, "uuid": "759dbdfe-b6b4-4fa9-bb93-14743f246e51", "value": "768:CBhsI2CldJbmXa83SZURODDchsI2CldJbmXa83SZURODDq:CBS4Jmq83SZJDAS4Jmq83SZJD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695988798, "uuid": "a598d8c4-6684-4953-81ec-002f12517096", "value": 46178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695988798, "uuid": "cc202d1c-4ff0-4323-81d7-68189d22ce65", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988798, "uuid": "67597934-5cda-4fe3-9d97-3e4420e25960", "value": "DMGTRE120803821_factura_CFE_20210615_8473HDJSGTW7873_SAC160504U42_B_376_20210609121247_nvD8v1C0twXcXq3.HTA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa476f0-5ebd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695987847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987847, "uuid": "382f7959-1491-4490-9a29-2b74404789c7", "comment": "Malware payload (RedLineStealer)", "value": "f340d31e095009d1db8f40c06abe32ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987847, "uuid": "35694a81-9405-48d0-bbee-e3931bff0760", "comment": "Malware payload (RedLineStealer)", "value": "549215a7b9832f2cdb44be0692842ee2bf3042a84073e53d1081ca2663db37ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987847, "uuid": "e8f4a7ee-5a79-4ad9-83c3-6de4ca443107", "comment": "Malware payload (RedLineStealer)", "value": "9399481f3ce4d0232bfb8387fa5b5543ee4f6dbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987847, "uuid": "13d7aaf2-f574-4a58-ad4f-6ae9defa2299", "comment": "Malware payload (RedLineStealer)", "value": "620e9a2ec1183654f7d1145ce8d959cb43cdc5c1259863ceb9586726f1bc2a0e0778ff747ec2bc363a40c2c977c5bf24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987847, "uuid": "a0d54a7c-a977-4353-a681-8af89ec1f715", "value": "T194763331E3404D78D97E393AA293110B1E94E630AA70C70761CF6D77CBB6EEC9D0659A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987847, "uuid": "9c471663-d51a-419e-bb92-2f377d566849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987847, "uuid": "768f6d07-9d3c-41a6-a3b0-fbaf9be5bf27", "value": "196608:0Tas4btCQXODtxULShdC/i+5qw2V5KlikRqdPX5:CL4bMrtx7fC6+5qwMK/RqBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987847, "uuid": "18ba1882-9a59-49c8-9f6e-8db67f541da4", "value": 7566336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987847, "uuid": "6cc879d2-2211-475e-a430-bad294602cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987847, "uuid": "ff4f920c-b7bd-4c76-8fbd-cbbad6d0d8cf", "value": "f340d31e095009d1db8f40c06abe32ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae2938b-5e5e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (N-W0rm)", "timestamp": 1695947118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695947118, "uuid": "9f2e199e-1d23-4693-9331-71bd02f38c7b", "comment": "Malware payload (N-W0rm)", "value": "3aa98ce4bf3e6a0d24b813f2bd417b83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695947118, "uuid": "47189e4f-ab03-48ed-9bbf-2373d9c6987f", "comment": "Malware payload (N-W0rm)", "value": "54ca21e74933aa1291eb305e1d9870a53e366f4d77963aed03c8e39307da8541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695947118, "uuid": "9e797f0d-07a3-4291-b578-06bc16f7e689", "comment": "Malware payload (N-W0rm)", "value": "bc2928c38f53958c948c342964acdb9114c9ef3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695947118, "uuid": "79006cbc-d4ae-4e89-ad98-c44a87c9f8bc", "comment": "Malware payload (N-W0rm)", "value": "c4b038eb94a51e74ec833a9d3ac4acbdba0fe7f4f6cbb6ef4ce97edb95057b3e349f87a842672fcfed5944e6672cfd9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695947118, "uuid": "5acb2ed2-1601-4279-a5c6-4539b90af192", "value": "T1B4158D2138C48176EEF320B743ECB63642ADE4B407195ADB16D81BEED7606C17F36686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695947118, "uuid": "1d9e4c6c-4431-41a9-9c1e-4a8a99167ec8", "value": "d215e7ae5c8053185b6f0c1eed2c8e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695947118, "uuid": "dfb4c8c3-a7cb-469e-9f6d-3e0890ec1a8e", "value": "12288:S+0AodKiDW9g145x58OpGH2EJ/qdDyyZpxThSGu4ywL7j7XI/9:SzBW9g145x58Opc/yVzSMXw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695947118, "uuid": "f421d33b-ac8c-4852-93b6-99cc0a5b77ce", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695947118, "uuid": "2b610d30-3773-4436-9c87-76161a9f586e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695947118, "uuid": "dd61d8cf-8bf9-4dd7-a60e-481ea75ce296", "value": "3aa98ce4bf3e6a0d24b813f2bd417b83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf9a31d-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987496, "uuid": "77a8f52f-ce3f-46a8-8503-8fb78f405210", "comment": "Malware payload (Mirai)", "value": "c0eeed1bec2618ad1f8cbe2aacfe01a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987496, "uuid": "fb062b0d-db9c-43d2-bb2c-ac618319a2e0", "comment": "Malware payload (Mirai)", "value": "54dc929add45d74c279185d5ea3111915ff4f644c6bcad684356b53dd7dc977e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987496, "uuid": "776cdf13-d727-46bf-a177-2677a6ccae40", "comment": "Malware payload (Mirai)", "value": "2269e479e9b3d8e14918a28d98a02c25e7529d6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987496, "uuid": "7262672c-b5fe-4566-87f0-6fe06b7db543", "comment": "Malware payload (Mirai)", "value": "40d6dabded7d8c32445e5f58b26497f38ebbd2836bbec7f027e3361a6b2e306aab1e35c605a18980037bb9cd9cf0b270", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987496, "uuid": "d5993554-765a-48a0-99f5-543c12a0d83b", "value": "T1E7C2E1A1E1F62D89FB756EA02F68C2C177A04E9EA777CC92259DAF0904A321747057C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987496, "uuid": "06f23f6d-c530-4383-9dc4-3bb393f3e4bd", "value": "768:yG959yM0HWubJsWDYcGf14uVcqgw09S0vV:4M0HRJswYcGt4u+qgw09S0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987496, "uuid": "69fce25f-6934-4d35-b541-00d4f4768607", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987496, "uuid": "0181ecb1-14e6-46f8-9fc9-81acedc4dc1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987496, "uuid": "7f09d8bb-2f23-4c99-911f-2dc6aa2f9dd9", "value": "c0eeed1bec2618ad1f8cbe2aacfe01a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee840666-5e9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695973430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695973430, "uuid": "859c87e2-38c7-4e96-932c-1da8a5731343", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "23e5e3246386326bc9b2d70a32c829fe", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695973430, "uuid": "97e6a12d-889c-4fb5-9de9-7da778b1310d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "551705fbd7751f070826db45864a2cdd3fe752eb9f0ca7529a40e51719f14a3b", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695973430, "uuid": "61f7f69f-4aaf-4f1c-bfe7-af26a83987e5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "aaa50bba3ffb97447403e0cb017e9d35be03a211", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695973430, "uuid": "efb10179-b4dc-460e-8204-127a62a581aa", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3d822dcf6e36d1b14219dd5328478b96099595e54560dd1c2a12ac30c3979ca225ae1a873de67c499b70099057c7563e", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695973430, "uuid": "8e19f4bb-7178-40fa-9724-6fc2b070d4eb", "value": "T1A7449F1272E2BC61E9278A729D2ED6E43B3FB5714E59672F33145BEF0870162C2A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695973430, "uuid": "39326744-685a-472f-a601-206f9f366ddf", "value": "bb3e0265f6d3c51a35d3f2ea7c8ca6ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695973430, "uuid": "fdc6330a-f8b3-4650-937e-a84e48319935", "value": "3072:IXK83XiU5ptVUiS4lwf5Houy1xk0xbTejLOyuDoAW65G9tepDz1TZsktG1:c5J53VU94l8SLinLXuDoAg9QpDhTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695973430, "uuid": "3b6d88df-9f9f-4e5f-8d6e-23f5d21154fe", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695973430, "uuid": "6d1614b5-225e-488e-8c49-e089159b9be9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695973430, "uuid": "d06697ff-3202-4101-b2ea-012ee7c68d64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04df62c-5ec5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991472, "uuid": "f602526f-709e-4547-b5c7-1f958b732935", "comment": "Malware payload (Mirai)", "value": "a91f4a8db6cd3a41648e014a8f31308d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991472, "uuid": "21b127c6-0731-485b-b802-56e56ab40b60", "comment": "Malware payload (Mirai)", "value": "5573f212d7e7cb03273a49a3d0faca4439825e95509906db7abaf9850e5a4298", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991472, "uuid": "0415869e-f684-4f2c-b024-5e2fc197547f", "comment": "Malware payload (Mirai)", "value": "8793eb7640e6fb96d2874d133dc8ec5ac2960295", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991472, "uuid": "8dc23cf3-02a8-489f-964f-be3966f42d0d", "comment": "Malware payload (Mirai)", "value": "0b5a68e251c966d8be884f24f404689aa9050de1a7869cc3bcb6d87639ed017571989763b9e49c9cbeb3316413528e5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991472, "uuid": "1947add5-ba99-4945-ace7-2e69d25e3414", "value": "T1E203F992B8D29F9AC5D06376BAAE119D3321A3ECD1DF3257CC245B007AC952F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991472, "uuid": "808d3aed-9038-47d5-85f9-d8f7564e729c", "value": "768:31VhGI7IFxBmCiD/N0Z4IZX20m4w6rDp/2HrfRsLYDtQswTTPpC+xC/hdAxLY0mu:3R7aACXm4ARsLCtjOjp3xC5D/ttk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991472, "uuid": "3f22f4c9-7745-47a3-821e-c0802c0234b0", "value": 40384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991472, "uuid": "503f18e7-1eca-4b1e-a364-9b43a5d21cef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991472, "uuid": "3f44c4a6-cfea-44fa-b060-a45395f98655", "value": "a91f4a8db6cd3a41648e014a8f31308d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d1b526-5ec5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991129, "uuid": "e68564ba-2072-440b-9d21-6998cdd055cb", "comment": "Malware payload (Mirai)", "value": "27a87802f22aaffdf605d314fecc2fbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991129, "uuid": "8dea8f06-39bd-4b1b-a2da-c87145f3591a", "comment": "Malware payload (Mirai)", "value": "55c3f3701f6b047e40b36897cbbda1cd2b59df4d5df5f98dd3bb0a88d26ae47b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991129, "uuid": "a2a82ab3-689d-421f-930d-1359499718a1", "comment": "Malware payload (Mirai)", "value": "273a8a4013ab993a9754ded70b79d962307ef647", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991129, "uuid": "e5b143e2-bdd2-4458-97cf-08546235c793", "comment": "Malware payload (Mirai)", "value": "ccef721628654601521375a1e20acba352700c7aebbf3bb023abd2d444ad78a098d1c0cead1c2b0778a1bc9b86bfb1b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991129, "uuid": "41e53f8d-4a50-47b4-818c-c343e78fbb4d", "value": "T1B753830ABF650FBBECABDC3745A9174624CC651A21A93B797D34D828F64B24F05E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991129, "uuid": "19e57e04-e914-4135-ab46-5dca438c6cae", "value": "768:IoA81yawwhsmVbNM9Yk0Er9/R5bqe7eeSeFjM6AFXVkWkeLXiSM6BP5/:IoA8ymgYI9/RYmnSajM6MBB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991129, "uuid": "c473357f-c898-431b-96d5-5a5c852f8acc", "value": 63388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991129, "uuid": "fc011113-82cf-4022-8cb0-ef1735359311", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991129, "uuid": "393bd754-b5ad-48ae-9308-05da1d1e48fa", "value": "27a87802f22aaffdf605d314fecc2fbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d24e75a-5f21-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696030766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030766, "uuid": "41a9db07-e1e0-47ff-b22e-0a96a9e95720", "comment": "Malware payload", "value": "251f46edca421d4da86220cc92048b1c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030766, "uuid": "32bcc92f-7005-4f6a-a051-8e03fb1bb713", "comment": "Malware payload", "value": "560cb21a263fbcee95ad2ac5c9a34e94dc3c82c3a23fabba4dabc570adf6b9ee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030766, "uuid": "b9b0a230-5260-4963-8f15-b8effa39a1cd", "comment": "Malware payload", "value": "df01b7f4afac7b8626aac849fb03f4e68272b5c5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030766, "uuid": "a4a08e5e-98c2-4501-b1cd-b037343fe31f", "comment": "Malware payload", "value": "6b5989e45710ef6f625f17d96691e2ca58b39498d1a1a9aa3128060f705bf66c277bf3721654ef10b0907d3a7185ac85", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030766, "uuid": "aab912a8-6f4f-44f8-a9bd-cd98577dce0d", "value": "T1D1142A45EA418F13C0D727BAFA9F0245333397A497EB73069924AFB43F8679E4E12605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030766, "uuid": "ade85463-25d5-4b0c-8321-3e2c62790306", "value": "6144:oBS9240WVaAm6aBpaoo4H4sQ8t2+CxM/RXjev:oBY2DAm6aBpaoo420C6/pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696030766, "uuid": "24561c63-9d80-42b7-a943-ef80102d7230", "value": 200509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696030766, "uuid": "fc2e1b67-d2b0-4fb1-b659-046dc5879bda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030766, "uuid": "df8d03f8-31c3-45dd-8206-2c466383515d", "value": "hydro.arm7-20230929-2339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5eca1e8-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987160, "uuid": "e3bfd3a1-8e91-469f-9292-3451e5f96cdb", "comment": "Malware payload (AgentTesla)", "value": "8051eb345f0135f09ff47d5d903375bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987160, "uuid": "ed92c489-a51c-4bf1-9fed-5bbef00bcea1", "comment": "Malware payload (AgentTesla)", "value": "5624c202efa98a27cf20bdcc59b5bc8138ee29bb4ea4ae5701bbf8f753197989", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987160, "uuid": "6766e9f6-d0d9-4762-ab1a-b22fab1b021d", "comment": "Malware payload (AgentTesla)", "value": "b72f9f3847b3c77d234bd6f0319fbb2b6bd3f8c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987160, "uuid": "7a22ec7b-2290-4672-b828-7f3bee5a4e4d", "comment": "Malware payload (AgentTesla)", "value": "ec60d1e124e6e9593916f0f619529b02b2029de58ec6e64a0a3f759c3d63a678f4bbb240770ad6891f8343e9a4e6d6e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987160, "uuid": "efe0c20c-2d34-4413-8665-991a48f9fe14", "value": "T10FF40246A78825C1F6BF6B35A9B6142143B77962C839DF5D0CCC409C1BEB6D0B984FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987160, "uuid": "12fbbe53-25e0-4b35-b85a-ba826d08e967", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987160, "uuid": "9c14472e-3871-4cdc-8f0a-ae5d4bf73f70", "value": "12288:Jc+AckjNFOoGuaUBWz1Yc8hpcVKSh3CedThZiE46caEzwKXMrtz4+cBd:7kJFGUBWpYFpCXVHZiE4Eps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987160, "uuid": "485fe68f-bfb5-46ec-bc58-4f9a7a04f7de", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987160, "uuid": "c06401e1-ac89-4618-a5cf-2bc9440f465b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987160, "uuid": "6d25a606-4b74-4d93-898e-877c295aa860", "value": "RN03874211.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8755f27-5efd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696015484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015484, "uuid": "e0146446-5b4e-446b-a327-b5c15f870f0d", "comment": "Malware payload (MysticStealer)", "value": "4c6ea4446f9bb37527ee1f6c854114d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015484, "uuid": "eb900d34-2b03-4ddb-b431-c4fd5c2794fa", "comment": "Malware payload (MysticStealer)", "value": "562eb85a706229c91357ce66da01a7f56d28e8e5d0772d4c247b07bdcfa484ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015484, "uuid": "8aff848b-49df-46b0-a8ae-90286c1048e4", "comment": "Malware payload (MysticStealer)", "value": "143af58cdfb0481ecb22a2e9c41965cda8d0b2f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015484, "uuid": "35443385-80cd-4418-a412-ed4b7929fb00", "comment": "Malware payload (MysticStealer)", "value": "0343bbdbb010ffbe4bb5c278ce973e9a245395aa38f55bd38877b3c91202c478ecd79f504e8ea0a9b7be3026ec68ebf6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015484, "uuid": "a406ea15-2024-47fc-ba1e-edaa985a69bb", "value": "T18374AE71F4E5CC32CDB211390AE59BB65EBF797408463CAF63E48E7DDE21240B691922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015484, "uuid": "a3fae40f-aefa-4afc-a875-6208a0cc1a23", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015484, "uuid": "688e0e2c-f3c0-42b6-9cca-8177d4c190b9", "value": "6144:MhTeW/s5GqrO5aXnfEGIXWPvZAO3y8f+wCIharYUb5rrMtdnYzv3+A7Vs0BC+:VmcGqrOk86xmIhaPvM+f5s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015484, "uuid": "9f694f02-b10e-4ff3-80e2-9415ff5a04cd", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015484, "uuid": "67fc7f37-6ad4-4984-b17a-1103fa43b9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015484, "uuid": "8130564a-9aa6-4a6e-8216-16c850974851", "value": "4c6ea4446f9bb37527ee1f6c854114d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35be8a1-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695987129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987129, "uuid": "59683717-a3f5-4044-9bbd-910bd8503ecd", "comment": "Malware payload (Formbook)", "value": "84ac0a564ad9bf1b672acfdd0bd397c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987129, "uuid": "10e9bcf2-9dd8-41d8-8070-b005be522162", "comment": "Malware payload (Formbook)", "value": "566e2a793ef02ec92066c9324c65bb406790217ba0a3158dc9ba56b612ba465e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987129, "uuid": "083bc75b-a37f-461b-ba00-c2e4b8795e58", "comment": "Malware payload (Formbook)", "value": "f910ffb986960d16ecb8a790e3cd02f4cda55cc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987129, "uuid": "b9a0e0fe-bbbd-4a08-9077-2d865f1a78ad", "comment": "Malware payload (Formbook)", "value": "f18a669922827fb0712d45cba73520d53532b332b1618d8feed35250f96238be9919b5017f82ad21904150dc2e0139a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987129, "uuid": "a8f30f7c-e861-4a4b-aa69-ef2b664ec743", "value": "T18FD4124C6B1949FBD96C09BF9480620047F9C2B3DD52E7858CC8F2FC64DA2FE9942697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987129, "uuid": "c26b5d90-300e-4192-ba85-3ce22c21eddc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987129, "uuid": "196bf3a4-8ac2-4e56-8023-01bc49adfad4", "value": "12288:4z9xUoA37s4O3tAckj9aYoLg8lQXAellUaZ3/htp1sIdVA23qNrYn:IkC7SDXUChT1JqN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987129, "uuid": "cdd8cf36-65f1-42e7-9e2b-810afee9c2ee", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987129, "uuid": "b0b13693-07a4-476c-95d0-350ba67b9ff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987129, "uuid": "ba56f801-9c98-4f79-ad50-e4fd18ec908a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e99b6ee-5ebd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1695987872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987872, "uuid": "217b944b-61c1-46c8-bc89-283919b51c5b", "comment": "Malware payload (WSHRAT)", "value": "6b262e3cfe7e64378337669bbdf768fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987872, "uuid": "683008c2-a486-4aee-b6f8-c1f33f6475a6", "comment": "Malware payload (WSHRAT)", "value": "577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987872, "uuid": "f204e28a-e85e-424b-a5b0-7e25e161c7d9", "comment": "Malware payload (WSHRAT)", "value": "6f2c63adcdda5114299344058464016be1a87c70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987872, "uuid": "ec8420cb-9d15-4541-a812-7d8206e3d897", "comment": "Malware payload (WSHRAT)", "value": "bea3a9625ff4ccc8a7e1e4bdfdaa7cdc074a6f1cca7595d83916e9b1b7e84043b448bcec88d2adecf50237d4b05718d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987872, "uuid": "1f430309-99ba-4c79-bfb3-5c1eb5cc15e3", "value": "T16AD4122174C0C2B2D4B7107240E6CB769A7A7076077AA2D7B79D5BBA2F122E093353CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987872, "uuid": "f0b76178-9f64-49a3-89d9-bac990f59d58", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987872, "uuid": "8a005d32-c524-40ad-bb06-7ff523f2a458", "value": "12288:dh1Lk70TnvjcZsqnY9LH8Vaxc07BK9GGjcCUfHP2kuGZiCKAzDN/ELq:Zk70TrcZr3ycKNubUfHDFkCK8h/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987872, "uuid": "8e4d5674-5b73-4f7b-820d-02637417c583", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987872, "uuid": "20afa4c3-ca75-4064-9c54-048edc492cc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987872, "uuid": "fcac6cc6-5fae-452f-a31c-058a5cd7829a", "value": "6b262e3cfe7e64378337669bbdf768fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df3e6a3-5eaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695981858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981858, "uuid": "854c4488-30a0-4be8-9930-fe02e4329647", "comment": "Malware payload (SnakeKeylogger)", "value": "b3ed7c220c1fabb6f0e1f18b5f3fb208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981858, "uuid": "c454a3d2-4a0b-49cf-83d5-a1c46b173284", "comment": "Malware payload (SnakeKeylogger)", "value": "578e73a317d1c1e9952b52e6fa51e847ce4e3fd3e3f3f1b0be051eba9fc4b9c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981858, "uuid": "440fc5d8-fb3d-447f-879c-972af55e8003", "comment": "Malware payload (SnakeKeylogger)", "value": "c2b640aa1c0406a4aae0a6758b7c67e2533c038a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981858, "uuid": "9aea34a1-bb8a-4b82-8b1b-1843207c6172", "comment": "Malware payload (SnakeKeylogger)", "value": "584e47d2631ce767e41968320938444a2d68263fac3f095eff01fb7f510b646c81ffe8e868d61bed9a3549ae602d6ad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981858, "uuid": "9c5cdaa2-822c-4971-8272-3a6943ba5932", "value": "T1A39402C20725B726C12267F1D26B1B565BB8B53BD113FA591FC1B2D590F2B037282BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981858, "uuid": "842dd36e-a4a1-49e2-8c83-e4ca73bc419e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981858, "uuid": "512f2b96-183d-405c-99dd-d1c4ae951814", "value": "12288:vrguH/URQeAismwvTCZGHe6RHKZyhpDKCW:vrBcRQHtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695981858, "uuid": "cb1de70b-9c39-40f1-8f8a-fa9a05e305b1", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695981858, "uuid": "a095e74e-5e69-4179-a8ca-2b297121bda9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981858, "uuid": "0509d2e6-8f73-40f2-9e09-d308f94c1500", "value": "b3ed7c220c1fabb6f0e1f18b5f3fb208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f5c51d-5ea6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695978078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978078, "uuid": "7e1f3deb-e91e-4232-bd9a-637e7b625a33", "comment": "Malware payload (Formbook)", "value": "913f975e387db27c215aec2641490089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978078, "uuid": "78871dbe-e51d-47bf-911a-e1632130c498", "comment": "Malware payload (Formbook)", "value": "582b83da6cb0374b90790106f9e4b8a046e9d0b24cbd725c2be985c8c0a149bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978078, "uuid": "682d3771-75d3-4deb-983b-a498b04bbb1d", "comment": "Malware payload (Formbook)", "value": "4aaa492916c2380d6b647f3d5134b2a351f054bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978078, "uuid": "0f37f86e-5df7-46b4-89a1-6085cc121bb6", "comment": "Malware payload (Formbook)", "value": "2f8ce66dea2218fa4320cf9263f1e732361309777ff3e37a25fda956e2ae65a071f9ea3facb0c0ebbb84feb4f86ff31a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978078, "uuid": "39b08101-517d-40e2-98a0-f062aef63772", "value": "T177D4238D7ED74A61C489277EB7D8455A8330F953D021F77A8AC530CB09367889862FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978078, "uuid": "d142855c-f61c-41b6-81d8-a1c70839f18d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978078, "uuid": "4b536dce-b535-45a6-a83c-d914c15bf9d6", "value": "12288:l725VAuE6SDGAQd19hS6sPH/5tDHX3ZZ59nv7H:sA6W+d5AH/zHn759v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978078, "uuid": "34517acc-8a2f-43a6-9b5f-2816646c9da8", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978078, "uuid": "fc5fa3f1-9dba-4e04-bd36-5aeb49ad4d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978078, "uuid": "13cd2358-ff28-4db7-984a-74648dbee139", "value": "MV BBC PLUTO PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e83b5b-5ed7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695998995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998995, "uuid": "0e873a1d-5c64-43a1-a37a-87440c4f659a", "comment": "Malware payload (Smoke Loader)", "value": "08a9bef38c975badd3516f99c87d2fdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998995, "uuid": "170244da-1a27-44ff-a604-0587f7ba96f2", "comment": "Malware payload (Smoke Loader)", "value": "5914bd0a1160daa025f15e0ea9b7a317b5fe56384ff094d3f3a9c2435362852a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998995, "uuid": "6c4e9b0e-2a65-401b-80a8-c8ac71cb6cf2", "comment": "Malware payload (Smoke Loader)", "value": "4b364b6b59606f9283ce15f6c2255f67a923e99d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998995, "uuid": "43c07c7f-e530-48b1-96b2-3f5a366cfbbf", "comment": "Malware payload (Smoke Loader)", "value": "dc43dcae801e183c57ef64544ec95c5542f8c36f1c8537bebb6a6588ee7df57b7b72082f55e11bd8657339c95f32fb2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998995, "uuid": "5916ef26-298e-4624-876c-d5c08a8ec7ef", "value": "T14C34AF11B5D1C072DC7225360AE4DBB99A3DBC3009A25EAF67F48F7E4F34281D621A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998995, "uuid": "369068b3-3bfa-4d01-84ba-c434dd812ab1", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998995, "uuid": "828cd6ff-e5b7-486d-b5cd-d41b9976d44b", "value": "6144:IKz4SHy5uoBMFGV5PEkIXEHvZAOEMZchFXrVs0BC+:ICmuoBMUOMxD6hFXJs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695998995, "uuid": "bfcb581d-dead-4e2b-9375-d07e79d6fb6a", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695998995, "uuid": "e17b5c02-06c2-4aed-8fb2-d26e9966bdaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998995, "uuid": "95d8e500-5b08-4548-8c19-8682a44bae78", "value": "08a9bef38c975badd3516f99c87d2fdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88c49e2-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696010250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010250, "uuid": "9e4e821e-41a1-4be7-b718-dded1616672f", "comment": "Malware payload (Mirai)", "value": "41c3cfd382e14747950370fb07e96366", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010250, "uuid": "a91e3096-5e67-4e57-a93d-ddae8ef9757e", "comment": "Malware payload (Mirai)", "value": "59165a17931481d05d0f3536b272ceb2294e8c7b6168236b700b6a60d7f27798", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010250, "uuid": "c1e211d1-b0bd-4a4e-8940-470b7ee79b52", "comment": "Malware payload (Mirai)", "value": "80b7046cd0756fa2b671e9cd6e50d26dbdc7837f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010250, "uuid": "724328d8-ded3-4ffa-b599-d7596f1d55d8", "comment": "Malware payload (Mirai)", "value": "c3a444715b2fcec15d279a33c402faf6972cb1884f167f4eb3e8318622a42e73a6f8f2679fff2ed0f1583c7e1b6767dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010250, "uuid": "759e966d-61e0-41a1-9ebd-9250c3d24b9e", "value": "T17AB2C0CC61943084C98D7C7C178D4A664F6CA190BADD9F26E350CD9873BEA8F345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010250, "uuid": "db6d3c12-bd23-4de8-af5b-a21bc43caaf7", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpqZqSWvi:4QlS07FUXqIYSXQKqueqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010250, "uuid": "c3c3b000-dd59-4b38-9669-b0c7ca89db91", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010250, "uuid": "4e87f329-2652-4835-9654-bd0afef45ac9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010250, "uuid": "3a4ec61a-9cb9-4023-8e0d-50edb91c9ec5", "value": "41c3cfd382e14747950370fb07e96366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9a1f74-5f0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696021153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021153, "uuid": "e377f61f-89fd-4bc2-8223-898fa4a3ebb5", "comment": "Malware payload (Formbook)", "value": "5306ade6a0fec092f19af6112a588448", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021153, "uuid": "3f722abd-608c-4dba-b793-a256aaa63a7e", "comment": "Malware payload (Formbook)", "value": "594d683dfc3a94c68da22ad08dd938693e5a0b96abce95664c965d6000a2ecd1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021153, "uuid": "3d4eff4f-652f-4f16-a632-caf326d514e8", "comment": "Malware payload (Formbook)", "value": "84ac6b98e6ec64a5d821080852b2ddbfb464b59f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021153, "uuid": "57a6c214-3ed9-48fc-bd45-ade8aaa635e0", "comment": "Malware payload (Formbook)", "value": "26c08a97df1e1cba5a8bbdb83a7335b3b698ce815b6961799f48a7eed5e1204d2f6d37cab00df5f47becbd4598c626ed", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021153, "uuid": "1ea1cba7-83d6-45a5-bbe8-5d574937a165", "value": "T103B423CD922B7D2CEEFF117D45982268376B6A05CF538FF46A9B42CB6D200C118B5E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021153, "uuid": "d759bf9e-2c54-4ae9-80fd-e0f5898a1b8e", "value": "12288:28YrRHU9bJYNX3852yzgCb6PrDVlAxC1B/N:3YrRS9Yh3VyECbijASBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696021153, "uuid": "5ee6a0f7-7d6e-4b01-a414-875b13b9486e", "value": 521660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696021153, "uuid": "6fd5659a-eec7-47cc-ad6f-df97c11bbbb6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021153, "uuid": "bbf04868-fe87-429a-a44e-7f8bb0b28c3d", "value": "Nvpatlaeuyajct.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c6332a-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695986886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986886, "uuid": "f0cae624-77ab-4a5b-9335-f0d1b6b68fc2", "comment": "Malware payload (Formbook)", "value": "81a5c535b46c2a330913597e8f888f25", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986886, "uuid": "b5826338-04ff-413d-872b-664eee8d43c2", "comment": "Malware payload (Formbook)", "value": "5951cef80086bfb2ce1cbb16802612e3366525aa94f5ebccf352c3761bcf15d9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986886, "uuid": "3f0a68c3-f22e-4e6b-8660-c9b529ea9ccc", "comment": "Malware payload (Formbook)", "value": "168679807c96c893221252a50d8884760e29ac49", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986886, "uuid": "5c231125-89f1-4c2e-a291-dd7edd15e6c3", "comment": "Malware payload (Formbook)", "value": "c12c654be2f41168a2859dadc281bfac43d995149b0b8b4a3ebc4aa84eac52dca2f23c6eb850645d6bcb68537754bd4f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986886, "uuid": "0daf251d-680a-4757-a5c1-a32e6f895d9f", "value": "T1838423F023CC54FBEC6357B09D37E5365AA96A1300E0721A67252FD43BB52429E1E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986886, "uuid": "69e8aab9-a5e6-4ff3-8572-67bef9775be1", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986886, "uuid": "f86fd9e0-e5e8-43c9-9c9a-247ac19923ed", "value": "6144:BnPdudwDsOGVkx6NDrYDo82AN2B1LUYuhrCd/uAkDR1FyENc/LRxJW6ah4U73C9S:BnPdwOxxCDvAN2B1KChuAk1jWrJWPpyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986886, "uuid": "48b061cf-6ff7-49cd-8e0d-be561ce203e3", "value": 388414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986886, "uuid": "5a20a505-d14a-46a4-a60b-aa1aa142e996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986886, "uuid": "079eac32-3e27-4432-8280-7172b9970cdb", "value": "(DHL) Original BL, PL, CI Copies.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00751dad-5eac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695980333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695980333, "uuid": "2afbc3de-d13f-4e97-9fda-0a035d75c112", "comment": "Malware payload", "value": "52e507f8cbdf95493c5963ddba10968e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695980333, "uuid": "157d81cb-23de-42a0-8d80-6fa9de9a93ed", "comment": "Malware payload", "value": "598b863b03ee4133545a4a978bb2c37b121f6e1120e17292c0b315546b13ea32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695980333, "uuid": "a5ca5943-b373-47f2-845e-34a17f2621d4", "comment": "Malware payload", "value": "765adfb02b9f0d6e814051d07c5b324c3b7a2d92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695980333, "uuid": "4d88c594-e296-43fa-b4d3-3b5c0ad21d46", "comment": "Malware payload", "value": "45dcb5a8970aa2cbe7f3dbc608ae3f32260f5a12e7e752b2627c62689ea0630496af3e2d56ad9d778f578cf11e3bc28a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695980333, "uuid": "1eb29619-c98d-4525-ae87-0a57bd4a9c7a", "value": "T12D848D067591E0B6C02221752F29D7795B7AE9214F210ECBB3E41EF82BB42D11D367BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695980333, "uuid": "5ca00fdb-f29b-4c9f-881a-9631007caaef", "value": "8c16b06cc391b6b42fc773e5da57f5a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695980333, "uuid": "30cf682a-df54-4859-b310-b3b8846d09cc", "value": "6144:EJbuFHgEq3nAE/aEaJdebAIpG65X2JYNjyHWDbuIlsMFP:3FA5vaEaJdebAvYNj2cVlsMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695980333, "uuid": "93b4e8cf-560a-42ac-84ef-9845169f6886", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695980333, "uuid": "513d16e7-984c-42b5-b391-4d4f58490fc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695980333, "uuid": "169f2d4c-79ab-4d18-b6f0-867dabe7158c", "value": "SecuriteInfo.com.Trojan.GenericKD.69471964.32170.5515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483628ca-5ea6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695977876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977876, "uuid": "7df32712-9926-4098-a612-98f756288a34", "comment": "Malware payload (AgentTesla)", "value": "9d7fcfbafb4a2bd4c4c146b9c105f8de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977876, "uuid": "95c48f70-7820-42b6-8178-b1cdcf3b5b1c", "comment": "Malware payload (AgentTesla)", "value": "59a8979d512482bc6a656efb0445fbd1ad97b6c07e6b4353204c6992daca3e35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977876, "uuid": "764c46fd-1d34-4870-adb4-459020f3884f", "comment": "Malware payload (AgentTesla)", "value": "81289d6023da1dc7ea2e3749b66242cb19f12275", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977876, "uuid": "dafa4128-1e88-485d-97bc-699fb4fe76ba", "comment": "Malware payload (AgentTesla)", "value": "ae24fea7260c7bff9cb93668545f4f83b52f63c5eea539f1c9357aa07e5883faa917da010fed611afcb28f7a26b43d13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977876, "uuid": "597d7468-5f20-477e-9a77-83947826ecaa", "value": "T13ED422ACB8D90F25D49D03B96B8C21A34364B134C402DAADCD9F25CB1F75B892719FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977876, "uuid": "dc50907f-01a8-427e-905b-c9c594881204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977876, "uuid": "f513ca2f-5de7-4310-9c5c-2d39e538313d", "value": "12288:Wl725mONpEBq3sjz9z+325LjOEtH6wHl/W9L6oKnT7S/VPhrW7aSzRN//:jhRcvNt5TtH3HlO0cPdSdN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977876, "uuid": "552fa777-4a69-4762-abce-fe91ff1ba664", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977876, "uuid": "eaf919a4-78c1-4a53-9e47-42a6401195d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977876, "uuid": "65bab612-e9d7-4e55-9b08-30207ddc523a", "value": "FedEx_AWB#50931274643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1326f9-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986523, "uuid": "592b8e27-d600-457f-9205-fcb186e6e1f3", "comment": "Malware payload (AgentTesla)", "value": "edff163fa9424a2c406c0f7ae9fd0053", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986523, "uuid": "4134e617-7a14-4448-a01c-422d0b36ca6a", "comment": "Malware payload (AgentTesla)", "value": "59b1624b294226b93b186dc503efd7c48937542eec03b0d32d27034729c2a733", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986523, "uuid": "1f6495c4-2bcf-41b6-809b-c72ba6d9c809", "comment": "Malware payload (AgentTesla)", "value": "0a0026a1f46e798798df00e995e2209cbd79ac5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986523, "uuid": "ae9ab365-48bd-4879-903d-8b7bfef0128c", "comment": "Malware payload (AgentTesla)", "value": "a93ebdd00359d08e92a2e6f5135ff11cd6419798547a5c7b6ec2d8f05a868327d15b0bbc8673a8baf51f14a3cec34d96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986523, "uuid": "fd29f399-35cf-4b1a-830e-00e053a664f7", "value": "T1AA64121846244436E5BF5EBF10A993AA57F0AB6731E3BBA74D9821E1632D3DC04D83C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986523, "uuid": "9276e56c-5aa5-46b5-9d21-ce1487b00065", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986523, "uuid": "22e727ae-55a9-43f1-a197-e74659b39d01", "value": "6144:ESgJVA2N2mgTJ0NfG2w4y23EQtKw3OfyMi48yO/DsKP2p0kHaUisxDVZ:t8VzNLgTAyenmRisVKsaUisxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986523, "uuid": "3a3223f2-b55f-4bc7-a208-5121eb03cd52", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986523, "uuid": "da806910-49f5-430b-9415-db1cbdf45cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986523, "uuid": "79e76c5a-d36a-4d91-8160-e66a16bc97bb", "value": "HSBC_PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdeda71-5e78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695958051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695958051, "uuid": "f3d72c90-d282-4713-89fa-861cc99a627a", "comment": "Malware payload (Mirai)", "value": "2bb9bb511c23f679ec90248aa4565404", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695958051, "uuid": "f1511e60-8eb6-4e85-b94c-c3eca12cba93", "comment": "Malware payload (Mirai)", "value": "59c8ef4bdf7ec90864fb97e64064eea9c9ede25f2c6b26e7b0a5cf4c66fbb18a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695958051, "uuid": "af7f7aef-1bfc-45eb-b927-a6bd42681b8b", "comment": "Malware payload (Mirai)", "value": "432042f644f422525d6503c0362a244581ccfd0d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695958051, "uuid": "bb6b0837-4931-4c76-8ed6-a4536acb9c08", "comment": "Malware payload (Mirai)", "value": "ec0d3dce27f0f918267d1635dfbe3f5e4d4b3294cdec35e19e6a6e16cc430596b25091246e3fe6f71dfec5d6c16508eb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695958051, "uuid": "3c8c8ede-ac19-4db8-9f42-9f7d6394ead2", "value": "T157042A45EA404B13C0D627B5FADF42453323AB9497EB73069628ABF43F8679E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695958051, "uuid": "2f13a777-34be-416a-8d78-55dff5911c42", "value": "3072:lZfpQpblLfAVGkoa7EZ+Gkw4DT/6wBjlz2cJsoyM/RH+qIN:lZRMlLfkBoa7EZ+HwkdBRz2+xyM/ReDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695958051, "uuid": "5694c639-3337-4e5a-b144-596eb086d0eb", "value": 179811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695958051, "uuid": "ccb0aa6d-dc9d-4e29-bf18-0956f3b9d671", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695958051, "uuid": "6c3a141f-bfa6-4f62-9e5e-51dce57a4ad2", "value": "vlxx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87a7206-5e67-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695951006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951006, "uuid": "dc5534e9-78fd-4f9a-9635-a994046fff26", "comment": "Malware payload (MysticStealer)", "value": "0ae8f34f62deba05674264b66ec9dc09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951006, "uuid": "601f6958-0ef8-40b9-82b8-68890743cb50", "comment": "Malware payload (MysticStealer)", "value": "5a7b48aaa90c48b2ebb50b1d78877f084d01f4daecb42b744844ffa887eefd5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951006, "uuid": "29dc3e66-de1d-465c-ba39-000d2c90386a", "comment": "Malware payload (MysticStealer)", "value": "83f3cae9e9d29468202ecfc497fc68a58cbc5f3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951006, "uuid": "fa4296af-e835-4621-8f73-761400b4e455", "comment": "Malware payload (MysticStealer)", "value": "d53bc90ad5d679cee046e051a712bc3464dca39746c70c8963f6c4d919148b40e16de93d4c37c903e48b7e0339ecd025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951006, "uuid": "242cf4a8-b809-4528-bb78-12d1403d008c", "value": "T1DC259D1138CD8176EEE320B742ACB726425DE4B70B1666DF46D817EEE7306C17B32686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951006, "uuid": "31a11f64-a85c-4adf-a956-e4cdc0150ebf", "value": "d215e7ae5c8053185b6f0c1eed2c8e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951006, "uuid": "1671bbc9-fb8c-4670-b8f2-4318771adb2f", "value": "12288:X+AAo8YtBYDKzcx9jkmP8bey7/0RDMmZZxnyUuyyuyFEmVHvgKF/9:XOqYDKzcx9jkmPe/knxyLFEmdV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695951006, "uuid": "703eb1a3-9146-4b81-b1e3-198478f2efa2", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695951006, "uuid": "6f23e578-110b-405e-81c4-e4d7f134e74d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951006, "uuid": "62dcd14c-5783-4432-b835-05af65d65f0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39f35d9-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024415, "uuid": "65d8d2ec-d70f-4422-a0ed-23f9d7ce6241", "comment": "Malware payload", "value": "027fa00b3c60e0e37a0331359948336f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024415, "uuid": "88ec1e78-e116-4c03-8a7f-bac6d04ca8ca", "comment": "Malware payload", "value": "5b7e5f5883158442cfd5b8d4335e13c17222b1824eaad0013d4e8e45f4e2b76f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024415, "uuid": "e1253ed0-177c-4feb-ae46-d9bd66a01a40", "comment": "Malware payload", "value": "c4fab21e6e3cfcb79aaf3501fc98ef7a015789ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024415, "uuid": "39ebb83f-5de2-469b-950a-81e9608ae99f", "comment": "Malware payload", "value": "7e21cafd75fb61f1997fd741612e4f643581144f2dd6b452d779efb4fe2571e98ae37ace09cd49224b8d913959623213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024415, "uuid": "ff1cba8f-ba78-4ae7-8283-2a4d3bab2b63", "value": "T10C3423B52E959EE11F3AB9EA880BC4ECEB70907C70A471063BF3551853C647AE9F844D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024415, "uuid": "012d63ee-c5a2-4e5b-a65f-f832c4c1cbae", "value": "6144:pLBup+0W55BsnoqWv8vtNPGqGI4oSalU+Tf4LQN:pLBtLLDv8XPGqGI4oYgUQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024415, "uuid": "7eb5ea95-edf3-4c8b-a5c5-cd39c41bf518", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024415, "uuid": "082f28d6-b990-49db-96e8-0d8bde2f941b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024415, "uuid": "0ff6ae9f-a953-4cf6-917a-9f66dba58dd4", "value": "288334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf234b46-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695990987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990987, "uuid": "45f98fc2-73da-4bff-88ff-0c844be04384", "comment": "Malware payload (Mirai)", "value": "d5be272fc05ccaf52b1618e6d0389caa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990987, "uuid": "eaa29180-562d-4576-aebe-544366e6d942", "comment": "Malware payload (Mirai)", "value": "5b87f2a5bca71c58ba5cea5458ef7d564edd6e318dd5003e59904e7a7246c620", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990987, "uuid": "6fa1ed39-58aa-4c50-8a89-5db4597af6fd", "comment": "Malware payload (Mirai)", "value": "95c4fb9f2733b7178f716327a52239dd08a6ee3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990987, "uuid": "5d4e0181-0236-4ce5-a43b-fa8df5aad0c6", "comment": "Malware payload (Mirai)", "value": "56173a957318e6387b85d8747dd04c80272995b585ddb07a7f96547e3e7320ea66658c6978511f593dd49ca8c43d4aa5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990987, "uuid": "bfc8d470-73ec-4a68-9c35-a677c49979e0", "value": "T109232AD6B801AD7CF94FEABE8017090DB621335461A3072B67B7FDD35C321989E16E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990987, "uuid": "a2aac41b-55f7-4b2a-a9af-7c8f93beeef5", "value": "768:/5exDVARntTtMMe2ImfWGSdBdruXWey6+pp+xJTzAeHc88x:B8DORnz7GmfSzdyXpcp+xJHAe88E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695990987, "uuid": "2bd17018-6a97-43da-b0d8-3072c5f34a81", "value": 47856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695990987, "uuid": "cd427c03-cbbd-45b5-8b9f-324a3a0a3f16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990987, "uuid": "8fb0f8cf-ea36-481c-abb1-005747b1f9e3", "value": "d5be272fc05ccaf52b1618e6d0389caa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9815ff1d-5ee9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696006786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696006786, "uuid": "e4fef5dc-372c-4558-affc-60734ec76670", "comment": "Malware payload (MysticStealer)", "value": "d4bd1f02480be04307350b599ba55625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696006786, "uuid": "dcdfb394-18d4-4a9a-8118-e295bfcaf6f2", "comment": "Malware payload (MysticStealer)", "value": "5ba5b868eef327f8a743a3f89ce7e7a2e79a9d94f22c392327eece0808aa77cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696006786, "uuid": "d7b22361-a0e0-453f-b9ef-de0f82dddb66", "comment": "Malware payload (MysticStealer)", "value": "85c180cf0f103d5047102afaf5049efbab89d8cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696006786, "uuid": "5230a5cf-45a3-4ba3-8ed5-9cae93a3d7cb", "comment": "Malware payload (MysticStealer)", "value": "52228b589d81ee05702e44084d0d72b2385695b0be788a9954356eb82b231f42431796186858641fab960045816b21d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696006786, "uuid": "1ccd247f-1ae2-4fdd-abc3-4acfaa9f4b6c", "value": "T15F74AEE170E1D4B1ED2A257139E4D6B99A3A69312A6468EFD3D42F3C4E20380D7771B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696006786, "uuid": "55289223-e5c5-48d2-ad04-713b9834a37e", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696006786, "uuid": "90132e41-4b1b-42b4-98f5-d86b29a162d2", "value": "6144:JPTeW/s5GqrO5aXnfEGIXWPvZAO9yFy+XhyIZAJi9rzCCo5AXzImhVs0BC+:cmcGqrOk86xahyuD9oAzJDs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696006786, "uuid": "9cc3e300-69f1-41b6-a4d3-ce2c12083905", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696006786, "uuid": "9e6decae-5995-4ae6-a2f6-7e598fb3d093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696006786, "uuid": "951f7f04-293b-402b-977f-a0a0dc3d1ccd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4b0829-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987516, "uuid": "4eff702d-6c78-4081-8b76-3726b88a7d1c", "comment": "Malware payload (Mirai)", "value": "861b7613afe8fcb43cbed4662486fa09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987516, "uuid": "4f28bc06-c332-45b0-b4b2-9535710be3a2", "comment": "Malware payload (Mirai)", "value": "5c10bac0ff6211c9c27c86daf218dfee4d175ac30cf064590c166bbfcf785c5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987516, "uuid": "96930504-e184-4260-85d1-a60792c6fa2b", "comment": "Malware payload (Mirai)", "value": "42a809b0292a82882df2bc708bc3231982f0aea5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987516, "uuid": "9688c0be-3add-44e1-ae6d-0fc3afe4f9c9", "comment": "Malware payload (Mirai)", "value": "7439e470ff059b81470ea30bfb43522a7002f0ca35ec4e8f26aa73fed7fe7a89f067cb0a4868b78e93f5bf2e1534f613", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987516, "uuid": "a203ef95-6334-4f9f-81e4-c80d4fdeddc0", "value": "T19D535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987516, "uuid": "43c3def4-ca1e-4eb4-9e91-9e103d90b0d6", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8x:N1GjR8EVGO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987516, "uuid": "77015f9f-3a0d-4d01-b4a4-9ebfe573ae9f", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987516, "uuid": "5e91d923-88da-4673-ac61-0bde99c21509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987516, "uuid": "d953d3cb-3222-4a44-a75d-8f50750127c3", "value": "861b7613afe8fcb43cbed4662486fa09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9220bb4b-5ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695978859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978859, "uuid": "4e0a30ae-de95-47ca-aaf0-17dfb21604a6", "comment": "Malware payload (AgentTesla)", "value": "7cc38f04f594e4f73f26293e0fe74653", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978859, "uuid": "b1ad184f-6fac-486c-9a91-9e88782d2b60", "comment": "Malware payload (AgentTesla)", "value": "5c2d15ac4493f51fc7a98201b6fa167689215d8b6878f9983a3022c89e38cdda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978859, "uuid": "6edfd2ef-69e2-45fb-96ca-cf096eae6809", "comment": "Malware payload (AgentTesla)", "value": "22c0ac89a2869d99c2b5ae566afaae7f9de82089", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978859, "uuid": "936629e5-f0a1-496b-aa35-0438a09cd321", "comment": "Malware payload (AgentTesla)", "value": "3f7097f8d4fb8eff18489e958706fc60ed97c0bed757a39517bd1af6e5621d15a2f1232928412f6a256a710a1078c0d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978859, "uuid": "8123e144-98ac-4601-98a3-64b9201a8a58", "value": "T18CD423EDFA468352C48CA3B9069D535703B1F96AE420E36CC88726DB1D7EB444663F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978859, "uuid": "189189c1-f881-4637-8d83-1d1cd3fa2936", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978859, "uuid": "9f8880a0-f0eb-49fa-8ff2-4c8c4a1229fb", "value": "12288:jh725t+IAAgki7ah+h0itjdKgZUkkG63shrgnqDatz:kHAAg57ah00itBKgZS3GrCqmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978859, "uuid": "414e0dc5-0502-4141-80a1-fd38322b2d06", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978859, "uuid": "ba453d46-e113-40fb-8219-ee0f3a06e1f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978859, "uuid": "61eb4f3d-3a4a-40dd-a663-2bc3f21d05ff", "value": "swift talimatinin isleme 25-09-2023,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b83201-5f21-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696030841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030841, "uuid": "aac05e6f-860f-4a08-8649-88f272862dd7", "comment": "Malware payload (Amadey)", "value": "f778e45798fced808f59586f5b2fd318", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030841, "uuid": "23f6988b-f2f0-4496-b175-edb49cc94fcc", "comment": "Malware payload (Amadey)", "value": "5c30d6858f3c17f6007ba87a11b0fc948ecebd18394d704dd7c282fea9686e0d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030841, "uuid": "103a0005-1702-4859-b510-333f411a8320", "comment": "Malware payload (Amadey)", "value": "b1f8326164d70ed9ec38a13486e7ef6046e83585", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030841, "uuid": "593f9c37-aaeb-426d-9fbd-6853534a0346", "comment": "Malware payload (Amadey)", "value": "9a56e86d57d2294b67fe3f05054369c88b412c4098225f6d629afa8fe1aaf881e1b11cdc1c95f33291f6235414748e46", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030841, "uuid": "ef59f3e1-76ea-4ccd-b3ef-0b75baa1cfb0", "value": "T1DD352343ABD18A33C5B5973408FE139B1F733CB66DB459277698EC0A48B3558A836336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030841, "uuid": "50ba88cc-5337-418c-ae3c-985dc8ec39e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030841, "uuid": "ef49a6ab-dfc8-486f-971f-12c990c56858", "value": "24576:ryNHc+hT7YZkFnMju5N18ZuuHwbHUDk5FJoA58:e+87dFnvfeeHUI/GA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696030841, "uuid": "0ea5154e-ec9d-43ed-ad48-8b3e18642f91", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696030841, "uuid": "94c4d8c2-b0b0-4be0-9561-7f44bdb171b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030841, "uuid": "d687d437-4d72-4c7c-a7a4-14730315491d", "value": "f778e45798fced808f59586f5b2fd318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d4b15a-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695986625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986625, "uuid": "eae158ff-b814-41c9-ad19-d440db38b985", "comment": "Malware payload", "value": "dc6d3ed65a4322a6be8ac881eba0a3ab", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986625, "uuid": "48ba58d5-c1d9-4a97-86d7-0fc776f720d6", "comment": "Malware payload", "value": "5ca125227add1eef231bf896d61a10fe6bf35fa4a3b3767f87f53d4792fead15", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986625, "uuid": "0303a07a-5d1e-48dd-b586-4fed5e970458", "comment": "Malware payload", "value": "4d429533504a996c8e3efabc80659bc74bf1faaa", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986625, "uuid": "34880d6e-2877-4927-baff-43f6e6644442", "comment": "Malware payload", "value": "e6c45dc53b048dffd9f91e3d99db8d9392f2bd1a2f705afee6b725edb8be1222b15a1ad03e3901e2c601aa8636795049", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986625, "uuid": "af2f617d-6a65-4ae3-b399-b1b66fcaaeb1", "value": "T158410C1026CBA36AE3F24D3A84BAA3758D77B867E075831D01808C8CA558200ECB4F35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986625, "uuid": "ba42d545-b7c4-4faf-a6db-e0b1eaca3deb", "value": "24:8a/dWJCnzcaoA8vkA+/C1ET/nnGgo+yXWwEi85JP+vG:8aDD0vET/nnG9+ymwIP+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986625, "uuid": "22b65350-46e9-496c-b429-f6b75821fba5", "value": 2134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986625, "uuid": "a264b3fe-04ed-4162-a382-196ada8a8481", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986625, "uuid": "36db1dbb-6044-4f27-b687-9c45e1fd3534", "value": "GQJ.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a0f14f-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986564, "uuid": "7361170f-6cdf-49a9-bfa8-ae55889859c5", "comment": "Malware payload (AgentTesla)", "value": "c6c1f5550ba032ce8cc907426b461b8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986564, "uuid": "f451ef6a-d9b8-4730-ac35-1adb92494901", "comment": "Malware payload (AgentTesla)", "value": "5cc9ded0f8036c49d0b4f6af841953e7739429f1b8f7ff813b7db07abe287cf0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986564, "uuid": "905c9865-e296-4041-8201-2e31f5adb7d3", "comment": "Malware payload (AgentTesla)", "value": "8c7eda47bfa5d8480b47ab385a70bbd833f6a737", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986564, "uuid": "57a38381-60e8-4105-9c96-654611a02e76", "comment": "Malware payload (AgentTesla)", "value": "afc83a6c7036548dc689362a4fa9dc1d22fb1638d5fbf0c98e6bbf1daa304ad689714fa53779839d1831570fd312a844", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986564, "uuid": "62c2420c-a091-4039-a0d0-bcc25317ddef", "value": "T138D43311F47C22CE9F2578B6ECE91C7A75E035E4E0322DA7DA389F6536A450BC1C982C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986564, "uuid": "fc67a6ca-6f66-46ee-9f7c-c14f96b78e93", "value": "12288:9T3n6NxPOKPseA11mBQCmpAjpww+WjQ/85/+p/q4DR:9T36N8kA1U1uw+1Ecqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986564, "uuid": "2b1bde1b-be7d-497a-bce3-69e95649289d", "value": 635125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986564, "uuid": "4134515e-0063-4b28-b7fc-3166b9ae851a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986564, "uuid": "12c93a08-deeb-48fd-86b6-19e0ec0fbc71", "value": "NEW QUOTAIONS.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c497ce6e-5f22-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696031342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696031342, "uuid": "00a9153f-a47d-420a-8639-af59d4cc42fa", "comment": "Malware payload", "value": "1fb6590ffcdc704552cf24318a640fff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696031342, "uuid": "b53d12b9-4285-448c-8d3d-b3538696bc6f", "comment": "Malware payload", "value": "5d4111d129f9502329b4da06459f6bfbc4c55a9bd033d8cd4566cb4018887162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696031342, "uuid": "ccc4b396-ac72-4a30-97f7-69df9dc60a79", "comment": "Malware payload", "value": "1a1c9dfe7bb2c8cd187b5fb66a8fceefbc1f724b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696031342, "uuid": "89d89413-53b6-4711-b90c-a95175187d44", "comment": "Malware payload", "value": "7e040128bdb8729627558c67165f9b90cfdf9c95cb6a7952e1a148e8319f4683f69207dc0972dbf786079215f786f5ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696031342, "uuid": "a72193d9-5e46-47d3-85f7-b09656bcb7db", "value": "T1A6B533513AF8D5F5E0130178CFA4E3F5E4F2C31A0F242957AF149D8D6AB84D6C22E69A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696031342, "uuid": "3c6b4965-9859-49af-8bf1-0fd8ba423a46", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696031342, "uuid": "a4687143-5ba2-4442-8024-77840506e7da", "value": "49152:WfRn+UB5b0HHgrYTtSkFk56FtbwYeueJKtws1X0ruU:Wh5uHA4k4NeJKtwsZ0r3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696031342, "uuid": "091f88d5-c64a-43e4-88f1-3a13b781a376", "value": 2324626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696031342, "uuid": "1fac30b4-4b44-4c91-94a9-fb505afd31b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696031342, "uuid": "d74853a0-321a-463e-a8c3-327bc451611e", "value": "SecuriteInfo.com.W32.Kryptik.KSH.gen.Eldorado.7877.27231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2152919-5ee5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696005219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005219, "uuid": "45e7fbab-8651-4576-8c82-748780f3a2a3", "comment": "Malware payload (Mirai)", "value": "968986831e144de8becdf282c18b8b4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005219, "uuid": "f917809c-331f-47e8-8cc4-f381b3b76df2", "comment": "Malware payload (Mirai)", "value": "5ee55bd23031703841beeae50f6cecfae4b942a1ec1821ebb28abff16cd13656", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005219, "uuid": "56000522-09e3-4601-b7c3-3f49f179600e", "comment": "Malware payload (Mirai)", "value": "26635bcec5ead8691a0e10a91bd0bd452e20044d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005219, "uuid": "3543bad7-8a0a-4071-a609-c505c9d1fd0e", "comment": "Malware payload (Mirai)", "value": "cd02c2c625f83ff9a7958cf45180b2030770413db1b7ea19a3096e193b98273ba2e1ee72a2d0bbc13c300f6578dd761e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005219, "uuid": "6f35d358-0124-4046-9297-30a6be41e35a", "value": "T15BC2D0E0B726F931C420AC3DE52B4D8A3A51067C91FE383764158D398FC165B66B84B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005219, "uuid": "fca20b94-476a-41ba-810c-bef127848a15", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwr04O9q3UELuD:OKy4qfqoeJdXWgTzLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696005219, "uuid": "3e73cc68-739d-402c-a1dd-1159399678a6", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696005219, "uuid": "3f8778e4-a432-4466-b9bb-bd80133cdd4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005219, "uuid": "84080f8b-d24d-4a3f-877c-d90e3a3b492b", "value": "968986831e144de8becdf282c18b8b4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0ede20-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024318, "uuid": "30a68fbe-5255-4ba5-af66-6d982db24c54", "comment": "Malware payload", "value": "06f27798678cf08fe088d05c1040a3e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024318, "uuid": "1414f24c-f15c-44e5-b2d7-6315c00301a0", "comment": "Malware payload", "value": "5ef9f0e89e2dd52d9a47d98ca943f3496f8e502b2def04601ed568113f55969b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024318, "uuid": "c1bae270-84c1-4fd7-8ba7-24b78eac38dc", "comment": "Malware payload", "value": "8f75820c9d8c1fc0dfd1f8eda03f62c7cede4f48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024318, "uuid": "97f96ea7-5cb8-4c13-9103-a167469ceb51", "comment": "Malware payload", "value": "8d4b66f0f2dc7bfaddd85ad1bc3876b778629234bfa38f8f019dc5f8c7ee24396f64e22b473c5090e76ffff865f81d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024318, "uuid": "0a2b17b8-fb01-46d3-88bb-a2e26468a879", "value": "T1C2342212CC868C895E37CF9A509FC117D6B5B1C205283D392E5EEEF69FC6D1E251484E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024318, "uuid": "53676b8b-02f8-4946-aeb0-56fb40b9387b", "value": "6144:tOqmkSEOAehTwE8qnKpTwYYiX2V92hBZ+LW32tbRGY:YxQ1eiqNYtmV0ZgW3K9GY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024318, "uuid": "e74182b3-fe14-4bec-9e62-547824c2f8ba", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024318, "uuid": "91315555-6432-4051-aa7c-cf330d646aeb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024318, "uuid": "3898c200-be3f-4c26-971f-9f1e21ee9fde", "value": "288323.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3518e5-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987174, "uuid": "992a57d9-94cf-48b8-8fdb-58354838f87c", "comment": "Malware payload (AgentTesla)", "value": "348ccc28bb8c5ccadf1ad4857108d350", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987174, "uuid": "a868def9-c8cc-4dc9-b322-afc4cdfb4181", "comment": "Malware payload (AgentTesla)", "value": "5f40cdee2712cc21e0f0f35983524f8b1e94cf29e666e1039deac3f5ec9cf3e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987174, "uuid": "a7c888bb-0738-4cc6-af57-826cc2a5c8a0", "comment": "Malware payload (AgentTesla)", "value": "8aeddcc3dda3c303aa3222147ca1e194660ceae5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987174, "uuid": "6f752f24-f551-48c2-b815-05194bebc28f", "comment": "Malware payload (AgentTesla)", "value": "7bf8f9c02c5711f0347b9bbd1f61ae1cee3ac80251d55837066de00afbf843889f669a5c70a8f8faa49d963680f56e36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987174, "uuid": "28f1dfa4-101b-43a9-a625-1e35d9e5a373", "value": "T1A8F402066BA51281F5BB67345AB2013153F3BA05CA39CF6D48CC50CC5BFB690FA94BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987174, "uuid": "2935a331-3582-4a70-baa3-6b932a1a4b07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987174, "uuid": "526019c8-c7a8-491c-9e75-4f279d9815ad", "value": "12288:bctAckjlV6x2xjvct/gIoxrbLY3DGkPhAmszwzYZTvrPPTvDLiw/9g:OkWQBigIocDGkizwMZbjTvDLiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987174, "uuid": "4a05d40b-1480-47e3-9ef1-e195f5994d7b", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987174, "uuid": "840416f6-30cc-4e8b-8acc-976d7781d129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987174, "uuid": "c09860b2-4042-4ea1-a0b4-52c676fe2d06", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0324ad3b-5ed6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1695998376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998376, "uuid": "c951577c-0bdb-4d00-9f4e-6a63681c7f81", "comment": "Malware payload (Amadey)", "value": "e263460398df2a57127c9081d61c3459", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998376, "uuid": "3c1e4e66-022a-47cf-8a66-de270dcf014c", "comment": "Malware payload (Amadey)", "value": "5f7cb41fa610ede3759b974c250e79f89a9046a9814b4c2d867272e58b830c0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998376, "uuid": "88016dd7-c37d-4bfd-b3c7-7834f0bee3a0", "comment": "Malware payload (Amadey)", "value": "9747d0d5a0c1239774338398893ba4c610b6a06b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998376, "uuid": "d16ae95e-a178-4a77-9609-4e3d3d43908b", "comment": "Malware payload (Amadey)", "value": "454a71c279fed518d4653e2923dcefce2a23c75eec05a010d83eb7cab3071163e586687a19d4d57b747b12e695144847", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998376, "uuid": "ae6ad1c2-34e0-4461-a9f2-4934da2b630e", "value": "T12C34AF11B4E2C072DC7325360AE4EBB95A3EB93009A55EAF67E40F7E4F30281D631667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998376, "uuid": "945a357d-9425-4ee5-a432-4b25ef2663e4", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998376, "uuid": "7fe64f5e-222f-4161-997e-cdedf7d4718a", "value": "6144:b8z4SHy5uoBMFGV5PEkIXEHvZAOjBYozSVs0BC+:bCmuoBMUOMxtBRzqs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695998376, "uuid": "c168524a-cccd-4014-953e-516f54b4680b", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695998376, "uuid": "bd39d68a-c64b-4b7d-80c3-ad03efe56a03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998376, "uuid": "979fb1ca-03da-40a4-9a60-99df6a5058d6", "value": "e263460398df2a57127c9081d61c3459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d10e9d-5eca-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695993300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993300, "uuid": "c7eb311f-0fce-4fd8-8605-abc59b4ed8ac", "comment": "Malware payload", "value": "3f5a5f754dc402795e96785e256a6013", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993300, "uuid": "bcf17f2c-43a6-470f-83af-23502d97b711", "comment": "Malware payload", "value": "5fa769cb3b37b716219d709edb9912239bc6bc023b41d506d47db4e66fbbbeab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993300, "uuid": "55469329-a9e4-4e8a-b0ec-740bb7429a5c", "comment": "Malware payload", "value": "817add1043ba3f0e8d167c9557c5ca13b7ec762f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993300, "uuid": "b77e6396-aee1-4b4f-b0ea-562152437a8e", "comment": "Malware payload", "value": "61d0a4ba3cef2fb789b791a09b186adcf48d517d6ce16f8daa3915754f02a4fd85c61a4afe01bf3efb1de79836902d2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993300, "uuid": "21e394fd-b50b-4fd9-8413-28ae3e036461", "value": "T1BCF33A07B5C188FDC4D9C1744BAEB93AD971F09D1138B26F27D4AF262E8DE205E1EA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993300, "uuid": "7704d591-5b51-44b3-9e0a-e9b23dcad83c", "value": "3072:2wsAK0x4TViGPRu0wU8oxg8l6jwRhKen221ZG6DWGSosF60VGVkj29xtP:2wsAK0x4TViGPRu0igNhjlDxSo1k2Dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695993300, "uuid": "c642e5b4-842d-44bb-adf0-0c7dd1ef3457", "value": 159896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695993300, "uuid": "f0bd0d55-2b7f-451e-bd6f-61890d71de1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993300, "uuid": "162f25f0-3269-44f1-b574-9211dfd7ea09", "value": "hydro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d294dc-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987190, "uuid": "75fb1ffc-63ee-4f5c-b07f-a3c4085ac0f9", "comment": "Malware payload (AgentTesla)", "value": "44abd1f0c74471d61528aaf0bcdfe7ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987190, "uuid": "4e3919fe-f8b8-40cf-8597-8c385505cea6", "comment": "Malware payload (AgentTesla)", "value": "60751e1f86b4b78e592917168a731a30b464a6c52b59118490ac8411905cbcc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987190, "uuid": "798886bf-bc22-4bca-9a07-9748c42839b5", "comment": "Malware payload (AgentTesla)", "value": "e05ba2523bdcbf9fc6753b6ecc7996ed1b5d19df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987190, "uuid": "7d9a32b5-40a2-4718-874e-03ea080631ee", "comment": "Malware payload (AgentTesla)", "value": "479bb084b90d013f0dfbcb10534269fe3a99be06771f394338c790c4bf7289cb18fdab80262971cfb35e3b76e895293f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987190, "uuid": "7054cab5-9c14-4ecd-9ce5-f8f553b4cd75", "value": "T167E412C0A30E45BFF56889BF91D5A45483F88272D952E34D4DD8C1F836CA7E2980AED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987190, "uuid": "7d109e2b-469e-4e88-ad68-ae2997c78024", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987190, "uuid": "60318965-9da5-4945-8bea-2acef602b2ba", "value": "12288:CI1xIo03/sYe3FAckjc6ssEBfFD0sxwHVOWee99zKYhGvOHH8gg26N/SbSQvdSDz:lkA6dEhFgP1Oq9zXrcgg4SQvdgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987190, "uuid": "bf1ac946-b42c-4e9f-a338-66e0017bfa46", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987190, "uuid": "a0e23601-43bd-431e-940e-c814c39be020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987190, "uuid": "261b5164-4f13-4f39-9dc7-e16665e2413c", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e367725-5f10-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696023386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023386, "uuid": "494ff515-c8ef-44c6-a71e-fa7b0b9a4563", "comment": "Malware payload", "value": "c02c6c85243a18ee4d0329d39699bbd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023386, "uuid": "6fde8e58-e8a9-40af-a148-0fb6e30911c1", "comment": "Malware payload", "value": "60fbe83dd96e96d721ea189d1b9fd07d5c9fa8505f6a4744cf0abd6e65954dba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023386, "uuid": "319f7278-7d75-4436-9ebc-cb2af1f87f85", "comment": "Malware payload", "value": "f8dc3d03399e283b45b2d33285f54b028f847d15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023386, "uuid": "d44c1d71-3a78-4695-92a0-8a07d0574678", "comment": "Malware payload", "value": "1d35e5c47258e4e695afdc08f38cc2c121cb4f2487c3fde824e0b2483ada2227406c1fc1c1d42a8423713ffde2d9dcff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023386, "uuid": "ec035051-cb79-4c5c-a496-e824b6439d63", "value": "T1B6F423C4350BC0EE19E415BAB7F391A9D65FD4CFA4B8B3818A2B1AC5D7FFD01180A685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023386, "uuid": "ac46865b-7794-41b4-8bc3-1cf46714811b", "value": "12288:bRZaCPdUj/BLEiyqUcPUl1HbCrs1lt+ecbXZ4RUEBgtG1ZXfoM1jpHZNmp5ufNz:tZraLEiy48LHbq4RUE2mfPZYruF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696023386, "uuid": "72259e57-4315-4fbe-92b1-e98dd06ad6a8", "value": 733248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696023386, "uuid": "1cf9061f-9a6d-4556-b295-d5241eed49ba", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023386, "uuid": "19eb639b-0317-4cfb-bc69-f837b17ed944", "value": "@03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa0c1f3-5e8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695966606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966606, "uuid": "fb2e68ae-1a3c-40b0-be64-cbc0db5efda6", "comment": "Malware payload (Gafgyt)", "value": "dbe1b47a23fb7348b079eba0be4372c7", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966606, "uuid": "b4c70c11-55fc-47f6-a54f-ccdb3bf25dfe", "comment": "Malware payload (Gafgyt)", "value": "61f1a0fd0d0fe86e00834259900234c08a92574de7d1f5dae5bb0c796f94c5c0", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966606, "uuid": "9a8455ba-fc33-41c5-9c60-9b6a1f65a172", "comment": "Malware payload (Gafgyt)", "value": "df0d69356144d5ab592f9dde521994896308aa86", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966606, "uuid": "8b73cb66-ac1a-4f98-b59c-8b065b1d36e9", "comment": "Malware payload (Gafgyt)", "value": "be03222101d971fe106698ebd042a0776990d10e1dd4986ff1db7ce880319b7b573150cbcfc454031192ec7d383bd2af", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966606, "uuid": "31af66e5-9dee-432d-86f5-423416ce62a8", "value": "T124041D0E6661CEBBE85E8DBF03D9412110CC9D4A069DAB6B73B0E61DE79F48B81C7D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966606, "uuid": "7a420a6a-5bd7-4170-84e1-815648a3e56b", "value": "1536:EJEOLeTs8Xi1cxWOzFylZaSkneEWYEl+eOshQ8nMUkAmn2D4qWwzsqqj:ELMFEomheshQ8nSAmne4qWwzsqqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695966606, "uuid": "b577b1bc-7ebc-477e-96be-66d4717e0308", "value": 174385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695966606, "uuid": "799586a3-ac2a-42a5-8c9c-d46b286e5d08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966606, "uuid": "ccded328-10e7-4bd4-927c-8c9ebf7cf4c9", "value": "mpl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6e865f-5eea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696007384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007384, "uuid": "3ff69abd-1be9-4621-a5b7-c92f057c12f1", "comment": "Malware payload", "value": "98dcccfa8845f10b2bbb9f38b82f097d", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007384, "uuid": "f9e5c657-0fcd-4f72-b6c0-cd892a34ee51", "comment": "Malware payload", "value": "62568df781e2e4d059a10650ff715c84e12964db759a1f74970681b445a1eb30", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007384, "uuid": "b53f3dca-e632-4855-b753-e81234830a94", "comment": "Malware payload", "value": "d7f2c18744dbb74996479c86387be16ac86a33a9", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007384, "uuid": "f2b2a454-4087-4eb1-b89b-343b53845f1a", "comment": "Malware payload", "value": "b35144286aee700ddc7f9b5f120e9b65337fb87176aa2a2039557a552f5b56af9f91307d2c440e786e7b5adb87303054", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007384, "uuid": "76771a6b-9f6f-419c-b4cd-91044a8a15ef", "value": "T1ADE6336C2136B720CD57D3F5B29B95C5419E912163B608F8BF8A7A2E89BFCE4002F751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007384, "uuid": "bb5da453-1ed8-42f1-adad-06dbb5713834", "value": "393216:Fu9Ke/qT20DfQxWfUNZzrfH7sd5fU4fUdziMPlV1hs:I/4fQxkULAM4fU0km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696007384, "uuid": "b93b306d-0ffa-4aef-b1fa-c65655d9c9bf", "value": 15110785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696007384, "uuid": "1aefcb26-2061-4bab-b028-d22beb9ed092", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007384, "uuid": "d3180417-1c13-4ae7-9388-271b27d3a484", "value": "Chr\u043em\u0435S\u0435tu\u0440.appx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e918f8d8-5ee5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696005204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005204, "uuid": "6e1ac749-556f-4993-828d-f1b9ab53bbbe", "comment": "Malware payload (Mirai)", "value": "af2ea581dae8277a5c9374e4a549e155", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005204, "uuid": "e7901710-be46-47d0-b686-f35507d576bf", "comment": "Malware payload (Mirai)", "value": "62ccf3d3ffce460b04d86e3005a952a0bda44634a2aa9e4a94ba95834962cf23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005204, "uuid": "a19c86a2-63c3-40ef-80cc-f69bec5b9240", "comment": "Malware payload (Mirai)", "value": "fb4f182b39cc2888148e0d4faaf819c85a7123f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005204, "uuid": "de8db171-6b5e-4fc1-a4b6-b3f47ca75f79", "comment": "Malware payload (Mirai)", "value": "69301e675169235df6d6f9892145850abe44edf2de3abc4590515d683a66c7b674f89b6a61169ccab85dae66254822e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005204, "uuid": "c49a7977-f6c9-4a2a-aa81-139d18de2ab4", "value": "T12833FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005204, "uuid": "0de7203f-3eed-45c2-95b3-69ff672c456e", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGj:r/hqaJMcjeqK806MHdMfQXoHuCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696005204, "uuid": "efc22691-0b87-40b2-a572-9be7056d44cf", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696005204, "uuid": "7d38a37e-a2e1-4ed7-9264-11d1d97e4d22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005204, "uuid": "1a4294fc-781f-4476-bf01-3201c948ebbb", "value": "af2ea581dae8277a5c9374e4a549e155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc261a7-5ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695978902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978902, "uuid": "c63e7178-26c3-4d4c-ae01-8b78da59d91f", "comment": "Malware payload (AgentTesla)", "value": "bf1b297357e3d9320e0d08c9bd2cbf22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978902, "uuid": "e073e6d3-9ff9-45bf-aaf8-bc762ebd1aa5", "comment": "Malware payload (AgentTesla)", "value": "632fe84dfca150a891d9aa68ba0fb7c8c1230879a05bb6ac1dc4d0538133b417", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978902, "uuid": "b959793a-4fd4-4a13-ad75-a490d9a5fee9", "comment": "Malware payload (AgentTesla)", "value": "a7ea45c00e701298092e22d1b0dd988bdf22e671", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978902, "uuid": "1232d904-62c5-4c88-8de8-ef57230c659c", "comment": "Malware payload (AgentTesla)", "value": "a83f55e85cd08903c1d445253d342a072e85d2758ec0f13ee5e0eb2d8a07e0f491c0fd9b021471f753b22c1e0d7921f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978902, "uuid": "c1617424-c441-4e12-8dd6-be390bacd84c", "value": "T12AD4239D78968760CCDC073A056D3A176374B126E020F3798FDE5AEB8E323595522FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978902, "uuid": "7d3d247d-1b91-40c9-8700-66838cdd3bb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978902, "uuid": "4c2ff2ea-0123-4823-83ee-da98af78aea2", "value": "12288:Md725tF3ivQL8+XKP0OrpGt2DQ8mvfdJ9DLAgm0XgOd/vLHh9:ZrFi1KKMOGv8mvlLAgKsB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978902, "uuid": "60808f9d-449c-44e1-87ba-861649d2208d", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978902, "uuid": "369e6c52-d621-4f6b-b38a-2aeab913b662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978902, "uuid": "4e661a76-33f4-43ae-a93a-5fd89e768310", "value": "Product_Inquiry.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42520c98-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024252, "uuid": "7a9d851b-fcde-4721-b6f6-85c7eb88f549", "comment": "Malware payload", "value": "c99fa9ae5a6b9a973f51a7efd0c9b453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024252, "uuid": "337e8384-4141-4e78-924e-91339ddbaccc", "comment": "Malware payload", "value": "633ea021b916ccd964569626d53a854b536e77e26aba0d388a91d42793d4ad88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024252, "uuid": "d1384336-4480-43bb-8029-e03926336ce6", "comment": "Malware payload", "value": "6a73ef7559126bb2617daca4ca6a7e2d72cbfa3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024252, "uuid": "c74bd27a-7664-4ee9-85ae-9d2b1f52f21a", "comment": "Malware payload", "value": "53c915c829f0d9ec5191d2d3c54e1d2125fbc665ed644f08e885efe21897f83430d0958f7e4fc1133cc0033ef16d2c00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024252, "uuid": "e8fc93b3-89ca-4d85-91df-c7551335f741", "value": "T1093423670CF96D64B07FAD5A74C45E390A1DABF90BD2033B4BA200A91AF1C7959C49F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024252, "uuid": "7bdf2682-aa8f-4db8-9a0b-7fee8731f864", "value": "6144:gfYpjxgRJla6F+yEQI5YWil3KSq8HeRxTTjaSOX6VoXS:gAp30SH9ao8axTvaSOX6OC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024252, "uuid": "00d2c3d7-05cf-4581-b60b-484bed18cda9", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024252, "uuid": "b4d71a43-3f40-47e5-9fe5-1019c75e0ddc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024252, "uuid": "db39d000-f946-46fb-b029-e4d8038e4885", "value": "288314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f89be76-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695986988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986988, "uuid": "4a9b9d1d-d26f-48f4-83cc-5c594cff91a2", "comment": "Malware payload (Smoke Loader)", "value": "5dfcc9416ebb857aac381ec33035bb31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986988, "uuid": "a55812c1-a9ff-4841-9f5e-1c7a4d648d45", "comment": "Malware payload (Smoke Loader)", "value": "634121b7349c0b191a9f3c581e4811ba888ce556f8f8658308170f32ca7c1761", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986988, "uuid": "12befefd-e445-433e-9fda-6eb6ef419096", "comment": "Malware payload (Smoke Loader)", "value": "eb2f9e454576aee50b1a8eb178c4953a4185bda7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986988, "uuid": "4bbe8566-1cae-4c61-9fee-96df5efb1b1f", "comment": "Malware payload (Smoke Loader)", "value": "bd73704aed51a7215ca324cbe120c45d0db9cbb8754ae5127830e4625737d46bed436f16c31e2bb36572f441b8b26375", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986988, "uuid": "954867e7-79f7-44db-9e27-fc01c1f2b473", "value": "T12A349D02E1E2BC60D967463A8E2EC6E4763FB5719E59E76733141B6F08F02B2D263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986988, "uuid": "3a693a1e-cf9d-4d90-b171-8f59e174d0db", "value": "2a568f33595a0107732fea57be00f8ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986988, "uuid": "3bebba5f-87f0-43aa-83d0-f9860ff1f376", "value": "3072:0Xr3qMzgBPvqbfjbAej955zlPc7WAuubo28IuF85WSahpDz1TKsktn:wGFqLjB5xkBuA8IcfpDhTcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986988, "uuid": "f0611d2e-2035-4469-91ab-5c6bc80faae8", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986988, "uuid": "2842977d-e126-4dad-a5ed-658ff05214e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986988, "uuid": "67529f75-0b78-4df9-9c0d-8d4499d7bc04", "value": "5dfcc9416ebb857aac381ec33035bb31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537326fe-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987344, "uuid": "e6dc79aa-6e89-4d22-b43d-98061113f30b", "comment": "Malware payload (AgentTesla)", "value": "b4de5fc46cd12ce94031974b006f4213", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987344, "uuid": "2c9d191c-88fa-469a-91b6-8f42bd2322ed", "comment": "Malware payload (AgentTesla)", "value": "63ad94d4ee50e7edb7ca2125ea488538068aacd4d572be22fa140addf11631e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987344, "uuid": "9c03f74f-8995-4f8b-b306-3530488d1a0a", "comment": "Malware payload (AgentTesla)", "value": "c33544c1f436191218274a8cb889ffcc4d6cf8c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987344, "uuid": "e5c90135-7da2-47db-8836-e6e6f480ba0a", "comment": "Malware payload (AgentTesla)", "value": "acebb4210dff491e9181f7fbae7ce8520b316517c085036e74fce9fa87a2740a1a30478e315d2fccab8d672ad9260f04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987344, "uuid": "dfa904b4-5e18-4a77-ad65-5ba1d67217c9", "value": "T137F402026BC90181F5BA267989B5013247B77A62D939DF2C0DCC609D1FFB390BA51FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987344, "uuid": "138f64bd-a314-499e-9070-28ddd5c2a8ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987344, "uuid": "44530cd3-a8ae-4a10-aea9-92c709849d30", "value": "12288:2c5AckjQeKF6ST1yTEoSA/RFt/5kSIW9AKKWjIy6+87jYy:dkEeM6CyTEPAzt/2SIQrLIy6zP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987344, "uuid": "4784f814-cb7a-4008-b98d-e4cdc2f0bad9", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987344, "uuid": "237873e3-f7ec-4fa9-9093-a4b0afe8a227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987344, "uuid": "8564bb7a-96ee-44f5-b02f-ee9b0a4f1dd2", "value": "b4de5fc46cd12ce94031974b006f4213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e72db1-5eb9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695985922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695985922, "uuid": "b52837c8-9c0f-4d6c-b21a-fcf6ea1ad6ab", "comment": "Malware payload (RedLineStealer)", "value": "8efcc58e8465df3114695f8b7a5cc500", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695985922, "uuid": "ac474ed7-b920-4268-980c-2ad4efa0ee25", "comment": "Malware payload (RedLineStealer)", "value": "63b03fe163219157f841478f39ffbe45b4abcf1e6b9069753a2e75779d3714e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695985922, "uuid": "d834d535-7cbe-422b-b8c6-d07de9881a05", "comment": "Malware payload (RedLineStealer)", "value": "fb0ca2377e3d39fdf0248544289bd0f90ddcf394", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695985922, "uuid": "4249dd09-fd9c-4f39-8030-af079b189717", "comment": "Malware payload (RedLineStealer)", "value": "dceb8e2eed649e3161c6df18d1a11b0a707ce6a06e16f6c1cf600a71fbe0c30f0435019f56c8a116409864163b84da9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695985922, "uuid": "e4db9bbf-575e-48ff-9b89-6caebbdf8a8c", "value": "T15984E11266D1BC21EA664A358E2EDBE4773FF5718D2567A733385E2F08701B2D2A3701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695985922, "uuid": "44d5f578-8352-4412-9a69-492b9c0f130a", "value": "2a568f33595a0107732fea57be00f8ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695985922, "uuid": "d73661dc-bffd-4e44-8117-8d45cb5c937d", "value": "12288:FFz/C7YvM4UGKMjBtfUUem58z8gO03DF:FFz/6YvTUj8ts458z8gOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695985922, "uuid": "445e4bed-65b8-4e99-8fba-8877864a497e", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695985922, "uuid": "16fae84d-813d-4076-91e6-fa68a102aa27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695985922, "uuid": "7793bc79-ae3e-460b-901e-44ab30dcffe5", "value": "8efcc58e8465df3114695f8b7a5cc500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26eb63e-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PureCrypter)", "timestamp": 1695977732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977732, "uuid": "75b62560-8319-4eb9-84c0-8e3a3e5c18e8", "comment": "Malware payload (PureCrypter)", "value": "aca05011fd930d7b5722fcfa9c2fa04c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977732, "uuid": "e6e06a17-4609-45e5-8fba-8d67f8cd3c2f", "comment": "Malware payload (PureCrypter)", "value": "642a8d7b24f5c7726e96fdda14c3499f485cfc6e8110f888211890e21a3b20ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977732, "uuid": "d7340016-c350-423e-a7e7-3eb1861b1a30", "comment": "Malware payload (PureCrypter)", "value": "79eeea36e0578531fff48a1a5b11fbe3eae704de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977732, "uuid": "d8c35997-fe97-4a58-a76d-ec9e1734948b", "comment": "Malware payload (PureCrypter)", "value": "e4f0861ebd09df8706f50578a013d5e7e311aa6ee3f69d628407489ea2b2c843133444636113f61f81b528c9fcffc190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977732, "uuid": "d20b3f3f-02a0-408e-89e9-89d444f3f32b", "value": "T10FD2A50A571DC932E862B5B48C5B16F2673CE932EA627B6B4FF0BD552CB12CD08E1570", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977732, "uuid": "23fba4e2-b2a8-402b-adac-e35e11a5391c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977732, "uuid": "313a2825-43f7-4119-81ce-7a37e347ca5c", "value": "384:vOr53B+3v6juk9B51g8PxlKCDmmlMrfg:vw3DtXHpQo9Mrfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977732, "uuid": "582050e5-991f-49fa-896d-bb1d3ad5703c", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977732, "uuid": "eb556ec5-2b1f-4229-a852-dc3b380d1cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977732, "uuid": "78084e36-99a9-44df-aff9-6b26d6246d64", "value": "Ssbaopba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e434253-5ece-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695995200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695995200, "uuid": "7d6afd0d-4845-435c-b298-4a2f04653c64", "comment": "Malware payload (RedLineStealer)", "value": "7becd8f40aeded9a925e4dc655d4744f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695995200, "uuid": "f651e5d6-a707-4c67-bd73-d711e963b422", "comment": "Malware payload (RedLineStealer)", "value": "65186ffb48580e0332f3a4915463bcbec866221b30cc2154f09171f20e17fe48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695995200, "uuid": "de8361c8-cfb7-42b4-9f22-6c273928cdb5", "comment": "Malware payload (RedLineStealer)", "value": "7e93efbe5885b696927e7de2c11e30e3f81c7352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695995200, "uuid": "10c6571e-53bb-4305-b206-1b272300df83", "comment": "Malware payload (RedLineStealer)", "value": "50548514a4c634712166f6bb98cb0cf5fb90179eded7f5c120ea52a8d22a62052b26e71e5ec27223d895894b72db1408", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695995200, "uuid": "5eb3a04f-c0f3-4fd2-840c-d9ecf13cc35e", "value": "T136745BA17C93C0B2C96FC0324F94DA7E052D65604CC9E75F5399C7A8ABF0EC3916626E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695995200, "uuid": "48b00341-a004-4e72-be2c-a6d830a8f331", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695995200, "uuid": "f712c273-4060-470f-9f5a-ca9621e1c022", "value": "6144:Gy4D1fj5cJ5yDuGAUzX3/IXvZAOF2yszOYOL7fgr55mYKs0BC+:+9NcJ5yqMAxmOH70mzs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695995200, "uuid": "a8ccb2df-1c07-45b0-8e78-f4de1d9eb9d3", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695995200, "uuid": "d35b4844-40f8-40ec-bcc3-cb0bb7bfd33c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695995200, "uuid": "d5946588-553c-4d72-aa58-a685602a939b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac2f557-5f0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696021152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021152, "uuid": "ac9b93f9-fa8c-4278-8535-20a021facdc8", "comment": "Malware payload (Formbook)", "value": "ac13b0670c5faea5d76340f07cfb7d1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021152, "uuid": "78ecd4f3-3f49-4dba-b443-f1857f972a65", "comment": "Malware payload (Formbook)", "value": "65419d777e93745b9feeee9969ef2a1fbd0049f816bda9053a96d2daedb5074e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021152, "uuid": "73307c22-a831-4e44-afa5-5d00ad32d6ff", "comment": "Malware payload (Formbook)", "value": "287b35cb07d9c474a92107a859bb96b1424d919f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021152, "uuid": "a6d52024-e2b4-46db-a002-a6dba072bf54", "comment": "Malware payload (Formbook)", "value": "95ad388403f405f085ea9d25314b29638a7c9e934e41ad138eb5fb525181de2a1db337f5d94687235574f9dbf0c7bc11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021152, "uuid": "1ed85af8-fe52-41b4-b07b-a2c04796c247", "value": "T104456DE2A258DC71F06A3578C849B3D0346A7CED693A9CCD566C794A1AB37613C2C43F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021152, "uuid": "048f49f2-2059-4b28-8399-6353834129af", "value": "beefa6546dd4570bf21020f1082d8b97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021152, "uuid": "0f543b2a-d915-4d55-bcba-5820762597e8", "value": "24576:ORTaL+A2f8Zhp8bYm1EnyWjkf0eFuPD+4m:gTaKsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696021152, "uuid": "9153ea1e-d192-40be-9af2-aedfaf19e022", "value": 1244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696021152, "uuid": "edcc3d87-0b4f-47cf-a3df-5f24ce01d73d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021152, "uuid": "d7b77624-d635-4a1d-92da-78a1ae35950c", "value": "Nvpatlaeuyajct.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430e358f-5e66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695950379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695950379, "uuid": "6c18cebc-2676-4cb0-8671-5d224e8f3439", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "14c384f7af66b85140c828e15aa878b9", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695950379, "uuid": "6c19d362-0b6c-4cd2-a83d-54cffa8be1f3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "654b379331d2cc678426426a8ed04f44d99d88299f4f0ab7f2c87fbdbe26f9bf", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695950379, "uuid": "2986c1da-606a-431d-af87-93e8aa452f99", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "78cd54f6e69613f7846f56242fe9f70251012f51", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695950379, "uuid": "c41e97cd-1504-4a0f-8622-44f6d6b794cf", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9252c76998e84b57b9ba6715d343761a5e24a438d81ac228b35b60cc18a32fde9619ac054bac329639eaaf78dae4a796", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695950379, "uuid": "3d18830a-65dd-48d9-8e85-4a4dd602f6fb", "value": "T125548E13B690E831D4765E319D29C6A47B2EFCA19E6963DB33983F2F18701E19672703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695950379, "uuid": "0d86c687-c3ab-4cf2-aeaa-330f6d2e13e5", "value": "d749dd3982d2564e67503d7c8e1b49ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695950379, "uuid": "be591038-78f4-4318-ad95-385a4d30fc65", "value": "3072:iF/DBoAFD07fW6twdAwPlbeE3SHJbB8Z26fF8IgcbDsIxw:M/D1FI7fWgwdAwNbeLH5B8Pvdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695950379, "uuid": "ff886057-20f7-407c-9761-750df72d2dee", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695950379, "uuid": "8fce9f02-aab7-4f5e-b3b3-533e501314bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695950379, "uuid": "cdefe4b9-5c9e-4a53-9b1c-c2d169f74e77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608d7d36-5ec9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695992949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992949, "uuid": "60592ad0-3b99-4c2a-9990-97be9f8ac982", "comment": "Malware payload (MysticStealer)", "value": "130062f2df51f89f34cb49b162deed10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992949, "uuid": "f55d8508-dce5-4076-b73f-033320d6689c", "comment": "Malware payload (MysticStealer)", "value": "66e233d66cfa61401190bf8d28963173d97eb27a66561ce04e7fa23f52e2d05c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992949, "uuid": "d667a142-d6f2-4ab5-8225-ce205dfb8faa", "comment": "Malware payload (MysticStealer)", "value": "c8f4a9bb28ef4cf79a6958acc570127dc6466387", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992949, "uuid": "202b0254-663e-4f3a-a78c-23cf86d946ff", "comment": "Malware payload (MysticStealer)", "value": "0c0a2d6d395880fd76324b5f3ab45c1a7e220c84b18715e4e5b76749206425034b949cb5438dc72682f8562ef49ce631", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992949, "uuid": "85cfd072-37bf-4032-b2d8-86eb60ae213f", "value": "T1D9152207A7C88472ECB58FF444FB1297273DBDA29D74936A27C09E8D19B26428931773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992949, "uuid": "528bd1c7-b04a-4194-bb2d-bae83f031115", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992949, "uuid": "e0afb8bc-73a8-4cf8-a86b-1320f8d252d9", "value": "24576:6y2cjhDRQJZE2OCcNXJaUIynJjiHqSw8dCM:B2c5RQIpNNNFjiHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695992949, "uuid": "cd2e49ad-20b1-422d-b38d-69a19a53e279", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695992949, "uuid": "ceee8a62-de3c-4d3f-8d4f-cee8e0e334c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992949, "uuid": "cc6e6d7d-6aea-4c23-b9b2-d1ed7c8db333", "value": "130062f2df51f89f34cb49b162deed10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7071f69-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015858, "uuid": "3941bc81-d291-483a-b1d8-ddb5c0535850", "comment": "Malware payload (Mirai)", "value": "7f13bdcdc01fea8f6db2dde8b277cb92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015858, "uuid": "1bc7e234-0731-44f3-aed2-f59233048516", "comment": "Malware payload (Mirai)", "value": "67920061baf3746b1fb96efc2246f0f9f6689a5c5109641e5e2abe518481e6cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015858, "uuid": "f8c7db91-e241-48cb-a84b-ea4a1eb61dfa", "comment": "Malware payload (Mirai)", "value": "001b588d5b2026c3f7c62e996782348bd39aeb2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015858, "uuid": "43e68e2b-10a2-4abe-9baa-ad395953eb84", "comment": "Malware payload (Mirai)", "value": "9efb6eb06ea38109b2c60a3c2c57a96c02dd51e97008b1266c0dfa2505e93da42dffa2dcd1b6fc0626fd2f2856a5dc19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015858, "uuid": "9e817e7b-5aca-410c-8eca-8ddfb296f43d", "value": "T1B2431925AD792E26C0D8B57E11F78724F2F2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015858, "uuid": "f1b2bf9b-6023-43b0-955a-07bfde3e8a29", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDx:eL0AxvSHfymp0xgunvCkV6vTMDaua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015858, "uuid": "94979947-77ee-422f-9f1d-4b46984175a2", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015858, "uuid": "36e60b81-0c54-4b2c-9fe9-e1fa3bd3fa9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015858, "uuid": "d8fa0715-941c-4bf0-bf68-803aab34e954", "value": "7f13bdcdc01fea8f6db2dde8b277cb92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2112eb67-5e78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695958053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695958053, "uuid": "1f81b464-ed59-45d6-bc16-9f30e8e3db9c", "comment": "Malware payload (Mirai)", "value": "49e3df7455cec3d5a6b11212de2deaa1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695958053, "uuid": "fad676e2-7858-43d0-8909-7a3be459d691", "comment": "Malware payload (Mirai)", "value": "67b316e401c05062ff592fcb81badbdbdabbe524cea06dea231855634644fb2e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695958053, "uuid": "efca3fb5-7fd5-4045-8ba7-938f5fd591e5", "comment": "Malware payload (Mirai)", "value": "a2f2d44bd045bf7ea2f4891461b8abb570961e1f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695958053, "uuid": "d287fe53-95a1-4165-a18b-162352dd1739", "comment": "Malware payload (Mirai)", "value": "e13c805e06417e5ff29653733f0c79fdc79982f464683b232010f4272aff0533e23d654b713b10b8188cefd807a643ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695958053, "uuid": "9219c1b8-b21d-4e69-82a5-b318c7e403d5", "value": "T155937DC5F243D0F5EC8705B15137AF379B33E0B91029EA43D3696972ECA1911EA16BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695958053, "uuid": "9efee3dc-3823-41e7-9280-8b1bfc937292", "value": "1536:sUYl80AvyebhzEzASUR39IaJi7M3MX1+NgKVL4GRUS3tkDNv7:sUYq0ovNHSi39IPI21HKVEeBMl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695958053, "uuid": "3db4f2a8-94c6-4a17-b40b-7d496399b9d9", "value": 89672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695958053, "uuid": "4175e4ba-49eb-4fd9-b691-bf2b11877361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695958053, "uuid": "ed7e29bc-ad30-4179-bd7c-254182dd7898", "value": "vlxx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0fab12-5f0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696021231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021231, "uuid": "43aa68e5-67db-4fb7-ac47-b57da09c6afe", "comment": "Malware payload (Amadey)", "value": "ce18d60b7daaeed5f897820fd12dd9fc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021231, "uuid": "7bb5f2d3-273e-40a9-b65e-c6e0846557c6", "comment": "Malware payload (Amadey)", "value": "6914377ccb1e95eb5708d111909e5e3616f465303e246f5590a6d9d4b891089f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021231, "uuid": "79ff958f-116c-4de3-b985-4c57527ba9e2", "comment": "Malware payload (Amadey)", "value": "f395d0736f735ddd9afeb5512a148970a87743ad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021231, "uuid": "fa870406-68d9-43e6-9ab7-27c2bab9758e", "comment": "Malware payload (Amadey)", "value": "7077f71c8367c3a21a9ef700b5b6636aba71af6ae1d002f4e73dd7b6e08b11d4e6976092c5066352c1e1063ad4722931", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021231, "uuid": "156e5ff4-71c2-432c-b15a-161b0a85d525", "value": "T10A3523227BD8D0A6E9BA03B05DF60B831F3ABCE18C78870B274295965EB3550653477F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021231, "uuid": "beebcd37-1b74-4ec4-8a6f-569492f641cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021231, "uuid": "34d3b774-81eb-4df0-b715-65ce897d4582", "value": "24576:ky3EJnaEU4SKvmmK51a7J9j+Qw04efGA6CJ5NitZrCagfzRiaqx0u:z0JaEw8DKMDKLB4M3gf9ha0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696021231, "uuid": "0759d1ef-e1f8-4aa1-9336-f312922cc460", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696021231, "uuid": "615828bf-c5ac-4fec-9a4e-d75ae35f698b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021231, "uuid": "04cd08df-9407-4309-b478-4bca73bb5756", "value": "ce18d60b7daaeed5f897820fd12dd9fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e39ad21-5eac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1695980409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695980409, "uuid": "08f0c46d-0334-494b-b24b-8c604ec4ad06", "comment": "Malware payload (CobaltStrike)", "value": "b81bf12132cd0beac215d435d736a34e", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695980409, "uuid": "a36677f3-b313-41b0-a2c7-154acff655dd", "comment": "Malware payload (CobaltStrike)", "value": "69458febe1c88d03d6b5f0a83b516481f9dcbedfb97c8720170e4d0c75c1c880", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695980409, "uuid": "0820a101-b593-4fe8-b3bf-1b45c440e454", "comment": "Malware payload (CobaltStrike)", "value": "37e881f8732317f04ff1714f854fb82e1e1e68d7", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695980409, "uuid": "ad5b2996-7beb-4434-952f-1e3c1a4ceb03", "comment": "Malware payload (CobaltStrike)", "value": "d6cb4149755bc846bb3f77e4d760bfcf370ab92e140f006d54ee36a397019018f9da8d3ec37b0cd6c91bbd20b8874859", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695980409, "uuid": "ec61fb5c-3517-46e1-8a19-c4f2b5a22f76", "value": "T189522B75EA0378F2FD1A897004EBB6FFAEB3E1138C105C96CFA4DC4158274BA581665D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695980409, "uuid": "fab37ede-36ab-4b20-90f5-3af5d7ead8dc", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695980409, "uuid": "44f9501e-586a-4359-a2fa-89b8da898c28", "value": "192:AnH+DgGK83SxHn2OQ/dmBI4KBfTgir+xzCq643P3OKyHbqUqV/Qjo7AGa:AH+kGKqbOCdWIVBff+xzCf4/w7fCXAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695980409, "uuid": "3d53ba80-b394-4f01-a3d0-aa10c898cd99", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695980409, "uuid": "96a8a062-e1c6-4ed1-b590-b364d32570c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695980409, "uuid": "8ee0cc3d-9fc7-4578-bad1-fe56478b600a", "value": "b81bf12132cd0beac215d435d736a34e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534495f5-5f1c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696028575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028575, "uuid": "e73d0112-cd1e-44b6-a11f-94619ab2ddb1", "comment": "Malware payload (MysticStealer)", "value": "fd9c5c946e997348c799dd7b397baeb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028575, "uuid": "04104b77-375c-42fe-ac24-003089032315", "comment": "Malware payload (MysticStealer)", "value": "69681a84faaa9db188bc47aa79ec4f8acbcc8b1452a59c86be9ea5e44f552d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028575, "uuid": "bb4d6c98-a1cb-4f97-be72-7fb2ce44a01f", "comment": "Malware payload (MysticStealer)", "value": "ea9665e25e9b542e6fdc760c6d0cf087ec3b3a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028575, "uuid": "6000ddb3-0744-494b-a6e9-d8eb66104266", "comment": "Malware payload (MysticStealer)", "value": "9c1e5a643d3a7828ef1250a56630a7e75014c6ea67463e0e5ce245820e784448051b5f191204f7130299cfc79274e9d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028575, "uuid": "291ac1ed-3dfe-4f2f-964f-f103eb5413c6", "value": "T116749E0174E2C432F8332031159097B55F6EBDE5C7AE5DAF93E50F6B5FA2282C96122E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028575, "uuid": "29259b74-ea0f-4827-84b4-ee7ad4a6a053", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028575, "uuid": "46d7bf27-2325-4be0-95e2-fb00e585a2a4", "value": "6144:DuTeW/s5GqrO5aXnfEGIXWPvZAOfykow2SGAn2KnIelfECnnnLURRlVs0BC+:DmcGqrOk86x/bnGKIwnnnYHs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696028575, "uuid": "ae837063-bb5f-4d73-83fa-c0747b6c4151", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696028575, "uuid": "200ab7dd-4c84-4126-b394-334b9f6a9da7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028575, "uuid": "fbf972e8-ee4e-4a07-8a31-51f5ce6fcbf5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8414cd6a-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986566, "uuid": "12c7d7df-b72c-47b4-8e17-07d586e57821", "comment": "Malware payload (Mirai)", "value": "ef217fed31eabcc6d16025601b40c62a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986566, "uuid": "b03ca8b6-9aaf-4c0f-87a0-48c116848a83", "comment": "Malware payload (Mirai)", "value": "69a2e337c38b3d867e99cabfe3b38caef977dd28fe01c902d3a43fcc302f9fb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986566, "uuid": "ab3d901d-c8bf-459d-8c65-7eafcbdc9ae8", "comment": "Malware payload (Mirai)", "value": "e604a3759605f05447e5ec14060588551a4c439c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986566, "uuid": "5a0f70cf-7d07-4865-ac72-21d27e0266ca", "comment": "Malware payload (Mirai)", "value": "97ee749e91fd0cda4d3a294397effc35be718130363c5718e366e1b5fb6f3e28e1c170918acf1356586b2f2ffd621c56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986566, "uuid": "8fd553b4-c56e-4359-ae96-b3299e3e85d4", "value": "T1E8B3781A3E11DFBFF66D817047B38A30969977E62AE18684F16CD6481F302CE641F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986566, "uuid": "4785f24e-73bb-4406-baf2-17de001c0829", "value": "1536:CAFmakMnMLM9kXknmsknr0SOlH8xkUVBk6+JnlPe0Wj97xucPoGjKS:OXknmsknrHxBk6SnlqxucPosKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986566, "uuid": "2e09f1a0-9a15-4235-92fc-bfaa8e976843", "value": 115572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986566, "uuid": "aec14921-369a-4019-9ab1-ff42d941c139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986566, "uuid": "ccc694cf-146a-46bc-9287-2b9c88aea859", "value": "ef217fed31eabcc6d16025601b40c62a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997a15eb-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024398, "uuid": "65c78b4e-821d-43e2-9ddf-26e6a2cc272b", "comment": "Malware payload", "value": "dfca55f5789fcd56cff38d5c6448d44b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024398, "uuid": "536a3464-00ae-4b57-b4f1-0e87b9a07318", "comment": "Malware payload", "value": "69dfb54248b666508c68be7f7948a98c526edbeb8d2363c34df7b0c0c68d2655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024398, "uuid": "b91ffc1a-c3c3-438e-a5b2-2660385c9d63", "comment": "Malware payload", "value": "195320a2af9ccc0e7507ff1a85e7c35587dbec65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024398, "uuid": "a5cf1100-9124-415b-aeb3-5ffd8f47f770", "comment": "Malware payload", "value": "f529babeda383e14388c6bf7b5b55143e642f7af98a792b62d1ff1774bab5d4ca9651d939477785bb4365d83ab9f61dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024398, "uuid": "72086642-14e5-403d-a29f-104e123b3bf9", "value": "T106342335A4A87A06C55D1FED36CF86B54F879DD6E500AF02268C2BFB4840067FE7A853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024398, "uuid": "33eb2b75-d318-4c1f-93e1-2a45ec6c5fb5", "value": "6144:+ZaJsBuHJFb7XRZv/1YBYO9zcEmFenEXMtdNi2G:+ZaJA8JFb7XlTIzxWvYri2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024398, "uuid": "3827178f-343e-41a6-8998-2ec112656b17", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024398, "uuid": "18a37a2b-435b-4c3d-9544-9dc6e400b983", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024398, "uuid": "b3e91d7e-fce0-486b-baed-24830fc6608c", "value": "288332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8b8d76-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977110, "uuid": "165ec9e2-2382-4c1b-b1e5-4ea69b80f93f", "comment": "Malware payload (SnakeKeylogger)", "value": "7fe389096fa318c3f3cb73fcf58973ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977110, "uuid": "a9fda81b-ca29-411e-b339-64aff510fdb0", "comment": "Malware payload (SnakeKeylogger)", "value": "69ee82a6768795d07d99bfa267bf0ecfdde55651ba756338c448b0735db3f59e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977110, "uuid": "5024e338-b8a1-484b-b915-52ae3616bdd0", "comment": "Malware payload (SnakeKeylogger)", "value": "61b3c643ffcf012bcb8f850a654af71eef6b2748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977110, "uuid": "19119e9b-42be-4380-b0d9-d2a60550cf0f", "comment": "Malware payload (SnakeKeylogger)", "value": "60928a2ad81ee7e829f71902b757deab934c66b2c7f881b17688521093d67dbed030c5c57944adf42ceabe27c4686ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977110, "uuid": "0ed606a2-d8c2-4807-b041-a0706a0ef15e", "value": "T1E6B21948AF69C457D7AC053D48E6465C0378EE17A442FB9B08CC7A262D37BD1C9D12AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977110, "uuid": "b06d7cc1-d645-4359-8074-a149c18cbfa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977110, "uuid": "3cdbc67f-0359-4407-87f3-53adffdd1037", "value": "384:JkvLCxRRfB5bGvdGsynUXkOaXYs1dFFq88afXpBC88aHXpK:2vLCTRpFZHf7JfXfRHXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977110, "uuid": "43185930-0714-4813-90ea-f375aedf22df", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977110, "uuid": "b4bd75c6-68e2-4d88-84c5-879af1b6a526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977110, "uuid": "a0b37797-aa5d-4654-b9b7-856acb95094c", "value": "Pdznjmwmori.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f79bb26-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986559, "uuid": "378a084a-b378-4a97-978a-564fa5918e6b", "comment": "Malware payload (Mirai)", "value": "b156c935a153427cc4a200d45454be38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986559, "uuid": "1edb3f12-6dd3-43ed-b1d7-281cec561b0a", "comment": "Malware payload (Mirai)", "value": "6a7364ad76fb360b07c5389a74d99e0b0a81331a16e5f9bcb17f3ed55dc9e163", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986559, "uuid": "71b0cfca-0c80-4e07-9788-72094a9076b0", "comment": "Malware payload (Mirai)", "value": "747a388cc835b9a84ff7d889a3d47e849b4afe3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986559, "uuid": "ff008c84-16cb-4ec3-b694-4eb03df69a95", "comment": "Malware payload (Mirai)", "value": "5c38849db312269f6d4a76e410d62cc770d8cb604dbd19bbe6a18185db7f97c48ba5c2c1a6aedfddea07741d54eac174", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986559, "uuid": "ffcab68d-4536-43db-9b76-12d4401bfe6a", "value": "T1F8B3A506BB518EB7C81FDD7306F54B1220CDB8572678377A3674EA6CB61A18709E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986559, "uuid": "e5ece6ec-3bbb-49f8-acbc-927806164957", "value": "1536:qicbn+NarahzJMOoS5cXldzm0IWsVwdph86XcBj8:lQw/uVkg86XcBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986559, "uuid": "eaff510d-e6f8-46d6-b183-af229bd62ff4", "value": 115572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986559, "uuid": "a07173f5-8a0b-4c24-b07d-eeaf9290e18a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986559, "uuid": "2622301c-9cc8-4015-a4dd-daad8fa9bc83", "value": "b156c935a153427cc4a200d45454be38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25ea10f-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695987154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987154, "uuid": "4d636fac-b265-4bcd-9582-6f5cdfb9aa7e", "comment": "Malware payload (Loki)", "value": "b075c8d37f3342eeb18d2698de2e3e65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987154, "uuid": "c23f5d7d-5c10-4657-aac4-cc0c94b51599", "comment": "Malware payload (Loki)", "value": "6a74804f8a0e8571a7d6162f62fec6fa1e73fe232f57a488da3d8b5d09b40b14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987154, "uuid": "4d4a0193-8c85-464f-996a-b7427c35819e", "comment": "Malware payload (Loki)", "value": "6c6f440e9ca12806473d91f02b027985edf141d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987154, "uuid": "101a48df-ed32-40e7-8673-f846722a7ecf", "comment": "Malware payload (Loki)", "value": "596a489413ef36381b7a2fc3f79b6de548cd2eb1d06b4f9871fc54f7e9dbb63de4fffc006b588a393a7a10c7a6f89841", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987154, "uuid": "ecbcff68-55e4-4524-81d8-58fb47560a5e", "value": "T1D6C4F102ABD52681E6BF237499B6513143B7AA128839CF2D0DCC50CC1BFB791BA54F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987154, "uuid": "0e12af9e-c195-4107-ab33-28c95b974a37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987154, "uuid": "29c77765-2ef8-4ea0-93b4-13618ecfcc38", "value": "12288:7cDAckj4CMeQD4ts7igCeUR3QGLKmHJ4A+S0:Uk3s4tKi9hQWKo4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987154, "uuid": "1ab69fa3-34e0-4ac9-b529-a2553e5a5a80", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987154, "uuid": "4a73d890-dabd-44bb-956e-d6ce318e87e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987154, "uuid": "216a427a-d733-41e7-b52e-7f25cbb87f9d", "value": "HAESU KOREA SLIP 20230928_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b247db-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696010274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010274, "uuid": "7c377077-5965-4610-b59c-edd1cfc6ca46", "comment": "Malware payload (Mirai)", "value": "68ce1f7eca529148757fe292246e61f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010274, "uuid": "56661d4c-75af-44a3-a672-e8b9415540ae", "comment": "Malware payload (Mirai)", "value": "6a7efdc8cd8d3f74e6de4c9047e39616071abbb882cf9b11f2b528cdba1f1f96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010274, "uuid": "d249e54f-9732-447c-9d4f-10426f0c4cb4", "comment": "Malware payload (Mirai)", "value": "36ecec7eddb475619ff850de1988cba49d17ec4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010274, "uuid": "88fe203d-bc9b-4c70-89b1-7cf9733ba88d", "comment": "Malware payload (Mirai)", "value": "896d53b0dc30bbceeb125a4ff5049d544246c8dd81b3672c4fc90ac71cf36734976613ed998e94752e5fe41b9cec5890", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010274, "uuid": "ea9ed2dd-7d7e-4de9-a60e-4f8bdaf4bdbf", "value": "T12343F855F8818B22C5D4027AF92D118E332367E8E3DFB2139E106F247B8696B0D37E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010274, "uuid": "653ec570-bf17-4990-8d29-8478513606c5", "value": "1536:5Jng2Ke3tTQZoSgLyUN/aBD3ezzIci13FihNJ:A1edT+dCO33FihNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010274, "uuid": "71eaa0dd-44f0-4867-ae2b-a3ee347878b2", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010274, "uuid": "a42c6bc1-cc0f-4264-a1ae-f7ced8d2c9a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010274, "uuid": "5011d949-cbae-45d5-a37f-597ea1f9c805", "value": "68ce1f7eca529148757fe292246e61f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3dec3d9-5eea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696007316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007316, "uuid": "45ce2bef-5790-4e7f-9851-48b7cd4cc82e", "comment": "Malware payload (RedLineStealer)", "value": "572271ee451db8db86c5642e60def136", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007316, "uuid": "ae3b75b2-d68a-4286-8ddd-2bd6700e6c40", "comment": "Malware payload (RedLineStealer)", "value": "6a804f8a720d308d62aef87f7b1fcc00c250c17df1db9a32a03833fa70fa7f2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007316, "uuid": "202e167e-60b5-4f1c-bafa-733cfa328576", "comment": "Malware payload (RedLineStealer)", "value": "cdc5adfc00a5a82f31a6d037c9f25368a8b9cdaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007316, "uuid": "ab4b92a2-31fb-4a8d-9a1d-033bad6c33a4", "comment": "Malware payload (RedLineStealer)", "value": "ba96305839977939f1e75dfbeaca7e5306c74a68a3daf8b065fae3365846a4ffb966618452375576363a2f8b5194b424", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007316, "uuid": "38e20293-043c-4f91-ad01-eb6b97de1364", "value": "T18A152312A6F41132E8F857B019F707830B3ABD529A3983AF2654B59F5CF369004B57AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007316, "uuid": "89521c3e-2f25-4451-8f34-6b060cd77512", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007316, "uuid": "dc7636d5-d2fc-467d-898e-bce2741df159", "value": "12288:GMrsy90P2Jqkad49zP2u/fCU6C3E1X2WwfP8sN3PJhB4RnT7vGza2f0xOJ0lBnRw:WyJad49zPHdE1mWXsBB4Z7Al0eu5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696007316, "uuid": "822b46cf-d056-4900-b4bd-654206b52a3c", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696007316, "uuid": "3f6ceb1b-3279-432b-bf70-e2145a3a3b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007316, "uuid": "2d175082-9688-4f2b-afd2-7a462f4abf38", "value": "572271ee451db8db86c5642e60def136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff72595-5e60-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1695947717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695947717, "uuid": "a4c18a49-c8ee-4de7-b3d4-e59dabbb79ed", "comment": "Malware payload (RecordBreaker)", "value": "3f7051e7e2f7bdbe78be54348128c211", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695947717, "uuid": "f89b51f5-befd-465c-8599-59c584ccfee5", "comment": "Malware payload (RecordBreaker)", "value": "6aa2afa0bca56dad0eaa1a3eab239455322466a77564076fb62445c1d7c23e5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695947717, "uuid": "36ca78ed-5a1e-4033-b4fa-8c68c2d9ae52", "comment": "Malware payload (RecordBreaker)", "value": "599bb8cb50b99f01ff0014ed1a30e87172a88bba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695947717, "uuid": "216f934e-bde8-49e3-9aba-a3402f996dfe", "comment": "Malware payload (RecordBreaker)", "value": "aaa212562a9adbec13bbd07800430ac0fb781f47af068f50675e3b7d0da3417577cd8ddd3208f9a28edebe9e9724dfa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695947717, "uuid": "053a014b-cd7b-442d-a0a7-caff2adb8b64", "value": "T1824623213DE5A53BE26646B08C58FA7462AEBC314F310BDB53D05B5D1A36CC26B7073A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695947717, "uuid": "b906a5d0-3e9b-425d-b50e-c460c29c1b1d", "value": "f6a0328944a60715360ce2ff3ef9a7b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695947717, "uuid": "28c4a2db-277d-4a10-906d-bd675ea1df98", "value": "98304:FNZB24hAk5/Mct9KtiWx8Tk/FQoFSJTyvq3v8Vz62UcH:FBLMctkEo27JToA460", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695947717, "uuid": "01b8667e-998e-4aac-8fa7-ec930d82ba5c", "value": 5483560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695947717, "uuid": "e9ea06aa-2d2e-4182-81bf-a093d16be977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695947717, "uuid": "cb94a85a-af2a-44a0-ace8-287ef2623099", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fe49a9-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PureCrypter)", "timestamp": 1695977656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977656, "uuid": "476f383d-fe5b-4d63-b927-02a8d831fdcd", "comment": "Malware payload (PureCrypter)", "value": "eb91d2bf8fed761ee9e6c0c94f40e943", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977656, "uuid": "f3a79f72-7267-415e-a8cf-e2766ceceb54", "comment": "Malware payload (PureCrypter)", "value": "6aab1c0f4cc3fba12206314dc0ef057ecd8fc745e46b01f602fc29a345e07e9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977656, "uuid": "56db3c67-66a6-4080-af7b-3704fefe61da", "comment": "Malware payload (PureCrypter)", "value": "8e4b45b8dabcef7159892952648986ecd2f57730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977656, "uuid": "f58518a0-e2d9-4f4c-8f52-b34b610c6a40", "comment": "Malware payload (PureCrypter)", "value": "f95534687b2278204b25040637b101e6f151a66bd823fc8ecaef6cc776f64128b3abb02b57f466e985f9a8532a6e5b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977656, "uuid": "7c00ad84-9594-44e9-8d28-a331717ba193", "value": "T1DFC2B70A236CCA76D46372B15C1B67B2372CE931D6567F2B1BF0BD161DB22C949E2134", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977656, "uuid": "8fcf7bcd-4e5a-4e15-aef2-66e8cc709e6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977656, "uuid": "598e42ab-4eaf-454e-a2b8-e4f18b8a19e5", "value": "192:vQPfJ+RQ/f3j4TgRpvjiPD10se9eae3e3eae8ehezlTSBPxSq2u3SDz91s4VSka:IfsRQ/f0E/ju1g8PxlZCDhm40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977656, "uuid": "9af9cacd-be4e-4e60-ba12-8a19d23fa677", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977656, "uuid": "cff77a76-1fe7-4123-80a5-de40572d3e3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977656, "uuid": "edd4cce9-b808-4e0b-a731-59e82f73a44a", "value": "eb91d2bf8fed761ee9e6c0c94f40e943.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b603039c-5ebd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987939, "uuid": "f90e5f5e-cae2-4755-b5db-9fd206c248a4", "comment": "Malware payload (Mirai)", "value": "ed44bb08b877465e0ce7e8effb13d86a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987939, "uuid": "692ae67b-068f-40ba-8c56-aa361f4645dc", "comment": "Malware payload (Mirai)", "value": "6b03ecaeb184ad94f9ff7d3559052961bd2f267f8995dcdeca81d8fb32063cba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987939, "uuid": "e21c74b6-e849-4ee9-9cd5-223d9ba34d0a", "comment": "Malware payload (Mirai)", "value": "191b724afb04494526128d8cd5e5d29b90e62252", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987939, "uuid": "473aa1f5-6507-41c0-9a2f-581e1b7f13b4", "comment": "Malware payload (Mirai)", "value": "a3182f342de03432764e8a66f23dd26bd5283bacd8f9ccabed1a87d6190496517da6cdedf639e71019fdcdaadb08e266", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987939, "uuid": "a5038ee5-d8c1-459d-9022-e97944550f6f", "value": "T1CBB2D01DC0AE7EB4FE9B7D345D41E2817BA19B9F3B628DC016C15B010622D282F9CAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987939, "uuid": "7132e563-28bd-4219-8d1d-e21d44d5ea79", "value": "384:EA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo8M4uVcqgw05VxJN:KApCdvwJr69VJoA8FZtxCo8u4uVcqgw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987939, "uuid": "2209fbe6-dec8-4d2a-a431-b4ff2f97c832", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987939, "uuid": "a5965fd4-d3eb-4439-aafd-b1a88940e821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987939, "uuid": "295f9440-1c9a-4eee-9940-6d5ce4fffc2f", "value": "ed44bb08b877465e0ce7e8effb13d86a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7b1e3c-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977103, "uuid": "eaee35cc-d848-4d9c-b76a-3e67169f0d67", "comment": "Malware payload (SnakeKeylogger)", "value": "813197e4b88a84169acefa66e7d8b223", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977103, "uuid": "efd06fc4-b430-4d39-bba9-50fd2c89ebca", "comment": "Malware payload (SnakeKeylogger)", "value": "6b100ecd69eca03ff9f39f370faedb6699a873af537b0e5f0491ef79d74c0cef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977103, "uuid": "65d0b362-00a7-419d-92c9-bb43d0909f78", "comment": "Malware payload (SnakeKeylogger)", "value": "2c0ebf421f40fabe42a4c00f906f20fc98870e6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977103, "uuid": "e9aa4d96-78ad-4257-bdf1-77f740d0da6e", "comment": "Malware payload (SnakeKeylogger)", "value": "6b40f68657580a6fb7bf46dd7d21121968f4f6d1e44a618163dac8dc6522430002deceb2360835c58308c8467d59b523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977103, "uuid": "17e89d7e-8f6d-4142-97c7-5c8257d55ee5", "value": "T143E40202A7D51681F6BB76325AB4043047B77A568938CF2D08DC10CC1FFB6A1FA59BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977103, "uuid": "827549ff-9ce0-4dd4-b72e-0d5dc5821f3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977103, "uuid": "00002d36-d093-4c26-837a-2cf0fdbf19ca", "value": "12288:ocJAckjZjcLQvtGD+8d/1Dd74mmdcMpu27YIasgTsh/:Xk+LQvtk+8d/1dku86s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977103, "uuid": "0794636c-d409-4611-b1ee-4aa69c1898ad", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977103, "uuid": "51917ce6-abd8-471b-bbfe-3746d2280d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977103, "uuid": "5270102f-25fb-4bd4-9be7-41df88ed2669", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dca90f8-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977107, "uuid": "7d84819f-45d8-4365-9a80-b27ce227f4c1", "comment": "Malware payload (SnakeKeylogger)", "value": "906f03b109ba170f2341cada8115cace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977107, "uuid": "b661c8e4-ed90-457e-9f5a-eebc8ef2fbe2", "comment": "Malware payload (SnakeKeylogger)", "value": "6c933d73454be8f55f59a321448496e742fb71513a6fab732426938f0f023206", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977107, "uuid": "bb152b87-d265-4429-8421-db667c26f595", "comment": "Malware payload (SnakeKeylogger)", "value": "b6617a4b65eaed21d1284a468fe2ea71ced24092", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977107, "uuid": "101cfd4f-86bf-466c-841c-43d1cc1d267e", "comment": "Malware payload (SnakeKeylogger)", "value": "95f96c2630f34921f0bd42dd58eb35682b781b5941d1745fff8c805e7795a6fc8dc8868eea7b47541ed2b13454b06170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977107, "uuid": "44ad7502-9dbd-4f5e-a949-dd10463e7ac2", "value": "T15B24077F865AB612C77E83FDB753A44D4770C003A4CBFBEE259DB6E0098335189066A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977107, "uuid": "4cb6efb1-63dc-4673-9dff-cf0ad1e9632f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977107, "uuid": "5254060c-767c-489b-9253-dcc7b9610724", "value": "3072:2vaIKVCDtw15bY5kThyItji8s+HXStsxal4MAXXnm4ZQvq2TIE8ET:2TvDtwg5kLtji8sOaljAnnm4WHgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977107, "uuid": "c17c026c-fa92-4881-a869-1045181f7d32", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977107, "uuid": "e9ab806e-bf79-43eb-8bad-d5e1198d9881", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977107, "uuid": "20dbabb3-c647-4cb4-a99c-b661fd311069", "value": "MPS20220928742916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83782163-5ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695978834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978834, "uuid": "3c242936-7ea9-440f-86cf-e584cebe96c2", "comment": "Malware payload (Formbook)", "value": "cdacf3f5255f21aef3d4ef7812bd23a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978834, "uuid": "19b55f60-9811-4838-930c-d5a3e9dba019", "comment": "Malware payload (Formbook)", "value": "6de402e896d0ecf6b4d55fe0ffc1b978e511a632a842e188200e5cb736893210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978834, "uuid": "1589bc00-7cdc-4065-a1d3-b5ae4268cfb9", "comment": "Malware payload (Formbook)", "value": "aa95561963a9e0ef26a09f4f908f3e0f8f2153b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978834, "uuid": "293ec49d-8c15-4c4c-9403-62594fcf97c5", "comment": "Malware payload (Formbook)", "value": "a715330f1616303157ba6997e0f7d547094d016c8745049f0997c36e4ea339bdb6abbb3dd2077a189ada2dfcfc1b0818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978834, "uuid": "35bb7d5b-b1a7-44da-ad4b-cc695f1527fa", "value": "T1ADD42258B8EA8B35D94E4339ABED514943F0B171A802F36DC9EA60CF4F397086661F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978834, "uuid": "c68055ba-8a8b-4cb9-8a04-cd4521130974", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978834, "uuid": "c5805f39-406b-499a-a856-caf3e29071cd", "value": "12288:4725McFZIYVAbsJAalkw1DOLv4r9WzF3h/SDxl/nOX+6CSVZPUFkH:TFZIy4UtpYU9idGmX+kPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978834, "uuid": "2d6e3885-8ce6-4627-88c8-7135f0b5de28", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978834, "uuid": "17e8ca00-beb1-469d-a6f6-5776cb6a406a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978834, "uuid": "3a50db0d-f235-46ec-94d0-7ea353f3d874", "value": "PO_# 315418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5058339b-5f10-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696023416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023416, "uuid": "fbda6edc-8511-460b-9dfa-945d34c39ebe", "comment": "Malware payload", "value": "a040acc9ab83051920da9898f1ebcd53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023416, "uuid": "4e73b5b0-a096-43f4-bebe-7d6c392ebbf8", "comment": "Malware payload", "value": "6ec39aad682a5be5b87fe8f0fae707b7c45687dedc400fa9f9b68a3cfaac194d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023416, "uuid": "b62857bf-c954-48db-8a14-5491ae583ae6", "comment": "Malware payload", "value": "ac918374b4168413dda72f79feb86302fb31b74a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023416, "uuid": "8f4da7b2-ba27-4893-9cd7-91db64eac45b", "comment": "Malware payload", "value": "9b5219f758fe2d606300bf5fe1be1594e98a97ba995eacc9b10050e1ce5e70678c50a2062a4603d96b7e1a31289985de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023416, "uuid": "b0e28e72-c248-4a38-b0a7-f3e462bb3845", "value": "T1AAF4236CB7EBF2484077AE70C67B6E19337E72629AA67FC021C1342DDCAB697540D142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023416, "uuid": "ccd49a6d-6b1c-4ae3-9ff9-ed4c6616b1f7", "value": "12288:JrXPJEE6TAUxMGZ0oQK9Igry6tKZXjqtnQC0BgnITZ3apsUY22uN7Nd0qDnN:NXPx6TBxMGVRfry6tOX+tEiCJkB28z0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696023416, "uuid": "292dd42c-7e76-4022-95ed-9ee6e0590f45", "value": 733248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696023416, "uuid": "37e8efa4-5ba5-4d6e-8b76-fa82f365a8dd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023416, "uuid": "75f2adb6-b14a-4956-9547-1c63c330e25c", "value": "@06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49eb49c0-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695987328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987328, "uuid": "6d055c2c-a41d-4334-a733-0a0ebd6313f5", "comment": "Malware payload (Formbook)", "value": "e189c425869e466d842c472d895035d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987328, "uuid": "b1df2913-c75d-4211-83a0-ee0b3aabd2d4", "comment": "Malware payload (Formbook)", "value": "6ed8801868c8baadf89c50bff443e9c29002e0db951ee456ffba50bca1812d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987328, "uuid": "d207270b-7587-4316-aa0a-43b0060ae758", "comment": "Malware payload (Formbook)", "value": "e50796539a9fd5c50f6569c00c2d01709bf203db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987328, "uuid": "11915460-a208-4cb6-8f79-f3fa5e90fe0c", "comment": "Malware payload (Formbook)", "value": "05b139f569fbb432e216601fe3c8400aeb60f5fba7f34928e31232c700ded7abfe949be3b92cc88c3304e119ee822cc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987328, "uuid": "1c77c17b-0939-405e-81cb-d764784cd7c3", "value": "T108E40103A7951185E6BB6632A9B5513143F7AA21CC39DF2D08CCA09C1FFB790B645FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987328, "uuid": "749d8e32-ff8b-44ef-9df6-df8d514ba10e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987328, "uuid": "34d7a9e0-5827-4ecf-8f67-26d351582424", "value": "12288:VcrAckjQ5bLSqHcGdDY30I3lYPiICl45mLPKNDOvNvttVZeDh1:OkabLjcIc0I3l4wlBLCm7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987328, "uuid": "cc86f375-7d5c-4266-834c-040b2bdde5c2", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987328, "uuid": "2807bae6-af6b-4af4-9627-453faa8acc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987328, "uuid": "3d715876-f7d5-42ef-9aff-c7fad2094c95", "value": "e189c425869e466d842c472d895035d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423eb652-5ef6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696012226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012226, "uuid": "65345edc-318c-4e16-82b4-df1d07042f71", "comment": "Malware payload", "value": "f7a56edbc493d3ca86cd4d0a94daa1bb", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HANEYMANEY", "colour": "#CBEB71", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "ZPHP", "colour": "#D5C8E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012226, "uuid": "a49ae08a-03f2-46c8-951c-167e04a15ae4", "comment": "Malware payload", "value": "6edaffbeab3e7509ba5cf4bfdba44b127cf4c23f4f277bff6b5c35ecacb0b351", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HANEYMANEY", "colour": "#CBEB71", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "ZPHP", "colour": "#D5C8E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012226, "uuid": "138dd7c5-691d-4b2b-a20c-b99e21e4d137", "comment": "Malware payload", "value": "4760a9ca5cd7b2e1ff07c75996c94e371d701f1f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HANEYMANEY", "colour": "#CBEB71", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "ZPHP", "colour": "#D5C8E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012226, "uuid": "b7d9dd59-5ad3-434a-8859-bb3eda2a6f07", "comment": "Malware payload", "value": "751c3bfb642c1d63cf9df2937c802b3e4cd2a64918fc48746777228bbcff329489c702f0ea7779c93fa0732bf9bb0ce0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HANEYMANEY", "colour": "#CBEB71", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "ZPHP", "colour": "#D5C8E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012226, "uuid": "2ede5de5-d5e6-49d0-b0ac-a5dad9ca62d7", "value": "T1E512D7526EC34B0EB049B0F2F146CC66DE8EA63E91B9736FC154FEE809B520DA1D7056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012226, "uuid": "e8cb89b0-1a3e-44a7-9075-f5323c6f2436", "value": "192:Pq4IZzN5U/aadTmqRx52Usz6/KCfNNy2ACWzduoc:S/LgI4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696012226, "uuid": "fb052530-da64-467d-91ab-accd19aa39af", "value": 9080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696012226, "uuid": "24718c57-91b9-47a5-994e-a5334dc1b02e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012226, "uuid": "2b44ca2d-e667-47be-9347-911aafca7015", "value": "1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67711f34-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987377, "uuid": "e793e5ef-731f-4d95-bf8c-3b1551390f56", "comment": "Malware payload (Mirai)", "value": "312d5f39fdb1c0746353f5c25ee44573", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987377, "uuid": "e7d0a4b1-c1d9-41ce-95c1-bd2cbb50111b", "comment": "Malware payload (Mirai)", "value": "6fca16019cff59e51eef4fffe5eac78249c9f06467b3f7d343b52b1a4a3a539b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987377, "uuid": "74994d60-bc73-4d84-9241-69cd065f2837", "comment": "Malware payload (Mirai)", "value": "6c1a6d25615fbe5afbf977964ff27518c3c55496", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987377, "uuid": "0c5daa0f-a517-4ea8-b57e-164bdaa23bc2", "comment": "Malware payload (Mirai)", "value": "8aa9c91d9579c0103db9d55868bec3cc2a55f7f5ba4a89b96010bee3d69dc6862880291d225120793a0f01ebb70e0970", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987377, "uuid": "7637c66c-e543-4c40-90c5-5c90a00d4fa5", "value": "T1AA333BD6B902AD7CF98BE67E80270E0AB53123541053073777EBFC937E321949956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987377, "uuid": "0efd1d96-f532-4af7-a8da-89ca1158c47d", "value": "768:8CeKEfhe5Xdrben4I1fN5KQnaodgFHx+iPuvWeffpqmUJT6r6Lu380DU:dsfIBZeXl5nKFx+imvppqmUJQ6Lc8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987377, "uuid": "86573c89-0717-4ea0-8971-5a287b247d75", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987377, "uuid": "334b1d39-b133-4dcf-885d-893940ee2514", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987377, "uuid": "ff1f85fe-4db3-40ce-a99a-ecaf600d3bb2", "value": "312d5f39fdb1c0746353f5c25ee44573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645ecbaf-5eb4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695983936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983936, "uuid": "a89cbf27-c072-4f65-a28f-e9b1eca4507f", "comment": "Malware payload (Smoke Loader)", "value": "9f050afee932c77cfc1c9a8fd271c422", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983936, "uuid": "6e182abe-fd97-4494-a7cf-4489a92c8c02", "comment": "Malware payload (Smoke Loader)", "value": "7005ac49242d30c3db32269e5029a253987ce6210a7fa53cc227acc7c71095c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983936, "uuid": "f68bcee3-f504-4feb-87c5-43c7e61af2d8", "comment": "Malware payload (Smoke Loader)", "value": "568571b73bebc1060b48fdfe6156c34c3ebb4edc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983936, "uuid": "74d0a206-1ba4-49e3-9cc4-0cd7bc29e592", "comment": "Malware payload (Smoke Loader)", "value": "549a9e59803e98ac44f9b5967cf80ec98ec5ecdbddeaebada1ceef18f1b2cb0b45d34522ab332baed0878d20a8a52635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983936, "uuid": "8870a007-68fd-4c14-a865-35d88fdc32e8", "value": "T1DB34AF0252E2BC61E56746729E2EC6E4BB3FB5714F79676733286B1F08701B2D2A3311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983936, "uuid": "706716cd-9229-461f-b523-e4d6bafec610", "value": "2a568f33595a0107732fea57be00f8ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983936, "uuid": "433e6489-3384-41ad-9ea8-00e071a97710", "value": "3072:H0Xr3w98RDLFkbxB/qOe0Sb9CvyN0eb8tCoJqTHF785WSP8IXpDz1TKsktn:QiWFkF89CvyN0nCCqTHlZIXpDhTcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695983936, "uuid": "e61d5835-52cc-4462-afc0-e96c6d4607ac", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695983936, "uuid": "3858ba46-209a-40cc-9303-e0f9d5b598b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983936, "uuid": "83db3036-460b-436e-b175-6d9f4e98128c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b6b683-5e91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695968849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968849, "uuid": "745367f3-b874-4230-ae2c-8cffe806cf91", "comment": "Malware payload (MysticStealer)", "value": "a3fbf2bc74348c7433a0734d31e0b3c5", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968849, "uuid": "d0a6229c-5e15-43f5-9659-0a65387f7a3a", "comment": "Malware payload (MysticStealer)", "value": "7097719cdc7b3061108c231dd081ecba1055bf9bf92c9232cb6b3f7fb3fac310", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968849, "uuid": "a9f7fb1a-0d9a-45a7-9101-15f25973f284", "comment": "Malware payload (MysticStealer)", "value": "05def82a902567b81b64c39df65bce36e34381f7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968849, "uuid": "58e15cf6-02e2-4a0e-87cf-b28e8dc3b22a", "comment": "Malware payload (MysticStealer)", "value": "603984213441ebaf62a884cdd4d01dee65f932b0f1a110f45a564d05020a1b7f609f3b4e1509300e2ddf061157c8456b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968849, "uuid": "78e4953e-a6cd-4851-83bb-72c0a2ffd824", "value": "T1B6515B061BBF1726F7F7497248BA96114933BC52F5249F0C41A1DD8C6875600AD14F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968849, "uuid": "6d97e2b1-6554-43ea-8fa4-02cc1d8bf176", "value": "24:8zRPJBvlTy2lghGCA7P5J+/fMbNBMg5KMQRDgVUVA6MMQFouUVA61UCi85hrOLO9:8zRzL7xQMp7h+A6O+A61UqOLOQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695968849, "uuid": "5d7bd489-ea1b-4f7b-b673-64a6914697e4", "value": 2459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695968849, "uuid": "59fca840-540a-4b16-9a13-6573b9eccfcf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968849, "uuid": "b307fece-9438-4dbb-a31f-ae0d49cf8b0d", "value": "Lingiang_Cosmetic_Promotion_Program_2023 Approved.by.CEO.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ac5479-5ea2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1695976422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976422, "uuid": "a7fd18c9-5119-49e0-8b41-488165ebe2cb", "comment": "Malware payload (RemcosRAT)", "value": "e7234fa661167d1bbb6a04f70bca9a7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FIN", "colour": "#4361FD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976422, "uuid": "55fb632c-730c-463e-8d6d-95d7ec93154f", "comment": "Malware payload (RemcosRAT)", "value": "70a9cc877a71e296c47e5e3aca4e8fac6eb3566c56e9abc476f3f0b69ca92ca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FIN", "colour": "#4361FD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976422, "uuid": "84acdd78-2914-4e32-80a9-4f324f939b25", "comment": "Malware payload (RemcosRAT)", "value": "d51ec30fc9ea18207a094a04a93c3f0d334daca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FIN", "colour": "#4361FD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976422, "uuid": "fe02518a-d9b8-46db-9d7b-4169c72c6bed", "comment": "Malware payload (RemcosRAT)", "value": "e7c8d61e9ab3913e52070e9242cddfdf07538ae4c77ec221a5ef61836542692c9f2e24928b5aacaa280e1fc1f63b5736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FIN", "colour": "#4361FD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976422, "uuid": "363b2afc-a68c-42ef-b53f-a6303a633a93", "value": "T18FC423162660E8F3D5AE47B29A3A7FA355B527042035222E43601E1D7EA3BCD217E3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976422, "uuid": "5205c756-b709-4881-812b-ac24d47bca79", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976422, "uuid": "886d04b1-f135-4bf0-b2f1-e65de44be240", "value": "12288:BnPdwj73IRNOGdgiKwVZx9H8uzA11+3ceWMy99cPH1tsn:9PdwH+NOqZtJS1IcXMA9c/7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695976422, "uuid": "4c41a6c6-7d8b-4728-ab9c-86bbe589fad5", "value": 578952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695976422, "uuid": "4d196234-000e-4f3d-8f2b-1f3d5eb96d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976422, "uuid": "64c4622a-10a2-4fb6-97ef-2db240647fae", "value": "\u00d6LJYNSUODATIN MAHLE(H14W30).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edbc017-5f0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696023092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023092, "uuid": "e5011548-1efb-4040-afba-38192eeec346", "comment": "Malware payload (Amadey)", "value": "7f676e38058d97f45ab94b9aba541da5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023092, "uuid": "cda7a466-1aba-4bfe-8da9-264c0a3ac103", "comment": "Malware payload (Amadey)", "value": "70cd9e19120e148a6913dac333aaffe409c9899e933ab5bd574b79e9e45ef481", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023092, "uuid": "73784ac0-d8b2-4f2e-9689-f5a9ee69a123", "comment": "Malware payload (Amadey)", "value": "d88ab6ca3692fd942e7df5e22687a96702dcd871", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023092, "uuid": "6bf8ee9c-7884-46b5-a2ca-02dc414b652b", "comment": "Malware payload (Amadey)", "value": "cd6741f429579cca8564115deda6f1e2920e5bd9353ad04c510bddfa5c7efdbfc6810a482b2339827e81e19aa3f3b513", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023092, "uuid": "6b181760-8e47-4917-a7d4-b51dc01ec75d", "value": "T14834AF91B5D18073DC7215360AE4DBF95A3EB8330E915EAF67E40F7E4F20281D621A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023092, "uuid": "9a1bca97-64c4-4ce0-b1ba-e08e76f6bf55", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023092, "uuid": "09e356c1-879b-46b4-814a-7e68a5b5f53f", "value": "6144:lBz4SHy5uoBMFGV5PEkIXEHvZAOKtYVs0BC+:ICmuoBMUOMx4ms0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696023092, "uuid": "8703743b-03fb-478a-8ec9-26cd42ba6799", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696023092, "uuid": "bb546acf-4a52-4f93-9e99-9f9f29bee9c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023092, "uuid": "aad93f79-ce18-488e-be5c-eff56ffaeb92", "value": "SecuriteInfo.com.Trojan.Inject4.61510.15457.2285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d880d2e6-5e96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695971246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971246, "uuid": "7e99e2a3-6aec-43c9-a4f6-fc1223553c68", "comment": "Malware payload (Formbook)", "value": "fded33ad1899fd9c725ecfb16fc01065", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971246, "uuid": "6301f749-3029-4f0c-bf4e-20462ec4d737", "comment": "Malware payload (Formbook)", "value": "710679ffb47d18cf16eaab6e21d156951f57bf14e84220f28d0de5f83fffce31", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971246, "uuid": "36aa80fa-5fb9-4d9a-99ea-93fa26ca6d54", "comment": "Malware payload (Formbook)", "value": "edddcf5b8854ca34f2f834ea3dad3e9fd763c598", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971246, "uuid": "41b9a0db-1db0-4b35-ae28-f0aefab8a915", "comment": "Malware payload (Formbook)", "value": "3043f9ec3133921f55f934e66b2bf3778250c2c79a85c2e9847d83fcc44cd9282de8fab1113845024f2c2c66371793ba", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971246, "uuid": "88442c72-919a-4bae-a1e5-9084483aabd5", "value": "T128C423C2F39E5851C4C64A893DBFE374286589885E449AF78D5D863A7C0313A2F4D2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971246, "uuid": "5c1d76fe-7111-4c4c-8a4e-2c38e3878b47", "value": "12288:4RyBAhisKcV8IiQ+P7xUN5KUk3NPx/iypGTMze15:4RyBAhJMIi9PGji3BxqypyqeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695971246, "uuid": "1168013d-1295-437d-82cc-7c56cdcae106", "value": 543648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695971246, "uuid": "c9fb1241-8ead-4420-8c4e-83bbbcb56b6e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971246, "uuid": "0113086c-bbf7-45da-8aa1-ac1e163f35d7", "value": "NEW ORDERS scan_29012023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91d47e4-5ea6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695978092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978092, "uuid": "27573bc7-71c9-4b6e-8e77-4929d9cd4c33", "comment": "Malware payload (Formbook)", "value": "b4db35b8d515a842523cecd060bd2f1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978092, "uuid": "e12f4854-446d-483f-8fdc-f6ffce3eaccd", "comment": "Malware payload (Formbook)", "value": "712f1dd153cfa3cdc0d32d481f58aff6b583bc7a60a94597a8c47ced99360d89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978092, "uuid": "6e357c96-0884-4a2a-b56e-2641c31d1c46", "comment": "Malware payload (Formbook)", "value": "c769a3dca8c8c9f2499a7a1154ad7b1ddbe84087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978092, "uuid": "c3452632-4eb0-4ab4-9ba9-d90a59dbe4dd", "comment": "Malware payload (Formbook)", "value": "946cecbf071a9c38fc7db69f4235e195ec73fe94a636637827f5e1c7e60bf2d242b7bf1e411bd8c8dbfe6c9a014aa7e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978092, "uuid": "db3ef207-0d0e-462e-b077-41a40b67fb85", "value": "T1F3D423C578988756CCCB473A1FDD419647313B29D803F7BCCA9E388A88BA7143622F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978092, "uuid": "5dc3f279-69e2-49d3-b485-afd3e3e3ed87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978092, "uuid": "6ea2e081-aad4-4c44-8c8c-a0e6e594c1a0", "value": "12288:hO725mDTMdu7gQj+it4Uh/7XEMiJB1xNReVE4zd4Il8MRsw:nF0EA5z9iP1xNRIdFRsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978092, "uuid": "04772f8a-b366-4487-b1c9-63c19999d1a3", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978092, "uuid": "7bb9a4eb-97d2-43af-8d80-3edb1a47d7f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978092, "uuid": "81456fe2-c6de-4885-a888-893a51b8cd9e", "value": "Stampa Di Evolution Order.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6234bf11-5f01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696017004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017004, "uuid": "23b61ab5-81e5-410c-a36e-77e2d18d1cf4", "comment": "Malware payload (Mirai)", "value": "93294eafbb660682463c6474d9132a02", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017004, "uuid": "f9a365c4-178b-4198-b074-746babb12ebc", "comment": "Malware payload (Mirai)", "value": "7161f825248182ff4656e716cba00c5b20bc2f265635ff0d3a8372c0ab2244c6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017004, "uuid": "3a28ed32-8986-4fc4-b5df-6f9be829472b", "comment": "Malware payload (Mirai)", "value": "93ebfacebd0ccafdc2cd1bd21287ed2df6dcd8eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017004, "uuid": "eb5f63a1-5a56-4eb3-bcfc-d42502310bfc", "comment": "Malware payload (Mirai)", "value": "004200773a52609f624c3d4b7c9b0a11e4428690601b35363577e788fbce139ef959ed08148901825ad94d45840f1605", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017004, "uuid": "3e058a41-bd11-4328-ad92-1b82f7b1a5e7", "value": "T198C2E1FA3E37799BDA39103A38598E329674E411D79FA753A240424D31131BCBB319ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017004, "uuid": "409e3f7f-39a8-442b-a56a-83bb0cec30de", "value": "384:Mp1DMwk8JPyG3GDZaEXVZVBy6HInRiWLRYh4Sw4cGJYeRzOFGBzd8QxQYkM9exNi:UMwoDZLFbBy6HQHRYfeAxdd8/YVN0NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696017004, "uuid": "4efcb6c7-99ee-427c-8750-d46647cf4618", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696017004, "uuid": "e1b8dc41-aa8e-474d-9480-4e7693e0a2e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017004, "uuid": "3ed9d524-01c1-4ed4-9d15-ad49441ef7ed", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9f556d-5edd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696001452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696001452, "uuid": "4e134e3d-3850-4e57-b1a0-53028866ee39", "comment": "Malware payload", "value": "b63087ee0da6c8c6e791ef6148965d0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696001452, "uuid": "e81de99e-1341-4d3a-874b-e818537c61e4", "comment": "Malware payload", "value": "7166a2d745495985dbb20a4e67387d9f0f6799ed9bdbe16a452805e0519eb38b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696001452, "uuid": "02594fac-d1a1-4cf3-85a9-960cf2f98570", "comment": "Malware payload", "value": "c4f365e6b775b27b7c12c164b552a31bd3578f78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696001452, "uuid": "482aa24e-1c2a-422a-9d97-0a798ac8bfd1", "comment": "Malware payload", "value": "9cbddc16df22a95093927c306f8abf2e02d35e4b572073ca884e0a10c230d2f5926774d9ac174b09d93d85fa4c691ac6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696001452, "uuid": "1ae8c168-f972-4b0f-9211-a3a0b4dd24c7", "value": "T1B1749E1A75D28477FC7124324F90DBB9953E786448821A7FA3A43EFE4A74F90D632326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696001452, "uuid": "1d0d1528-312a-4aae-82ac-cb0cbfecac4a", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696001452, "uuid": "07743615-7b3f-4d92-8399-8d94b655a800", "value": "6144:OCTeW/s5GqrO5aXnfEGIXWPvZAOPymhGFpF/YEAdvqNQYDMVs0BC+:wmcGqrOk86xbGFvYEAdCNLIs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696001452, "uuid": "1968637a-337f-42ee-979c-d488ba67a1d5", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696001452, "uuid": "33f7152b-9054-4675-8a21-f2ba1fab9c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696001452, "uuid": "2ac51af5-b3f8-424e-af51-06dbaa8a2524", "value": "b63087ee0da6c8c6e791ef6148965d0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e58b90-5e91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695968822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968822, "uuid": "0c69d542-9d10-4b50-8ce8-c90bdf6151b2", "comment": "Malware payload (MysticStealer)", "value": "f9c403c1c4b55521d5cb06bf5232ca0e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968822, "uuid": "73ff775a-2d72-4630-bfd3-80b48682b28b", "comment": "Malware payload (MysticStealer)", "value": "716d31755f09d102d83a35276c9c6422c490757eb7c62f9e39a3263ba6057267", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968822, "uuid": "8a32421b-a41a-4304-bb51-2e3ebb2fb43c", "comment": "Malware payload (MysticStealer)", "value": "6f2cd23f0c816475dcbdbc60039c0aa7252a98fd", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968822, "uuid": "0883bfff-910d-461f-9fe6-a6cc64352077", "comment": "Malware payload (MysticStealer)", "value": "9fd7d3d5c8a24e9b2989fa2c409ad8f4eb3a4841d18b5e3312eb21118ae68653fb44e89d429d14574d5e06c1e31a09f6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968822, "uuid": "739b9d9a-2f75-4a01-aef1-71840d6f2f1a", "value": "T1145168161FAF1720F7F7497698BA561189337862F9259F0C41A1DD8C68AA900FD28F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968822, "uuid": "9d602945-fa22-4fc3-b14d-d82cb4c92a20", "value": "24:8zRPJBvlTy2lghGCA7P5J+/35+bNBMg5KMQRXkqhaOSk6BMQF5ukOaOSk6eUAi85:8zRzL7xLp7ekMSNZukKSNeU4OLOQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695968822, "uuid": "f9ec001f-d39f-4ace-860e-ff24d3efae91", "value": 2441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695968822, "uuid": "6b233f38-70b6-4112-b751-612c1eb9879a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968822, "uuid": "3d4c470a-8682-4841-8b38-8c222c6e5434", "value": "Cosmetic product_list_2023_Quatation.Approved.by.CEO.xls.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d35f2d3-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024350, "uuid": "79c2e86f-b997-43ca-8335-af7df3cd75ba", "comment": "Malware payload", "value": "2518099b63836243bd724b3cca2d84e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024350, "uuid": "d0a2f962-5bf9-45c7-aa67-a535423eb192", "comment": "Malware payload", "value": "721e0fc3c482f4203cdc351948df9f3a43a50e53bba3b794d5e768aa88340ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024350, "uuid": "68d9e418-3b1c-4182-974d-3f3b29e6a2f1", "comment": "Malware payload", "value": "857c5ca01fbb7f61a0674f3c0206917b7f973d11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024350, "uuid": "5e39d599-2b1e-4137-8d79-f1cc43fedc29", "comment": "Malware payload", "value": "30f79b64ff20ff66e2f0b80a5e574d35a4a0887bf24d39202cfc76909b3b398d612ed68de5093589209804e982acb8a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024350, "uuid": "957d9dfe-a7da-4caf-ac1f-615decfa1171", "value": "T132342392983ABB5EF14817BCA3DF0AE1A5558933743F437BE0C51484B0B1A7688DAF4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024350, "uuid": "e1452ca2-5d25-4d9a-a508-cab8d5818da9", "value": "6144:OaAbh0iT1TMAunvgTytDOIQJUBDeFed7dp:whfhMZgtJUBSFedxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024350, "uuid": "29d1cd03-8e15-4ae8-a155-8d5745311e7b", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024350, "uuid": "37914500-3df3-4b04-a3cd-5369f0ab96f0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024350, "uuid": "c019a7f0-2835-480f-9f2f-d6842420e8f6", "value": "288327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf00a7d-5ecb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695993961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993961, "uuid": "2216d1d2-154d-4218-b189-69c4ace2a90b", "comment": "Malware payload (RedLineStealer)", "value": "bdbee32664141cbebbf64c9c1b75dcab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993961, "uuid": "72fc35c8-2848-4add-b558-850e0f3d0bba", "comment": "Malware payload (RedLineStealer)", "value": "7246254d224a08d78eaad8bbcb7b83c10b28ef4c3e77373b4602edea4c1e61f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993961, "uuid": "3b78dcfe-0bdd-41f7-b671-a93fa02911dd", "comment": "Malware payload (RedLineStealer)", "value": "b00a5cbb65cc25d94d607ffafc4782d8a5d8fba1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993961, "uuid": "ed0f4a38-9878-42f2-bd4e-46b2b3a85a20", "comment": "Malware payload (RedLineStealer)", "value": "ebfe6e9288c832cb43123ffae0f9a4b81c7033aa6b7737a15789df70e8ec40d89a4e2d71569008780a07befb50a9fe1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993961, "uuid": "d07a694a-a31b-48e1-9fbb-8e1d6a10b9b5", "value": "T184152343B3D48073D8F9673008FA02D31B357DD45D70926B2246E9AE1EB3998AA77727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993961, "uuid": "edc0c7ee-234e-4396-bb3c-fa16f3150447", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993961, "uuid": "b6631f5c-0bb1-4316-8ce3-d3288f5ef889", "value": "12288:MMrEy90I+DUiHD4c/WwtPNgrNgYrQIFO/ax/YpIOd/Dvjd4dsICqhdcE3VaqfgTL:AyZ+t4c+aP2reIFAae/zad/T1I39J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695993961, "uuid": "ab7c34be-56d5-4154-856e-fd8d6be3ad56", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695993961, "uuid": "bc0e0491-f8be-436a-8df8-88e5545b3a03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993961, "uuid": "7aa55c03-ea33-4d9e-ba01-c72edb221b2e", "value": "bdbee32664141cbebbf64c9c1b75dcab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2562311f-5eec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696007882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007882, "uuid": "9d976657-b32a-45b1-a856-c095c96f7d1f", "comment": "Malware payload (Mirai)", "value": "7f69a86c9cbef6fade619296cae7b5d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007882, "uuid": "293f7141-ec52-49db-b686-356042f52796", "comment": "Malware payload (Mirai)", "value": "72cc69c3a225d15807396d2d13a2ecb1af325798b96aa0f43d5be59dd95759ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007882, "uuid": "0c4d8d23-47ec-48d5-85fe-8355e2ab2513", "comment": "Malware payload (Mirai)", "value": "b1daabe2a4eb2c1e735a6dde95802669c5f36206", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007882, "uuid": "4a0a5d4a-58eb-4f84-9f27-b51918886155", "comment": "Malware payload (Mirai)", "value": "da7c05011d3f2a8f82092d7bfe9e36094710b85608e06c095f0005033de62e6a127a99c609dc36921338b56b481993cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007882, "uuid": "683b09ca-b6c5-458a-95f8-5fe939feb230", "value": "T1B3B2D0CC61943084C58D7C7C678D4A664F6CA1D0BAED9F16E350CD98B3BEA8B385D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007882, "uuid": "fffecc10-f22d-45b4-a813-07eaa30913ca", "value": "768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBp2uoZq8Wv8:BQlS07FUXqIYSXQKqukqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696007882, "uuid": "b8274aae-f8d6-49ea-873d-cf48405cc040", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696007882, "uuid": "439d911d-6615-4cfd-8802-dcce61d44464", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007882, "uuid": "5fae9584-1015-4ffa-8825-330ddedca284", "value": "7f69a86c9cbef6fade619296cae7b5d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481caeee-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024261, "uuid": "200101b4-5c70-4d8a-8310-73a6c3de349b", "comment": "Malware payload", "value": "ccf2df04be056d90deceb9dbf50f3719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024261, "uuid": "bf2fc296-914a-4703-b070-99a167b7c00a", "comment": "Malware payload", "value": "737d6ffd1bb4d817f95f96cec7960f3f8b8aa6ff496b732a17fad1cb15db77b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024261, "uuid": "e92ee3ff-77b4-49ca-948c-06e71b811f7c", "comment": "Malware payload", "value": "ae2b9930b44d32f93da4640e7fa228226ee18b91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024261, "uuid": "3257ae64-0004-4039-8338-15db895f4fa5", "comment": "Malware payload", "value": "5aa457328b45609ca0572ee0da6392feac09e628edc38e13b4ac3df8145a84ceb05e8f775b20399a4c0108405a7fd282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024261, "uuid": "c6d1ef17-2f2d-4a44-80b5-73d6f14facab", "value": "T16D3423D4C1223428EA64F7A84F316BA39E8426B8F85205D1D1F7C2F55C8D7BE84B5E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024261, "uuid": "51f7d2e6-2741-4521-ab2a-610612fcb60b", "value": "6144:RCefZgV4GEPsM16L8INXoy4LpJhaNLA581C/K:DfZ3GKsM1o3oy4dj2AGqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024261, "uuid": "58eeca7e-adb7-47c4-a39a-d44216beff9e", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024261, "uuid": "818bdc82-6c34-4895-96b2-64ffd9e1e331", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024261, "uuid": "e82f655e-00cb-423b-8679-29fc37ada587", "value": "288315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07151939-5ef2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696010408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010408, "uuid": "99cc139d-7d0f-40cc-8081-1aeb0e9bbe7e", "comment": "Malware payload", "value": "38974d1d106aad67aff4cbff76ee449c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010408, "uuid": "d174a15c-7e60-428b-8353-cc59dbac0b9a", "comment": "Malware payload", "value": "73951898957840702246fc9a0dcb0851ff2846a9d31f972f6b978d3b0526e272", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010408, "uuid": "4f742bde-40f3-4cae-91f2-c08ac473eb02", "comment": "Malware payload", "value": "4e2bf8c823b73dcabde7c9d4ae9c6a50d165bdfb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010408, "uuid": "7776ab2f-0ec9-48c4-89a3-797c6071350a", "comment": "Malware payload", "value": "db3603a912c648912a45245a56aa92f9dd731d7c74a9d3eadf3226936091f8461e9e24cc8f5c45643e50f9b67a6d970a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010408, "uuid": "187c88d1-f34c-44ab-ac79-09d3443dc685", "value": "T1D3C2D1E1A71F6A20D4302470C73887EEF9A518F4E4FA7B0E2D8643586B0A056A5FC64B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010408, "uuid": "a68a3ae7-2948-4f2c-bf6f-0f31b6eb73b2", "value": "384:kjiZ0dsJnavf/4sUJpyStTdKWA9tHESD9tdb+c3q3uC4c0SHdbwYahymdGUop5hT:kO0dsJuXpBSNdmj9DXRtG2FSlms3Uozl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010408, "uuid": "af567e63-d847-450b-8456-1c523292f296", "value": 27552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010408, "uuid": "768f10fc-0012-4f8d-be9f-e9458e6138be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010408, "uuid": "19306315-9263-4e47-a561-a8f202a4f970", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db942f46-5efd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015489, "uuid": "0046a191-4a9f-48a1-81ad-e7a4b41abfdf", "comment": "Malware payload (Mirai)", "value": "0f83386184ba5c6251be3cb6608c07bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015489, "uuid": "516c44e2-761d-4c33-96af-eb8b473c74d5", "comment": "Malware payload (Mirai)", "value": "73ab025078664103d0e93b8c72ae7cb45dc92de9acc20edf54502c34311228d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015489, "uuid": "860fc65c-9db6-44fd-a0eb-6335283a839f", "comment": "Malware payload (Mirai)", "value": "427577f98e8cad2e586bf62216ad62a3f04ba19d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015489, "uuid": "0cb3d1eb-b57c-4b3a-bb72-891833485d9b", "comment": "Malware payload (Mirai)", "value": "0f9824d197d5ab53d700e2c5a22e39d24a4eaee903c143a8b2e3cdcf8e79eb1af40791f4c47cea2e097d84dffaa7e7f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015489, "uuid": "aacbb98f-0a0a-4717-8186-5edb2d3fd7ab", "value": "T1BAB2F1C5D6FB17C3C2A1C336D47C9A4DA6722BC00347410A210AB24F979764E4BFB3A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015489, "uuid": "323ce646-416e-4b75-99d2-86a6756d85b9", "value": "384:MCDKKQOcRpmYLdn6RBOFRFt5rUFW10iSelCo3AnupPFNqnrrd1NEZgO8UXWozPLe:P/QOC0Yhn6ROHWFGrcwNVFCnNBxcPcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015489, "uuid": "c527c565-ad91-49b3-8b40-4d7ebf88403f", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015489, "uuid": "2e4ef53a-2ed0-42ee-8b78-98f92fa455d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015489, "uuid": "eafeeddb-fa52-4e0a-a5dc-bc6875270620", "value": "0f83386184ba5c6251be3cb6608c07bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55baf949-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024284, "uuid": "0be5869e-a58a-4bed-b7a0-b325f2986b48", "comment": "Malware payload", "value": "43f5ae2c78e0ef2fb6f2723d946a87f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024284, "uuid": "04ca8e67-1860-489c-995c-c6ae284fb184", "comment": "Malware payload", "value": "73bb215286f9bc00a586ab009a09ee87c8bd143af27b23184074b81b6a104533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024284, "uuid": "96ae8762-2129-45e6-b210-6312f6a25755", "comment": "Malware payload", "value": "16f65c891bf343ec3fe6b0b1ca57f3d1ec377276", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024284, "uuid": "a8c7c303-4b96-4c53-bee1-3ac11628278f", "comment": "Malware payload", "value": "ce107fc3daa55b3e8338175df48501c7a0938effc2171b183483f65f8e670b7012ca49a170bac3e5cc7b8644ce504ef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024284, "uuid": "78475538-3e29-403e-a003-bea6e0617168", "value": "T1443423E648D50CF821AE609D5D9020DC7D0129D637EFDABAFB4745B08A552333FA0ADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024284, "uuid": "d8cb149e-9e60-4c80-905b-dc8637228fd6", "value": "6144:MexT2KfUVeLMvUAYxNVUozKnndSR3qj9hxxAy/ovbUxk8JrTM/:xT2iPIHeinwqj9vDmb98xTM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024284, "uuid": "7a3bbb9c-2aab-4db2-b249-2028447c2a11", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024284, "uuid": "bfe7b834-d01d-4fcf-9a1d-6a97edbe3392", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024284, "uuid": "c6978964-6cf1-4cc9-9504-59e92e1303e1", "value": "288318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9ae18d-5f18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696026744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026744, "uuid": "b839c94e-8055-41e1-8fbc-aca35d8f2f61", "comment": "Malware payload (Mirai)", "value": "05d9f3a6d9602e1ff33b724d1abc5850", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026744, "uuid": "1467793b-fb43-40b4-9da2-a7f8a7698d2b", "comment": "Malware payload (Mirai)", "value": "743f2fd2da6546ab201e2e8a990010f09f27e84e4add9b4b0bf1d828c9b2f9bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026744, "uuid": "c5adf34a-097f-466d-bb47-2a0c9b8f68f2", "comment": "Malware payload (Mirai)", "value": "6fa262393a1c89940fd71b516418cba72efb8ca4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026744, "uuid": "4c3475c0-861e-44b3-848e-7042f48e0546", "comment": "Malware payload (Mirai)", "value": "ab1e4ae2df19c84e8f18ef4980dd7375bc5b7a50903ff5f1f80d0202296a5a307fb2c1b23aa46c0ecae6a7ba27fd4630", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026744, "uuid": "db81326f-c52d-422c-a35e-010d1216564f", "value": "T170338CB5C579EDE8D1144A78BE248E749723E000C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026744, "uuid": "961911c3-6942-4d4f-a211-a053defe27e0", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvt:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696026744, "uuid": "e190aa0c-6f06-41b5-96ec-c47d9a0ab255", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696026744, "uuid": "87c644cc-6032-433e-b278-24ea2d750519", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026744, "uuid": "edd3bb92-0410-40f1-92ac-2cea5003e474", "value": "05d9f3a6d9602e1ff33b724d1abc5850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8084079-5eaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695981983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981983, "uuid": "6ad2953b-01c3-40af-87a0-9d48c8765c3f", "comment": "Malware payload (AgentTesla)", "value": "5225c117158395201f37eb2e29da7dcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981983, "uuid": "44c07567-587c-43a2-a4ac-96a96ed7e3f1", "comment": "Malware payload (AgentTesla)", "value": "745a2e72b90992f95d56b53cd3e8af6182a6f00f8187717c731dfdae657a882c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981983, "uuid": "5e90301b-4b2e-4114-9f69-3eb467e0ca36", "comment": "Malware payload (AgentTesla)", "value": "85e8c2c34360512246f9624b210f31504482b274", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981983, "uuid": "9367f565-57ce-45b4-b305-b649ff09a3ea", "comment": "Malware payload (AgentTesla)", "value": "3fb496f74699471113600c0d44c0ee228448844875ea1bbab79f5846136daf23c9e1757820271ded3b1bda1fdcccd624", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981983, "uuid": "80bd2197-b58c-4282-8395-5b5a8fd78337", "value": "T137A31208325FD955FE395199F44796AD0EC2BEB04AE12B23EB9164E6C7C0D0E4BF2603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981983, "uuid": "39c52f02-3458-4a06-8e93-44237c84f5a0", "value": "3072:d684dR/U0YVs6PDVKnShQcmGHwmUecZe6K:dJTSIDVKnncHwmULkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695981983, "uuid": "9edde939-ea03-4c62-8e18-ab999e1f0bbf", "value": 98607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695981983, "uuid": "acd40139-808a-437f-b11f-0f5ac50f7ad3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981983, "uuid": "21d38e08-f6cb-41c6-b155-2392375d132b", "value": "PO--080523-FM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38dc0cf-5f22-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696031340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696031340, "uuid": "954a990a-d510-4020-99d7-d982433a15a8", "comment": "Malware payload", "value": "d58a3798fa315495da907729469d1df7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696031340, "uuid": "be1d2abe-23d1-4531-8233-fb9b9ecce89a", "comment": "Malware payload", "value": "74836002d4823f1f9b07ded5aefb9683451e088a6f448526f2be887e3e21496b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696031340, "uuid": "7d719b1b-d970-44be-bc86-5ad5a53d4112", "comment": "Malware payload", "value": "cd45027c88684949fb8c432b59ac3af62055d35b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696031340, "uuid": "c1442e60-620c-4708-9970-cc62c1793bc2", "comment": "Malware payload", "value": "a4c9c7b387344931f6d08ebb8675da8d3ad6bf0f5818c74df7ad9b1f758b69cb1d60e49df382cdd98d287d2149241dc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696031340, "uuid": "ed470f76-dda0-412e-94a9-f5bde08f7c0e", "value": "T1E574BF21F0C38471DC7355390BE4DAB44A2FB4A04F611F9F57941FAD9E302A1CBA5A6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696031340, "uuid": "b0adddc6-b3b3-45d0-93b7-1ab766809eff", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696031340, "uuid": "b50bf36a-fbb6-4877-9f28-d78bd3d4b90a", "value": "6144:ndTeW/s5GqrO5aXnfEGIXWPvZAO6yy7Qc24tMwPnteiHD6bEFAVs0BC+:smcGqrOk86xY7H22f3Tss0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696031340, "uuid": "154e4982-453a-4d90-bac9-28a44f1e283b", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696031340, "uuid": "64df2315-bd71-4725-9de7-73785b93531d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696031340, "uuid": "1a49e1c3-00e4-4520-939f-0f5f3d54e716", "value": "SecuriteInfo.com.Trojan.Inject4.61510.24680.14440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ffc200-5ef8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696013007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013007, "uuid": "66c067a6-d264-4974-a786-184774202733", "comment": "Malware payload (Mirai)", "value": "72f05dc9969ac9d01bb3c950e4113e5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013007, "uuid": "c101d10f-a584-4117-bc21-f6bf77a4aa9c", "comment": "Malware payload (Mirai)", "value": "7638b8f899eed622444bba6ea40d5e72f22ceacb237f6de7862535993cab41fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013007, "uuid": "f770e052-59ff-4253-8f19-4385587555f6", "comment": "Malware payload (Mirai)", "value": "9924a94f3fe9368caff58319544f63d037aa8d5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013007, "uuid": "7b95b686-f149-4824-b182-91d5edf04458", "comment": "Malware payload (Mirai)", "value": "1f043622e7721ce9208885c46bae823bc6e7e839c91bef3349cf96d2ff6e0135c4b75092c2084b7d2aaa322ba7c69d85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013007, "uuid": "04ef8253-de0f-4013-88e8-bd768304342b", "value": "T1B7A2E025D345AEF4DFAF9CA056C1D2C276E546C7268BC8E240EEAF022506046BB88D5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013007, "uuid": "3ee0354a-2eef-4787-ae96-f3c826e09e2b", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5TM4uVcqgw05VxJO:mRxsSVsMD6xiJJE5zRWNG4uVcqgw09M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696013007, "uuid": "36c5fb7e-da21-4efa-b812-a44fbba460fa", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696013007, "uuid": "47195914-5b44-48ea-bc03-b51ed3db61fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013007, "uuid": "8046d843-23be-4241-8611-68d57cfee259", "value": "72f05dc9969ac9d01bb3c950e4113e5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bb7044-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PureCrypter)", "timestamp": 1695977660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977660, "uuid": "a2600fc6-3dc4-49a7-8177-175c1e5f63a6", "comment": "Malware payload (PureCrypter)", "value": "0fa9a3f385fc1d0c61076a22cab73897", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977660, "uuid": "f4ad6575-1340-4802-8f78-701112c1251d", "comment": "Malware payload (PureCrypter)", "value": "776b34a9802587aa4b4c58838ea6a2f0947b7086cd8c97902fae7cf18f131c17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977660, "uuid": "6a95ba6f-786d-449c-ae20-bc117316ada3", "comment": "Malware payload (PureCrypter)", "value": "1d4292d02482184887e310ff8fa68f71641c47a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977660, "uuid": "10e54ae8-25d1-4736-b775-9ebdb4d03f52", "comment": "Malware payload (PureCrypter)", "value": "a9a58c52e9d6f72fcbfdbcef8b7b1ce23eee627ce31045b70d80020d7cacec4b87ac385fc9c09c9eae4f66a2e8cd4064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977660, "uuid": "6015391a-8b7e-42be-a38f-6044cef946ca", "value": "T1E2C2830A276CCA32D452B2B49C5B6BB2772CEA71DB557F671FF4AD161CB12CC08A2134", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977660, "uuid": "5d17e131-c733-4e4c-a364-941b5a26edd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977660, "uuid": "126ad0b5-7edc-40e6-b2eb-6a8c75c7fd1d", "value": "192:5MiUlMyvhk4IkKHzvLiPD10se9eae3e3eae8ehezlTSBPxSq2u3SDz91s461Oe:6l6OhjI1HbLu1g8PxlZCDhm48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977660, "uuid": "90ed0365-a427-479a-b510-a8e5480eba23", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977660, "uuid": "24f5cc21-1b6f-43f8-b108-e3873e14fa5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977660, "uuid": "d7c84035-7c92-4858-859c-de4cf4061ef0", "value": "Oauujj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d8e448-5e9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695974867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974867, "uuid": "ad857ebb-22d1-49da-b140-4b8d06fc0802", "comment": "Malware payload", "value": "99c476a32c37142818cf32724b992ca7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974867, "uuid": "007a478e-41b2-451b-a3fa-931851eac588", "comment": "Malware payload", "value": "779323771d4ebd97de44bdb9cb03e40156182b2012acfd444a4787902b0f1f35", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974867, "uuid": "cbd78c67-cc2c-4051-be78-d012485868a5", "comment": "Malware payload", "value": "68d1330bac438dbaf2f3026040a94661709ecb2a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974867, "uuid": "0b5c0a8f-90a2-4dd1-985e-56c121d9486c", "comment": "Malware payload", "value": "16fbf5917c1ff0f4f53703b4dd52203a6bd8936539728e3ac7c7eb011bb4c865d38a4565a1cac7e3e7c37529f286538c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974867, "uuid": "63890883-b78d-45db-989e-eda8c65f2a9a", "value": "T1F4E47C56E3F414B9D177C139C5534223E7B2B4651320A7DB03B08A7A6F23BE66A3B760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974867, "uuid": "f1a8a5db-a656-4f22-b55b-ce3a9c0e57db", "value": "c86121860bee8f7935c9ca830d327682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974867, "uuid": "a6a055fd-1fe4-4777-a464-cfc960b6131d", "value": "12288:vvIArRDjmkqR6tv3cKOuWmDxyEI+mVLIOlxBnvRI48+MVjt1wIbo:vvI9ptuWKxyEI+mNIOl7nvRId+MVxho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695974867, "uuid": "ac31c740-782e-4074-a343-a02c9dcbdc63", "value": 682048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695974867, "uuid": "93248235-1850-4af2-b745-c952f52e9b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974867, "uuid": "51584d8f-9ed5-44b1-980d-afb1ef0838a5", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ba0ab8-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986994, "uuid": "cb89afbc-5e9e-4deb-8ff0-bd5e6c3b3f82", "comment": "Malware payload (Mirai)", "value": "a5f1af30de12e2703593e289154c2828", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986994, "uuid": "b194e759-25ee-4871-b094-255d249eb5d3", "comment": "Malware payload (Mirai)", "value": "77e5f00a913dddf77b7857b6a602e4f591c8ac69716e45ca477ffa79885eaa4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986994, "uuid": "459fed0c-1562-475a-b7d0-bfc86fb87cb1", "comment": "Malware payload (Mirai)", "value": "747c7c385290469450c1b91db875e89618807bb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986994, "uuid": "11dc2a76-91c9-4c99-b602-dfd8c8bece24", "comment": "Malware payload (Mirai)", "value": "6c59395068d8cd9ca61e3c89ccdc1ef4f22322e19acb58d1977325cbc71ca7f5a4dc2abc6fe86ece616c937c8920622e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986994, "uuid": "915d3c4b-fd6e-480d-838e-535016372177", "value": "T197D32906B31C0B47D1A32EF03E3F6BD093AF9AC121E4F645255FAA8A9171D325585ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986994, "uuid": "18a7683b-1d5b-46cb-849d-67b393078c03", "value": "1536:h3gCaxTCNqebcqxpKvHR/ORySsOLX4B9ZrXFvAkWuk6audsqbk24xdCHl1dTA3:nFcqx8fWyQX2rikmxdCrpA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986994, "uuid": "02e4957f-5c4c-4e3f-9466-2d09482fdcef", "value": 140156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986994, "uuid": "7b194004-6eb0-411c-839d-7f02734aa6d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986994, "uuid": "69b9ae71-c35a-4e97-a4ce-c26cddc70b91", "value": "a5f1af30de12e2703593e289154c2828", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de1fa2b-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024325, "uuid": "719ebcf5-ee0f-487a-ba10-0a7c53f4cb05", "comment": "Malware payload", "value": "7d43f9ce022c9933134d1d81ca963da1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024325, "uuid": "b927ef14-a638-437b-956d-8d557951b2e2", "comment": "Malware payload", "value": "790bc811d9d68226be7b027bb781aadd288cb1584b733e5dc5c2b81cfebefa7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024325, "uuid": "0180ee96-9571-4195-b6dc-800e28d37e69", "comment": "Malware payload", "value": "5429ec2a2617cb2430d3fd247495fe928678b1f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024325, "uuid": "0ecfc207-5222-47cf-9f2b-07187fe3bc96", "comment": "Malware payload", "value": "f610e09ccca2e3069c128e353a9976cbc76224e5f2f91eb90766c81436d4c57a4c4bab232a818f635e7ccb46bfd2ae9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024325, "uuid": "c6dde330-3d52-414e-8916-6dfae99938b1", "value": "T1D7342393A2B1FB0C4593A8F0220694A25A8653D97D953FFB7E8D32DEFCB090294D75D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024325, "uuid": "b893d62d-f268-4e6f-84b4-e6a0ccac6b10", "value": "6144:wBiavRoRgsjHwe/uVf8XYd0nRhA90tEjiugVxt6n3n2pA/n:wBiaArjHw2wf8I2hA9NLgVWmpA/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024325, "uuid": "5945af5f-b7d8-4450-8109-c906a318f807", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024325, "uuid": "3dad7b83-ebe1-4fb1-85e6-c91519ee3040", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024325, "uuid": "55cec463-c010-41db-bd41-6375ed54fd73", "value": "288324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac79e8d-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1695986685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986685, "uuid": "a3af9e38-9b11-442a-ac93-e9d4d8df8792", "comment": "Malware payload (AsyncRAT)", "value": "a3b6093b3cad17545a9203797b99f9d4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986685, "uuid": "dd3def87-22f3-47ec-8b28-a5d668ae0592", "comment": "Malware payload (AsyncRAT)", "value": "7a5e40af0dfd5001e398e55cf25568bea05420d292bc44a6fad390c702073d17", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986685, "uuid": "4f465212-53cd-4160-ac10-9e549cec436f", "comment": "Malware payload (AsyncRAT)", "value": "d482882fa433bcafe4f8f7c4e3b4cc3a83c0e14d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986685, "uuid": "52ffc0c9-93aa-4dda-b690-b921e6b68d12", "comment": "Malware payload (AsyncRAT)", "value": "454a72adb905120287be530b4ffe62a56a17bd23ebfea34751a52854312335654dfd83767b797173f2736419e120f782", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986685, "uuid": "f9f1b067-2269-43b8-9a8f-cc5fc3e032f6", "value": "T1B6B4CA1065EF95CCF1B37E231FEDB6D58F2BFBE51626909C2104030B965AA84CE59B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986685, "uuid": "e790ee9f-c37b-45b7-9fff-6c2369c9c995", "value": "3072:KrhQRfxmRlHRWpTC5nNcnL+ikkkkkc9r/kkkkk8xekkkkkjkkkkksKMXvkkkkkdo:mmZOlH2TLnZ9r5xDNDkqWKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986685, "uuid": "a28defbd-3a4c-449b-8f39-4083215397d3", "value": 511044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986685, "uuid": "f952733a-5899-4c17-a894-c2d55a651f41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986685, "uuid": "f9344108-812f-41aa-a002-30f8020ec196", "value": "REMAVISO_653756733328092023.xls.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e012035-5f0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696021157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021157, "uuid": "a30898f5-d1a7-40f2-854b-e2043eb70cde", "comment": "Malware payload (AgentTesla)", "value": "06f147c654c1259b0d2af9c564b49dd9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021157, "uuid": "d675b92e-6b52-4b82-a19b-18c535bf19af", "comment": "Malware payload (AgentTesla)", "value": "7a631e00ff1ab35bf5919126f15f36f1efcd29f5fe584fa4df7521667b411854", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021157, "uuid": "80326011-65cc-4728-82f0-9f22b27b3d10", "comment": "Malware payload (AgentTesla)", "value": "f30ab4d785a99a71bedb1638167e8511e74cdd14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021157, "uuid": "4d1df69b-3e63-42e8-b532-6c7c4f8cdac2", "comment": "Malware payload (AgentTesla)", "value": "7630c12dc08f20a5d6f78968c77cb8b17f15074651c3c9f982982a2b54f8a234dc3a2dcaf79bd59951b2c727a0ec625c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021157, "uuid": "a2eada85-58da-4219-93c8-51284537f2ff", "value": "T14FD4233005C2E605EAD51D76F79BF3D08217A2AF2452534BA86F7CC63B61E7CEE58281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021157, "uuid": "2c58e3cf-ac67-4595-bca2-dbfc9b2c5cce", "value": "12288:A3U+2+Pa6z9saVM8dnUu916IL2AlAqFsluMg6ib+Mhgs53Ho8Cc:5+2+RzbnX916C2AlAq2lulnCE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696021157, "uuid": "91748b99-8f89-4e30-909b-77f437b54901", "value": 643851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696021157, "uuid": "e3ab2135-316d-44e6-9008-9a3b100bda5c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021157, "uuid": "644933ba-3c4c-45b6-b233-8ac314db677f", "value": "swift_29092023PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b486ab-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977100, "uuid": "dae6a1c5-9d28-473b-a32d-63240302c3e6", "comment": "Malware payload (SnakeKeylogger)", "value": "6f820a4bdf920b7cfba582b2f52aac87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977100, "uuid": "19df8733-a420-413a-8eb2-228cbe705991", "comment": "Malware payload (SnakeKeylogger)", "value": "7b2594bef48e15617990e73122879220c97e63fd640d88c9570c4e86f130ece8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977100, "uuid": "870bd5f6-9d02-4e94-bce3-866fd71dffa4", "comment": "Malware payload (SnakeKeylogger)", "value": "dcc2e483f5cfeb42ed85cbe877a4fea3f81a3ea9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977100, "uuid": "f234cc69-20a1-4614-9110-e9f3e9a9ec54", "comment": "Malware payload (SnakeKeylogger)", "value": "8ccc69b263b76774b938892aeb91c862a97f804a12a4260ed5eb4cad327a6142e8fdb0dac2b5ae0fbd54ac94676f4842", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977100, "uuid": "5ba88189-2d30-4407-add5-a7d3600871da", "value": "T1A9E4010627D112C0EABB277599A6117147B3A921D93DCF2D0DCC60CC2BE7BA0B649F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977100, "uuid": "bc41b0af-c328-4b7f-a49a-37eb3cb7c767", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977100, "uuid": "3fcc9c8c-e832-476c-ae0f-cd3acb34709c", "value": "12288:ecuAckjsqKDyng/mwz1btO+6755N+l0DHDlZXc7c9/ckOWtGs4LBkgpD7ET:mkYDyng/mwxbEHQqHbH/+FL2gFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977100, "uuid": "083acf16-40d2-4532-bee1-5b780c9d45d4", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977100, "uuid": "54cbe7fa-03de-4c43-befd-d5e36035b20b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977100, "uuid": "22eb835d-d6b0-4768-b295-9a09d37b2d95", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a014382-5ee5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1696004964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004964, "uuid": "963330cf-e11f-4c79-90e8-d8775ceac50a", "comment": "Malware payload (RustyStealer)", "value": "5ce47fd612555d33fd5a5ddc04acb57a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004964, "uuid": "c3936e75-62c7-4b9a-895e-16974b5cc994", "comment": "Malware payload (RustyStealer)", "value": "7b37f095f7bdabaa7d841b41fa99708d58790e2b73887118ba9de74a0e6bdd39", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004964, "uuid": "69f74de9-8e01-4a7b-83a0-34113c4f1197", "comment": "Malware payload (RustyStealer)", "value": "8001e188e2d02fec2230cf59d585bb560bdc9763", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004964, "uuid": "25f63b72-5b71-4795-b27e-01ad4ea45283", "comment": "Malware payload (RustyStealer)", "value": "02b8ac192135165ba080ffe5970c6a4c8de1f34ba22447d060e164260b643ff438edd6f29ec168bbc777172892a66187", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004964, "uuid": "0f4b2229-9637-49c3-9971-bca3344dffd5", "value": "T179F4F116FE4A60FDC46EC1B4821725227976BC890B2179FF12A4723E6E75AF41F3D608", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004964, "uuid": "f5ab457e-17e8-4a1f-ac37-c3f763b6912f", "value": "1324e912b3362256e05e802a834f2c40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004964, "uuid": "ffefeae7-1fbd-4e9f-a80a-1bb6dd6aa453", "value": "12288:U+16R2LddlvB2v25xRMru65uZEKG+uaUMVQQSsbCGe1f:U0JLddlvj5xyF5uZEKGaRVTSsb9+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696004964, "uuid": "c1fcfaba-e7ad-4244-ae2d-ead43b8974f6", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696004964, "uuid": "4abf0e50-33b8-4004-a7e4-a76bdea159c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004964, "uuid": "95bd30e9-0359-4671-885d-52ec82551873", "value": "123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a37a421-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695986899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986899, "uuid": "2cd984a1-918c-48e2-bb02-d0721a34cf5a", "comment": "Malware payload (Loki)", "value": "7c6259d70d7b10251e0a0f9931033863", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986899, "uuid": "2cd5a5b5-b6b4-4264-936a-d38f12656311", "comment": "Malware payload (Loki)", "value": "7d1ecdb6f4825c42fd25d761f94b4b9b460c8da0f5e7b84b7b8b4fbf25c690ff", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986899, "uuid": "4f02e636-e8f3-4d62-a876-deda9f1581a4", "comment": "Malware payload (Loki)", "value": "6ec330fdb52cbb785d57ca0427e8e3996f387204", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986899, "uuid": "777a37ef-3e84-42e3-86fb-4436d7a552a3", "comment": "Malware payload (Loki)", "value": "30b4b99abb8465480cfa3fa149d7eea3d687caf3332a1c9c0c1c31c7ba9b013ccee6560e5b3cad105d8b1ae9252f4aec", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986899, "uuid": "f268388f-f853-40d5-82fa-a53180ef4c84", "value": "T1F5C4F102ABD51181F67E22B459B1217143F77A659939CF2C0DCC209C6BFBB50BA84FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986899, "uuid": "0bd92163-8c8c-4e0d-8b13-9c51da7413be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986899, "uuid": "e9e621a5-5610-4cfd-9c2d-96d5cb2f90a5", "value": "12288:BcsAckjMIawDkafuMPo6TM/5QIaLPbvxgwnFz:xkAMkfIo6umdn+wF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986899, "uuid": "b264ac4e-2467-4134-a90c-aecf7371fe3e", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986899, "uuid": "ff1662b3-02ec-493f-ada3-05e140388a7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986899, "uuid": "f6457b09-dfd9-432f-9619-0c8db4976799", "value": "DHL Express_AWB#80125820822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae6660e-5eaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695981907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981907, "uuid": "a17637bf-a2a6-46a6-a173-ac724e5b2683", "comment": "Malware payload (Formbook)", "value": "5d51496d75df6969e707fc16970c9c2e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981907, "uuid": "edff97fd-bd4d-44e8-9d95-8bb8e5b8726a", "comment": "Malware payload (Formbook)", "value": "7d9994c10dc1afd596648bad3156e571c30f66667ddc7558097a1ffd3ebff59a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981907, "uuid": "9bc32779-edda-4b6e-a24f-ca79b7567d31", "comment": "Malware payload (Formbook)", "value": "6be0d19b811da758233951f95e483f8e76b5efb5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981907, "uuid": "3ec4398b-a712-4ff1-ab83-ac2da0d7e4d7", "comment": "Malware payload (Formbook)", "value": "14a05d350b70bd6a6a8da2e6920192db63698942813a879594384e4c65f9ed635aa73fa820b0aef96daaec1a644717f9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981907, "uuid": "6719d939-93b4-434e-a1c1-85d4ae95caec", "value": "T19284120AF262C62BCC26A834ECC9B4DFC339DC690F05E74F7186779F41319A18657AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981907, "uuid": "0f1267c8-0dd9-4c05-95ae-b140a85169fc", "value": "6144:Nn1m9kdbIgb8ylZetJs0hdMJUXcjjwhjWUOij7AKSVdssk:NOepblatqSdLcfY7AKcdss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695981907, "uuid": "3d01c3cf-2823-47e7-8b8a-d8a06884c0ee", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695981907, "uuid": "b04ba271-f1e8-4c43-89f6-45f92c26863b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981907, "uuid": "fbe95696-8437-4205-ba19-94e84e3a5a2a", "value": "Sample DrawingsOrder Sheet_09272023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ffece4-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695977047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977047, "uuid": "e904cd5e-88b7-4806-9402-d74b72d25ecb", "comment": "Malware payload (Smoke Loader)", "value": "ae734fd25e32844afea091f8331b32e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977047, "uuid": "ec5397bb-9986-453f-8c50-fc379bfb7dbb", "comment": "Malware payload (Smoke Loader)", "value": "7ea97f81f136aa078921e44fc6e10f889c998e0e393f4d3cd5a061b8525f6e1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977047, "uuid": "b2f9bce2-d9b5-4105-8eba-e15612bf51d8", "comment": "Malware payload (Smoke Loader)", "value": "b1dffb4fe5761d333d2f4638f9474cdbae38a65c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977047, "uuid": "5066ed9e-f318-492d-bbbe-48718254c980", "comment": "Malware payload (Smoke Loader)", "value": "e77f98a139f743051bcd7cdda43c517d13676024cad6391304620409aedf5d3922b4cbca6885454832fec5a3bd93cae6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977047, "uuid": "be6362d9-26d0-46b3-8220-f7be044a894a", "value": "T15034CE1171B0D031D5AB41358834D6F86AFEF8B39674898B37683FAF6D313916766306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977047, "uuid": "3b767498-62c5-41d8-a910-7d2205549703", "value": "14051e4df4c36cf261bf236adfea8971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977047, "uuid": "547704a5-68cf-41a1-b7a0-e469d7c5beff", "value": "3072:XWC+yl7PsQXI8cOVXN2OM4uC2LzhtJj6uqZtVz8Ln5cp3TTWLm:XJ9bssI8rr8ZxPjTqZtV4Sp3TTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977047, "uuid": "487237c6-7fe2-459a-ab7b-0e21c1fdb0e8", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977047, "uuid": "5c3c6d30-81b5-4e0e-9ceb-4427a84832b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977047, "uuid": "068d5e0e-557d-4acb-9236-b56e8d95e24b", "value": "ae734fd25e32844afea091f8331b32e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2662bfa-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696010239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010239, "uuid": "f4200122-468a-4ad7-99a2-14ba38409f09", "comment": "Malware payload (Mirai)", "value": "fc907f5af1826f697310ab571a10de3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010239, "uuid": "d19a9c66-1176-4e35-a05a-5d7c7af06196", "comment": "Malware payload (Mirai)", "value": "7f20f8917a6a19c5db4c0893bc3c36997efd5c97e5e18129a51b95749838ec99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010239, "uuid": "424496b4-1495-4e43-8513-7cc559a4fb0f", "comment": "Malware payload (Mirai)", "value": "ab491ce8d06ac0c4bdc527703087d660107e40c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010239, "uuid": "5f84ccd4-7d4e-4794-8670-5bf6166afb49", "comment": "Malware payload (Mirai)", "value": "788d3228fbedd795779b537ae02215cb098d22103deb786422395e7fc7ab16f7c1681bbffc8d61816bbc7e389a83a306", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010239, "uuid": "9cfdffa3-9566-4790-b9d2-dfef9b34c706", "value": "T179336B36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010239, "uuid": "6b807337-1ab1-4ef5-b922-ffe903d7cfb8", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010239, "uuid": "7c19bdd7-031d-461d-adf5-165ba1995be9", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010239, "uuid": "9789e30e-6f9f-4550-a61f-8821faafcd6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010239, "uuid": "2ae3361c-016e-4db3-b790-fcc39279a71f", "value": "fc907f5af1826f697310ab571a10de3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9065ee-5ec1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695989424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989424, "uuid": "e9baa688-b134-482b-8e41-b5f4e23fb35e", "comment": "Malware payload (AgentTesla)", "value": "b53d71a64cb165fb5bd36e7f22879546", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989424, "uuid": "8152ba15-aa79-43c0-a82a-73bb7cbe736f", "comment": "Malware payload (AgentTesla)", "value": "7f4c3b1a665c0cfac753aaae7812e6d60585a0a878ed1d8fa021be401abaa94d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989424, "uuid": "b3dce043-cd75-44d8-800a-1c9329220756", "comment": "Malware payload (AgentTesla)", "value": "0ba27f31bdd7a0847d012556266ae899685c730d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989424, "uuid": "135388a8-b76a-4dd8-8013-75718a8013e4", "comment": "Malware payload (AgentTesla)", "value": "05e85bbfc6a2f5489af342b7a770f3c3c8292e853193adc0eb24f9605c553c3d941fbc8e38053121096282a367e4245b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989424, "uuid": "9fa930ff-1ae5-4f61-bf2e-b88e432fda8a", "value": "T17093146ED38F02A88F520372AB1B1E9496BDB63AF35255B1346C533433D9C3D42266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989424, "uuid": "63fc72ab-2d28-4e5e-94be-5d5eb6bfaf2a", "value": "768:rC7Wq0BiIsxPpwkWfYjugztCUlkXba1C/gnXfXgLsaqcTKES9CDF2NR+:rC6q0BnpP4ugzxTXgL3qcRDUNR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695989424, "uuid": "12804e7b-451b-48cc-a6b4-a22b15b07c75", "value": 88887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695989424, "uuid": "0b933b3b-ad86-4919-baf9-f234a9641263", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989424, "uuid": "45067b6d-5895-4b75-a18d-ef0054f86d9c", "value": "b53d71a64cb165fb5bd36e7f22879546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed19455-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977189, "uuid": "ad13163f-1601-4d05-8cdb-e5a5b5fe13ce", "comment": "Malware payload (SnakeKeylogger)", "value": "bc65373fd5b20831b8a163b7feab686f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977189, "uuid": "1716ebbf-8000-4271-b889-dd682299e495", "comment": "Malware payload (SnakeKeylogger)", "value": "7f55e05562265419f3b71f902d68bcff87833e4896845a5662b6624d705dabc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977189, "uuid": "3ba049bf-b3af-4bd2-b7c7-e9cbc78a9679", "comment": "Malware payload (SnakeKeylogger)", "value": "d4b37030bbb788c5f7b90cc78c68c89e460a2954", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977189, "uuid": "4ca447fa-030b-438e-aaca-85a2cea9f24d", "comment": "Malware payload (SnakeKeylogger)", "value": "8f08c64e215950843e05d39767666854a6c8df0eb331f2e0cfdfc44d77852ceb7e18d4b494d7bf03fb5f1a02cbab9e15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977189, "uuid": "ffc025bc-0d54-403a-82fb-d2d4925d3d2a", "value": "T1EAE4123072FD1B9AE2BAC7F548655A18177478BE3126E60C4DC670EB15B2F80CB15E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977189, "uuid": "a0f5001b-6737-41b3-a087-83986df8d16d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977189, "uuid": "e0529c07-fea7-453a-bf15-ba22d6927284", "value": "12288:ntzyiRJU/WcDr/Zzj6Ofh+XH1G74vHewVMs0RzNOfHnU8Nb9vTTCgtb:t+Fei/Zz2ObEHewpKcvUCGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977189, "uuid": "3983524c-6ff7-471c-bbdb-dc871d74d326", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977189, "uuid": "ef897515-5a29-45b7-8997-2128b1ce29e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977189, "uuid": "4d6f60be-cae2-4271-acfb-6ed25768e988", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6e9c4b-5e91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695968837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968837, "uuid": "cf924c79-58a5-4343-9e78-4b0ab6d06f63", "comment": "Malware payload (MysticStealer)", "value": "130a62fd71a7ddb71e14bccdbfa96eef", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968837, "uuid": "7b86bb76-0d7f-424a-a67f-99ea3ec23232", "comment": "Malware payload (MysticStealer)", "value": "816861d37628099fa4f22a64d368ac9b581c04dfe793569483c87ee736886dce", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968837, "uuid": "03bc0e3a-9da5-4134-bbae-99ad4a7c43c0", "comment": "Malware payload (MysticStealer)", "value": "b19b5669734878479bef70b416fb2aa01a82d44c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968837, "uuid": "b8c7fd78-02c4-4a1a-8811-54a398e265ad", "comment": "Malware payload (MysticStealer)", "value": "73369a4cacce7151b3bd203a9dea808d715e15593cbf52bf423eef8679a40d65609bfe88e8dbfbd25d42d43426b0cde0", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968837, "uuid": "5ad3d182-acd6-42cd-8efc-9162dd643773", "value": "T11C5167061BFF1765F7F34A7289B6A2118A32BC52F5219F0C41A1DD8C6879A00BE18F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968837, "uuid": "ed754722-d184-416e-bf5f-94af29c6a9ee", "value": "24:8zRPJBvlTy2lghGCA7P5J+/KbNBMg5KMQRLWgHVUgYnSMQFduUgYn7UCi85hrOLm:8zRzL7x5p7K/1jYn5jYn7UqOLOQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695968837, "uuid": "7f50c3a2-d7ad-4c1f-a1ae-9a2680ccf886", "value": 2495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695968837, "uuid": "4de8a9bf-a845-40f2-98a7-3d8a9d730e27", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968837, "uuid": "35a2ea5d-73f6-4618-87b8-b4d5e7a227e5", "value": "Lingiang_Cosmetic_Facebook_Ad_Campaign_Brief_2023 Approved.by CEO.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc1189c-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987472, "uuid": "f2091619-c526-4d4a-8784-96511f9d4897", "comment": "Malware payload (AgentTesla)", "value": "d4b7e36fb1553c7392d21e96039339cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987472, "uuid": "fce60e87-600c-4877-b2ec-71b92ddebc9f", "comment": "Malware payload (AgentTesla)", "value": "819919f399fc0acbf006c2715ba275e0dc19590437ba6dd6ee6c461f1ec89e2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987472, "uuid": "12095b43-5467-41cc-a388-6cf1f7d820b0", "comment": "Malware payload (AgentTesla)", "value": "dcc6c2670734dcb7cc6ac0c603c2da8239c0839a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987472, "uuid": "8054f9f8-74a3-4645-8690-934d837343e0", "comment": "Malware payload (AgentTesla)", "value": "d7cc651158be601ea6b72b2ef4fd32354db6257da8213869f6c20068d9ae4a92168398c6409518605d46e055baa84397", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987472, "uuid": "5ff1051e-4d79-44c6-8075-8f3a5bc64c45", "value": "T13C05C3626427294EE92A3171D052F36D86458FFC4D37DA4CFC49B21ED272B831CB9A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987472, "uuid": "d1fa0d3d-e81b-4027-a594-ade03ca8771a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987472, "uuid": "f2add9a2-d927-44eb-93d8-51591d5f8007", "value": "12288:n2yLr+VcBh76VRglBruUZbvozfQfd2X+A3K:ZS0h70RKrzZbvqlP3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987472, "uuid": "93a2d6f0-8373-48ae-9aa1-64451a34f9ad", "value": 845776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987472, "uuid": "9c62bbbc-eaf5-4cb5-bde7-0c97c754839e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987472, "uuid": "36576c58-495d-4090-bda3-6188b9cb26d8", "value": "QUOTATION_SEPT9FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0983ba-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991039, "uuid": "0d396e0f-1395-4f3c-be22-949ef01248f7", "comment": "Malware payload (Mirai)", "value": "7958379168cca18cdf07b10977edf6eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991039, "uuid": "b85c2aeb-e1d8-43d1-9811-21c818db17a7", "comment": "Malware payload (Mirai)", "value": "81bbf181f301d5ceb0b09bbeb6138f9d7740d6f0e2e3c285687316d5cae5cebf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991039, "uuid": "0d79cd15-fc29-4bf1-aa45-1e2b7dc731a4", "comment": "Malware payload (Mirai)", "value": "a6fa46b504008f6479ff63527d703ccefb7eaace", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991039, "uuid": "71760336-3b26-4262-a924-9b97a086cdce", "comment": "Malware payload (Mirai)", "value": "95f26cc609036fbe6e7408aba9d15766cf78bc181b7a25e802810de5b3071259950f91643e7dc1ee6747b3180d834d8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991039, "uuid": "525a7dee-3acb-4e47-a22d-2e5496fa1f30", "value": "T1D5E2F1116516857DEB308471E4F6858277791FBCA9FFB0A654A2020DDCC2A4293F2ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991039, "uuid": "bd227624-faa9-46b4-bf6b-cb274b96371e", "value": "768:YEKkUgXAnURCr6HmDFStmYtCc9q3UELdb:gkEn7uHEem1lLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991039, "uuid": "3c69e1e7-190b-4c69-95a8-99fd87ddc9db", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991039, "uuid": "89060e14-a857-4461-aa5d-039c4f467e82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991039, "uuid": "59dcaccc-43c8-4c22-ba4f-ce82cbc17af5", "value": "7958379168cca18cdf07b10977edf6eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb2a239-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986579, "uuid": "0cb5aa57-375a-47f7-ba77-514a1d6fbc47", "comment": "Malware payload (Mirai)", "value": "bf592ae23d936759683f136e469eb7a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986579, "uuid": "cadafca6-b29e-44f5-9334-7b95734c8b0f", "comment": "Malware payload (Mirai)", "value": "81c763d87b9bdbb88f61f8a22af4b0760a7900daef81e0319775217093a94618", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986579, "uuid": "9e18b007-0eb1-4c98-a48e-061d245c3dc9", "comment": "Malware payload (Mirai)", "value": "ba162f29e1cfa7327159d86aa6ddaab05cb1a405", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986579, "uuid": "a64308c5-14c8-4fea-a428-adb1f75a5007", "comment": "Malware payload (Mirai)", "value": "2c7a7c2e6ce4f596e129e3d59c6234023245d09176c87cbd19afc68f218138a6b740dfe1d0baf8fba09aa640bba8b2d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986579, "uuid": "a6d30897-6c93-4ab0-8214-1e7c758afc25", "value": "T14EB2D1A487A1A706C2B0B435A27C8F961A3715A4C6F639272720C3BCD64259673FC9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986579, "uuid": "00be91c4-e6a6-4e10-9db7-edd0c8e179e0", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+Bvz6s8b7ihymdGUop5hul:4GaKQFH0rs3zWoDDRsjt7LB9U+B9s3UV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986579, "uuid": "01c2371c-1731-42e8-b03a-2de6c273eefb", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986579, "uuid": "bde1f668-fb23-4e85-883f-7896a97243e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986579, "uuid": "41550ddd-04b5-45d0-a419-edf163d44c3f", "value": "bf592ae23d936759683f136e469eb7a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd32d03-5ec5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991116, "uuid": "be52f6c9-2b8b-456e-8fb1-13538f68bb80", "comment": "Malware payload (Mirai)", "value": "70c59ff9e97fdbcc93f5f0a8eb9db692", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991116, "uuid": "b1cc2083-7869-43d0-9cfb-31d92e560c9c", "comment": "Malware payload (Mirai)", "value": "829b28cb1bfe744136c848f01f3e5933adae7a5a17ff2f3e25d7561aef87315b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991116, "uuid": "bfc38ac7-d7d1-4ec7-a4fa-d834ada715a0", "comment": "Malware payload (Mirai)", "value": "643d31b6b1d71a109ef0f3f98203bfb609c92596", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991116, "uuid": "fb96801f-cfdc-4939-a614-439c651d91fb", "comment": "Malware payload (Mirai)", "value": "236ef80ed92c202b4589c4fb18ed5319c25759c25c161301bfe1a41e93d0e6e4af0191b72337f58b2599dabbf1fcfc1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991116, "uuid": "7b2484e6-41d1-4acc-bd09-5460cc738b30", "value": "T18E43F756B8D18B01C5D812BAFE2E118D33136768D3DFB2179D106F247BCA92B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991116, "uuid": "5dd2969b-9da3-49c0-86f3-d2712058a607", "value": "1536:Adn9SB+Ms0HGgaufSZbo0Fg1OaSF+iYLeItijNWaKWOv:LwimgN0o4goaSNNWaKWOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991116, "uuid": "d21a0733-0973-4428-befc-1b22ec6cbb98", "value": 58496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991116, "uuid": "3f860ba2-3fa1-4d1a-bdad-1375088303a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991116, "uuid": "98e26751-da76-4f96-97b2-3f9cb1d344ab", "value": "70c59ff9e97fdbcc93f5f0a8eb9db692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2fbe8f-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024188, "uuid": "2839620f-8c90-46de-bc35-1a9b2975c653", "comment": "Malware payload", "value": "fd5bf52096e3cdaa3bb8f63effcd8ae5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024188, "uuid": "848a0763-91a0-4de2-96a0-cce741474631", "comment": "Malware payload", "value": "82cbeddb56c4370a2f412e3bc9e1ba3970c99b6c91487c189aa0464f54ca1fbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024188, "uuid": "522e5120-505c-4495-aac1-8ab806a49a59", "comment": "Malware payload", "value": "50c66e62d5a44a829039d5f55515ba1c985617b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024188, "uuid": "6ba5c663-0dfe-4e5e-a3f4-6ad620869409", "comment": "Malware payload", "value": "afa81541b3be9d86253bbeff691d9446225542f6291564c49aee0d110bd4d5b67348f0e5dd84323737dde1bae1816f74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024188, "uuid": "0dec9a58-5b29-4515-9fc9-21f8f2ba04b2", "value": "T15834222914E827CE61460A1E1574D0620CCF794775F938F48B7A6323B7762EF732AB4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024188, "uuid": "36857dc0-b9c9-45aa-9eb1-0c3a9aa36df4", "value": "6144:ikBWZFvxpa58fdrIXpNq4531SDeYFexA/c2d:FBCNWSdrIXLqY3AFe6/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024188, "uuid": "e30e20cb-a581-4d0b-9340-2dd901ed43d0", "value": 251920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024188, "uuid": "548d4816-baf1-4879-bd26-b862a9b980bf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024188, "uuid": "7e21071f-8534-45c0-bed5-8cf25a24d8fb", "value": "28835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd49253a-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987521, "uuid": "4e8bb994-0079-49fc-bde6-f1abc6ac6328", "comment": "Malware payload (AgentTesla)", "value": "a1f785bfdea5c75ed569fc48681eb610", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987521, "uuid": "88028782-0bea-43a4-bd90-91699e2da7bc", "comment": "Malware payload (AgentTesla)", "value": "83cfc425e31898223c5cfb0fbb28fb89e6ba02386a5719170869ae974b479f2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987521, "uuid": "624111ac-4781-4743-8ac7-5c42a90adc0f", "comment": "Malware payload (AgentTesla)", "value": "89eb5b87feb47c6d47386555658aa6308e0ffef3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987521, "uuid": "8afe0385-0a68-4c19-8d25-89670cf32496", "comment": "Malware payload (AgentTesla)", "value": "92514ef77671e9dce7da4313d11fff6da71958b3a3effeb6563b0dd66622413192a07b5a80c0b3be150ec2fc740f27b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987521, "uuid": "7bc16485-3c58-4048-a2c1-369f8407678d", "value": "T11CE4394526D81719F47EABF1C3740308D7FAF96BD736E55EBC8501DA0A71E00DAA2B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987521, "uuid": "92b5f562-654f-4762-b076-0f6ecfd45de8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987521, "uuid": "fa0964d3-562e-4d6e-b37c-25cb5aa1aaf0", "value": "12288:Qfbjg65pMyYut1Hl8r8HJFczrPJnsJ3q2zQjz:QfF4U1pEzruw2zuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987521, "uuid": "ecbbc513-006c-4963-b18d-ac23a676faca", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987521, "uuid": "8980f6ac-dde9-4cdc-b5e2-c40383e3ce0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987521, "uuid": "f211690f-46ca-4429-9eb9-976cf7b73406", "value": "a1f785bfdea5c75ed569fc48681eb610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b530abd-5ee2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696003705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696003705, "uuid": "38e66293-0ded-4988-b010-b278884a9622", "comment": "Malware payload (RedLineStealer)", "value": "d21c6a8e2c0966635c477d44cba7c035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696003705, "uuid": "0b300c2b-9408-4c27-a302-7bd92eef9b07", "comment": "Malware payload (RedLineStealer)", "value": "84447b2534a241354998b6b6556f74c99775e160d0381466be29cfe8d804bf18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696003705, "uuid": "915c9e2a-720a-426d-b204-9dc9b248e8ab", "comment": "Malware payload (RedLineStealer)", "value": "3b6871ac7095ff7d5322e5a5138d172c0878e784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696003705, "uuid": "8835a886-5d76-43f3-b17b-28dcce92438e", "comment": "Malware payload (RedLineStealer)", "value": "e8c113117e558dc859d097550932df8b9ee13ac93a578d3e86e9a95b9c721c0bd9611b7469787882fd91d18d5acecd99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696003705, "uuid": "141a00e3-82e5-4b54-8424-75b9f9459b02", "value": "T1DF658D7139E3B037DDE310BD43ECBD2485AEA5B08B2519C752DC57EEAE206C16A33586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696003705, "uuid": "0327d3d4-c2af-41f0-a3c0-9efa70c9b5ea", "value": "500aa68029ae375a898af1edb3f40b87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696003705, "uuid": "dd37b229-3358-4117-ae20-a895b0fc7c7f", "value": "24576:PryzyicBpqoZTg1qnZtq6PwszmfKj1b9x:PlBpqoZTgYtPNz2Kj9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696003705, "uuid": "f3343aea-a8af-4edc-b659-ef2ab774f884", "value": 1498432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696003705, "uuid": "5903556e-2a4e-4517-b7b6-5a0105b4d7ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696003705, "uuid": "50de2782-a86d-48c5-9b23-78971f792f38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e13df6a-5f21-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696030768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030768, "uuid": "4c727f5d-9a1c-4d66-955f-aa90495efc28", "comment": "Malware payload", "value": "8a4e12be23b61e64ec5652e6c84d6b0c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030768, "uuid": "898e7913-5804-44d7-ab3f-d1aa95bc26bf", "comment": "Malware payload", "value": "85c4558b7ed3cd831e35ec02869692b868f7e79a8cf7aa0f17a612e3e923b346", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030768, "uuid": "73e5016a-4b33-49a6-873f-dddb5f540253", "comment": "Malware payload", "value": "38869963f0a53e8f3375754c04fb162ef9dd5dbd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030768, "uuid": "0933a84f-9415-4415-967f-a6b2cb9518da", "comment": "Malware payload", "value": "494eb8de54fa533012c9ec6a7eb40f3bb9a90320ef306048313ccbeb6e3f4df0a4da5963fd5bdd5d470a8c1a7527343b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030768, "uuid": "89993217-b1a5-40b0-8453-7857da15dba6", "value": "T119B36DC4FA43D4F2DC5215713177BB369A32E0BA2129EB43E36C9A32ACA1611DB1775C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030768, "uuid": "d336b502-185d-4c7d-bc3f-fe34d5cedcf2", "value": "1536:kaTjD7S/+5Hli1Q+OmmenkJaq4j8Qow6f07fx0Fy1ISE2VbTKk:R/D7SW5A1sLenea5o1wpjxWOVHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696030768, "uuid": "f074713d-61d6-40c9-8047-b5e41d5b4cc4", "value": 107912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696030768, "uuid": "d4dbc889-3d6c-47e3-a7ec-caec02f43b3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030768, "uuid": "3e861093-26fa-4c03-8f34-68000c66ee62", "value": "hydro.x86-20230929-2339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4d5ce6-5e8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695966608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966608, "uuid": "246663f7-9281-4cef-a5a7-3cd1ef46d092", "comment": "Malware payload (Gafgyt)", "value": "0e43d6a210d85120b8af08b46d5c6c0b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966608, "uuid": "46b9efbf-a6ec-49ea-aa85-8b5cefcaee85", "comment": "Malware payload (Gafgyt)", "value": "862601636368d0633bebbad1fc705f791dfa27355f0a336eafcd19b3bdfc1fa7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966608, "uuid": "744157eb-e7db-4e56-9c7a-378440249a21", "comment": "Malware payload (Gafgyt)", "value": "b2603a44402b17bb4efb2d79e64c28718012166b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966608, "uuid": "f06d2a25-801c-47ed-8cbc-63f9098cc1e3", "comment": "Malware payload (Gafgyt)", "value": "5f57a201f3d63547432c79981bb2dcaf29c98eca0fffb054f606c9ab6a9a15225c358414bf6f61f386172aeff45005c4", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966608, "uuid": "9a3e81b3-ae84-4e60-ae3b-149cd5018ff1", "value": "T1EAC3708FE6491BBEC66F2BB1187727F18F69E86112715085E44EFB8007F253418A3B79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966608, "uuid": "c5422510-85c6-4b40-9404-3a2edd286c07", "value": "3072:fWdyfx+DXRZr5OihQKJLn1JmJA0xiSXgqlj:fWdDBZrPdF1JmJA0xiSXgqlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695966608, "uuid": "68667db2-f2b9-4fb2-b945-27e19a7b0893", "value": 128155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695966608, "uuid": "ba5ff901-ecd4-4ace-a2db-7b8f52b38d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966608, "uuid": "ed245138-76d8-4718-88b6-017640f719dc", "value": "hajime-like", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97864305-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695987458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987458, "uuid": "73527ed6-4dfe-4ca8-8c81-c0731fb1dc19", "comment": "Malware payload (RedLineStealer)", "value": "8935c2566a154a12f5980df728d4db4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987458, "uuid": "609fd6c5-3c8f-4758-8d91-3212839e813b", "comment": "Malware payload (RedLineStealer)", "value": "865e1bbaec089713462d554d11ce2cb59be0219ea386721cf6ded5ac4d021e15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987458, "uuid": "6e266cce-eac4-41c4-875a-c3ee2f56a214", "comment": "Malware payload (RedLineStealer)", "value": "a898af65c24990a309f343968626ad8540545385", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987458, "uuid": "4bb45708-90ad-47f4-8635-9902638a3284", "comment": "Malware payload (RedLineStealer)", "value": "c60d51980200f702d0459d1dc11d95fabd4123c7ffa9c3802f732ba7c34ccde19922d56b536c1fe98f0b098150ab5769", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987458, "uuid": "27730c36-d318-4178-8188-3480bb072179", "value": "T1D284F11175E1D471CDA78138A834DAE029BEBCA39575884BB2683BFF6D303D1636634E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987458, "uuid": "3f02df9b-c9b4-4a12-ab12-29499069d51b", "value": "14051e4df4c36cf261bf236adfea8971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987458, "uuid": "330cf0d6-900c-452d-8435-5d72716acf00", "value": "6144:F1dAAqA7gfBoVb0YvsIWAyYyv2zATNIjE6P69Jj4Ukv4UttZNDpyVwsTO:FsAl76mVbnPIezAZIj7P69NVVUnD6wU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987458, "uuid": "f5f67258-fd1b-434a-a26a-d64f79aa65f3", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987458, "uuid": "3369b20c-9d2b-4fb4-855e-7ae5b0f85ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987458, "uuid": "905b168a-06a7-4180-82ab-f3fc9e44297e", "value": "8935c2566a154a12f5980df728d4db4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d662b64b-5efd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696015481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015481, "uuid": "7f13d660-4db0-45c3-8295-a19c3ad44110", "comment": "Malware payload", "value": "d4694669fbd8056097728dcf2d03d71a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015481, "uuid": "0af1e5a6-0c97-4e8c-8cb5-ffe5ae35dc89", "comment": "Malware payload", "value": "86a168c145da81f5afdae6fc649c12f16159009b8ec3ab185d867cdc4bed8d36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015481, "uuid": "0b875e91-c4be-4be6-bf19-a9332094ca76", "comment": "Malware payload", "value": "dea6afb3d3223509c03e879c4de0c8cadfde33a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015481, "uuid": "6beedcc2-ddaa-48ff-9ab6-4834cda2bf80", "comment": "Malware payload", "value": "9fb6fd980fcdb0da3ce6fffeb88a298976f1ef594c1d14d9f429d9d5a42e2e73681d92fe215d7203f925bccea91f1d27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015481, "uuid": "2a07f6f6-39ec-40f5-946c-dd7ff07ceb0c", "value": "T1FC152252D6D850B3D8B093B468F917831B7B7C715EB9C3AB2352980E1DB7498A832377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015481, "uuid": "33a2352a-7b17-40f0-98e1-47b3ffc544ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015481, "uuid": "612b4dab-ec59-4b69-b3cf-2cb42792bf49", "value": "24576:+ymTGqYkldZEGjiIlO1RmKDlN9EW9odvMwNn:NmCqYklQCiIlO1RmW9ERdvMwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015481, "uuid": "f114c892-1c58-4474-9c2b-cf4cce2b3b9f", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015481, "uuid": "86160fa1-2f79-4b5f-8b0d-e595c2c910f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015481, "uuid": "0c078146-59bc-42ae-b998-25115472fd88", "value": "d4694669fbd8056097728dcf2d03d71a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee2ab15-5ee3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696004086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004086, "uuid": "345b5e04-88e4-49de-9f05-7538afc921c3", "comment": "Malware payload", "value": "f77b6594836fb1463ca5274356604e1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004086, "uuid": "7d7c47e0-c9b8-4f92-b012-8f5a51bbb94c", "comment": "Malware payload", "value": "86b98477c29eb28351bf9e17e4368dbd18642a54088e5f205dbe43b23d09b8a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004086, "uuid": "a5ec0d12-a31f-448d-8ace-f8008a53a008", "comment": "Malware payload", "value": "7ffcd5a522ec8a338bf3067f8b15cc92560dcbba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004086, "uuid": "1df00c84-5dfe-4121-ba43-2b617ea4377d", "comment": "Malware payload", "value": "b9983cb257eb935d731f1edddb1a3fdd8fdc433fec768c2a2d063783eed65a06e35d00d4778594066c0dc7e0b4df2bcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004086, "uuid": "89414eee-7be8-41f0-82d4-9a73a13cb6c4", "value": "T18D349E0AEEE2BC61D52746718D2EC7E43A2FB4614F696F6B23146B3F18711B1C262731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004086, "uuid": "99047e0a-36dc-4598-9369-3177ab2f08c2", "value": "04b413a231387eb973c8024c0a5e8f4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004086, "uuid": "05bf5431-31cc-462e-8eed-ed1516ef0e86", "value": "3072:+Xjw4xqAVQxOnZ9twhy0tjQ+DDLc8gmB78M9Bpa8bQtgGvv0J5mkbHLYT:Gc4PVQxOnZ9ItjQ4Lco7hjbQtJBknYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696004086, "uuid": "3e25d79e-3452-4742-b527-bdb7b4092545", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696004086, "uuid": "6de4351e-cbb8-4bcd-af98-ac67643bd282", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004086, "uuid": "4af84d23-f446-4b1c-ace6-2c2dd4164277", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f32f4db-5e8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695966613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966613, "uuid": "ca67d24f-c348-4cf2-8d5e-76638a87abf1", "comment": "Malware payload (Gafgyt)", "value": "e598d3b6fd6eac82950ea7e7ca270b05", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966613, "uuid": "3aec7601-6ae6-4cf1-8ab7-af4b3bd4070e", "comment": "Malware payload (Gafgyt)", "value": "87d496fb86dd6d3ba78a730c37a91d638be324ae36fd5e3ca96bc1ce55c2da1c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966613, "uuid": "d0950d9c-8071-4e96-8141-641ab6b6b8ce", "comment": "Malware payload (Gafgyt)", "value": "99dd28d4783d0943d5a7e9c50d2140d53f06fbbd", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966613, "uuid": "3b9bd0af-dd57-46bd-824b-63d74f37f2e9", "comment": "Malware payload (Gafgyt)", "value": "1c8b18b7e996a5d4cecb216e4a9450ec5942d75c142ec97efc1f5cc3901946b36f5d0f67fec880d79e04ed61a22be681", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966613, "uuid": "d36cec1b-2f61-4a02-9442-daad54d6019b", "value": "T1D214D809DD902733E2D23EBEF7A681CB73264BD46B973282C52C7AF467957EA4532050", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966613, "uuid": "01603b24-4d9c-4dec-a7ad-1a2397c25bce", "value": "6144:nPcqakawH5xXuw/v9IqujpGM/9PmUwsAtnlq:PcqakawH5xXuafan/BmUvAtnlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695966613, "uuid": "110dc7fb-7071-4d45-bf63-73bfe39d7c07", "value": 203522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695966613, "uuid": "517118fc-4bcc-4314-b665-bca90dac50ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966613, "uuid": "75c912f1-5730-4b6d-b7bf-901c00b4ced0", "value": "hajime-like-20230929-0550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbf5b6b-5ef6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696012512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012512, "uuid": "083ab0b9-2498-4c01-b658-8e877f6480fb", "comment": "Malware payload (RedLineStealer)", "value": "b772fcefbc1fcb46da5fadf257db35cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012512, "uuid": "6f099bd0-3993-412c-8881-30e7c0670493", "comment": "Malware payload (RedLineStealer)", "value": "87d9a32b848b94c1b9d42a860baf9395688b6e5b434f7a779136a9e3c6c7695e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012512, "uuid": "5430093d-2cef-4dd9-88ad-9bdfc61810bb", "comment": "Malware payload (RedLineStealer)", "value": "800f3d28a67dfe44fd05e0dbd3c919661fb443a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012512, "uuid": "d3f2f287-b9fb-4817-b007-585e6bf02696", "comment": "Malware payload (RedLineStealer)", "value": "6f3bb8e381b6e8279e26d4a4e591f7b2d3f4e9e145eb8e0cb74d567a61dbb54ca13fd076617cdd9841ed13819ca70b1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012512, "uuid": "3a5c4073-ad04-4e08-9dc6-3b7844917ebc", "value": "T1A734BF11B5D1C072DC7225364AE6DBB95A3EBC300DA65EAF63E40F7E4F30280D662667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012512, "uuid": "7ad47ec9-4206-4c26-9207-ea02e9461f9a", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012512, "uuid": "5c11aa8c-9fdf-48dc-9129-e91cb160c6d3", "value": "6144:skz4SHy5uoBMFGV5PEkIXEHvZAOLzheVs0BC+:2CmuoBMUOMxphGs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696012512, "uuid": "d63926dd-81ee-4613-983d-2a3b89a38c03", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696012512, "uuid": "7927080e-29c2-4e7f-867b-50c3ae5ffcbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012512, "uuid": "8bcb171d-847f-4c9c-91e5-40e253cddc56", "value": "b772fcefbc1fcb46da5fadf257db35cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b898b2f-5eb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695983358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983358, "uuid": "74207fc2-b158-4391-88a1-377e3095d808", "comment": "Malware payload (MysticStealer)", "value": "563ea0b001de039977dda41650318bf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983358, "uuid": "6336e0bf-7227-4ac7-a3eb-5707b1e9db62", "comment": "Malware payload (MysticStealer)", "value": "885d6abe4ce4819b6ae96807220378f5b48496df0c2908e1965340465d77f77c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983358, "uuid": "824498ba-a0ea-4702-b82c-b20f8022f747", "comment": "Malware payload (MysticStealer)", "value": "960334e5824882b27a5e3e73ae703b4de2ed0e02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983358, "uuid": "ee942250-6dff-47c7-ba51-61d3906207cf", "comment": "Malware payload (MysticStealer)", "value": "2dc7e816c9d7ca667b5a441c36e6afbf28b27a775a2720cc34f018e032de4dd00f9bcf154fecc06f41360aafb6a760a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983358, "uuid": "3261cf3d-9976-4f36-95dd-7015face993c", "value": "T1AC74BFD970D28073DC71C6314AD4AFB4CCBC7D7148A29B5F63F43ABE4A681819166B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983358, "uuid": "44a41140-5aa2-4b01-8512-8f42b97acff8", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983358, "uuid": "4e86ec3c-ab92-4a57-b9b0-d40813b20947", "value": "6144:diTeW/s5GqrO5aXnfEGIXWPvZAOPydefHB1fjcSVPx6t6mv6BCBD4FVs0BC+:RmcGqrOk86xJfHBVjPPx6t6mA0Ss0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695983358, "uuid": "f8e5e442-237d-4c3e-b5c0-b8496b6cd681", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695983358, "uuid": "48bcfa0d-1123-4e79-ab53-482e76716d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983358, "uuid": "ee7fa8b8-db22-4525-be6f-306bbaf494b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b90425-5ec1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695989735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989735, "uuid": "059bb64a-ebaf-414c-9417-68262543a67f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3c81534d635fbe4bfab2861d98422f70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989735, "uuid": "665c8b02-651b-4dd7-b3bd-6e06c9fb94fe", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "88921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989735, "uuid": "5f79fccf-d2bb-4a65-9e2f-550c420970b1", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9cc995fa42313cd82eacaad9e3fe818cd3805f58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989735, "uuid": "6b9d09d5-6c90-4da9-b55b-b78b956aed5a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "0ba536b6253e4789216dddc87d14341742cbe718bf6784f1d416cb98c54a6bea6eb14cf6dbffd3465dbe624da13d7cf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989735, "uuid": "a39b75fe-cb01-4a16-8066-b18594d8ab4d", "value": "T1B166E287C79ED3DF75FFC6FC4F3A30F1F819CCDA7589A52426863114A1879A026A1862", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989735, "uuid": "1cfd54ec-9475-4653-86f7-3f03437bc4d0", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989735, "uuid": "da722912-bbbd-4024-888e-3e013f054f38", "value": "98304:QPN/I0szIQvuryztahMlA12Yqyt+BNeC3sMLdYkewNp3CJ/ASWvxH9rAwu:K/IrIQR/mpqythC8cCGxCJ/ABvxHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695989735, "uuid": "4c635b7e-0972-4b7e-8267-48ca902ca8f3", "value": 6706688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695989735, "uuid": "b5b5ba38-27a0-4bb2-8f47-1bfaad947564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989735, "uuid": "b17d2195-c9a7-4060-b43e-ac06f7f4d89f", "value": "3c81534d635fbe4bfab2861d98422f70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7ef163-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024431, "uuid": "5ad96af1-d9fa-405e-ada5-264e8e3ecc48", "comment": "Malware payload", "value": "17a6b139dceac5030159a354da1321a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024431, "uuid": "dbe9d688-6cce-4080-b19c-288b368f6f67", "comment": "Malware payload", "value": "88f0c294a540b5ccd6ffa680f7a01899083978c08b2e232ddb2fbeb14b74e186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024431, "uuid": "da6e1494-60b3-4d8d-b722-a1a7cf1dd22f", "comment": "Malware payload", "value": "f1b0ed8e7ae3dfed3c49cbe877971ac6b5d2e52d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024431, "uuid": "06355ef5-0816-4915-bdfc-b52ec965c467", "comment": "Malware payload", "value": "5e89fb45ac9225834d3f9c08e88c5fb756b5286c211ddb65a11af07442992f7175824be230c94960598ec97c01e7d172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024431, "uuid": "688599d1-f6b0-4082-8232-3ea606a6b2ee", "value": "T1823423BDD9139D31AFD681B6A303F2372C60DC290A2CB97667CA2117E471C7326596C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024431, "uuid": "d0b08d44-f39d-4158-97bd-8faa15a56575", "value": "6144:BSxYKLTAa+BYEDO5qLny/bsI9dqYzrNGWvWy73FXFi:MxY8ZVTsI0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024431, "uuid": "f1c6272d-6416-4a09-9901-056d600c633f", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024431, "uuid": "b06dc2e6-0a2d-40a7-a924-65c796452b43", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024431, "uuid": "dabe2053-f96d-482d-93a0-ad9f788732ab", "value": "288336.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c707284e-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015884, "uuid": "13b94319-197e-421e-aa20-34f623821595", "comment": "Malware payload (Mirai)", "value": "ebe7b07d49ffd738a952d96d835a37a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015884, "uuid": "f15fa887-d539-4610-8369-1e07b07333c2", "comment": "Malware payload (Mirai)", "value": "890efff21af30227a812ace1c8be00c60ee1eff719b5d137e2372f08b8c344e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015884, "uuid": "01f2ea8e-e52c-4b6d-a0e5-9c011fcc1680", "comment": "Malware payload (Mirai)", "value": "7e20f2209a6650ee02ee944137e84cfe355eccc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015884, "uuid": "e85dad9f-a6bd-47b8-a51c-13d3102c97be", "comment": "Malware payload (Mirai)", "value": "ac42ad36c0cb20d75e0cd462b30895c947cd0003d4dbcd5e6d44b4d33f2c809ecf16e0cdfbdfcf3ab81bc45c52a2ac8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015884, "uuid": "23e5aff3-e395-42b6-9bfe-ca070e0b825c", "value": "T113130891BCD2897BC6D027BAB72E169C33A623E8C2CF3313D9102745768A95F5D37A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015884, "uuid": "cfdd17c3-b992-4801-9bac-58a375bff4bc", "value": "768:IveO9NlmFIFdmd0G52E+It4+8aC2EHKwcU/P1LzqULleQ4D/nY3owDSmjkMPJvzN:GHaIFdmmG52ei2EYU31LzjOYX7k8Jv20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015884, "uuid": "2388968f-e54b-4522-93c3-f98475f11ca0", "value": 43936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015884, "uuid": "ae286db4-cb74-46a0-9b01-861bfa44212b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015884, "uuid": "fc2f0bea-7465-43e5-abd4-5aeadd323092", "value": "ebe7b07d49ffd738a952d96d835a37a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935ea88d-5ea3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695976714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976714, "uuid": "209d196f-026b-4696-ad91-80e6460f2f18", "comment": "Malware payload (RedLineStealer)", "value": "c6f44e43d575e258ee129e1655355545", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976714, "uuid": "190b091e-48d8-42b2-b61d-04e6253e58eb", "comment": "Malware payload (RedLineStealer)", "value": "894e37b79845fc0f611095eab8730effaa3ecb30c52892c979a03b2a621ac020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976714, "uuid": "f5dc3cab-1661-4823-ad50-05eb5540a223", "comment": "Malware payload (RedLineStealer)", "value": "641eacb351a1afe4d6231965ed8f4b3087d11935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976714, "uuid": "8023573e-8c0e-4a92-8f0a-d38126d3a854", "comment": "Malware payload (RedLineStealer)", "value": "ad8f9a4197fc48a09a99d55ed2c73fd0183cd96af294587fd952a1a5e93d7c8f9442100c2f61c40a66c24209ac5a3e9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976714, "uuid": "a2c377f5-73cd-4c6a-b5f8-c92d40762a7b", "value": "T1F9369DA0265BD2DFE25604789CF3D897E65862E18538AA0DE83DFC7CF485C1612D4BF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976714, "uuid": "1c6e9fc4-6e0b-421b-9c28-c1a96b989470", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976714, "uuid": "636f8686-1b13-4da1-884c-cb83331233a8", "value": "98304:V9b5GdtcWedZ5iZuJKxF+kWzE63pFxiQZ/E9WW+d:Xotc/5iBxF+kWzE63XxiQZ/E9cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695976714, "uuid": "1e9e3799-4099-46ff-8a36-ddcaf694cece", "value": 5019792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695976714, "uuid": "7fb90682-fdde-4ca7-911e-600793a2182d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976714, "uuid": "56df78e4-490f-4fa0-8814-89c1c9936a05", "value": "c6f44e43d575e258ee129e1655355545.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fffb6e-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024179, "uuid": "990bd5ec-0b8f-4f30-9687-e2a1d93533cb", "comment": "Malware payload", "value": "673de84f5ff2c8b2affce35000273e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024179, "uuid": "36aa7811-bfd8-4b19-9786-f57caa26d9d2", "comment": "Malware payload", "value": "8ab25fbeb2bea10fd193507c1d3bae23fa48fcee083207771e6f1ed5d4d288a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024179, "uuid": "451cf6e1-fbe9-4f16-8099-8c58ba733bd2", "comment": "Malware payload", "value": "754686bc146b96d6e4dd4f09159d5011db8347ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024179, "uuid": "c59c52f7-6948-402f-88cd-d47c99276f6e", "comment": "Malware payload", "value": "481158e948ccf20dc3fc137e8090a81902125e9f5a5d7a385d186df273e2631dc9c55c3effb8cbe7579946ec32a0d6da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024179, "uuid": "2dda039c-1659-496d-8f2f-6f2fe8623bb8", "value": "T16234236C455152E121B2176F2D99C5CD6D08F8C2B4BA1E9B9B3297B9933EB1C2ECC10F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024179, "uuid": "41b6b54d-bf91-40d5-ab45-dca4fabf8b93", "value": "6144:+FmPQzP39TZau5kVdjsWmamV4KKUOldi/h60Dip6aU:+TP3hcmkVdjsxpEhl4hEpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024179, "uuid": "5c4300c9-1c94-426e-a650-f8df038f8452", "value": 251920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024179, "uuid": "f993f862-bd36-4b09-9356-d53102c44b80", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024179, "uuid": "37b517d2-a473-4c66-9c59-70fb54abc862", "value": "28834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9a4339-5e8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1695966606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966606, "uuid": "c3f22495-736a-4a36-a2be-8fd583c8cfce", "comment": "Malware payload (Gafgyt)", "value": "58017d23c56b32f7ea03cbd56097db84", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966606, "uuid": "0498af9f-8d9e-41e8-b9ba-8442c8bef1b7", "comment": "Malware payload (Gafgyt)", "value": "8b18effb55ec855c1326996cfd893c49fd6bb70c3fc0591b2121212b16414c61", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966606, "uuid": "bbf9a810-8a6c-4d2e-9b20-421e28c45996", "comment": "Malware payload (Gafgyt)", "value": "27fecac8b1b0b1b68edbd1b93caab5c936d7c134", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695966606, "uuid": "f81b4f05-6fad-494d-acb8-8dfcbf55f982", "comment": "Malware payload (Gafgyt)", "value": "55b046bcc6a28c741117e0af70f9354ade1123739fbe05a81e8d04d4ebe582bcde4a002cc60693a506fe01734b7f7b83", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966606, "uuid": "31014ca1-727d-402c-982c-5e50ecb1010a", "value": "T1CFE34209EDA02733E3D23EFBF3A581CE72290AD86B573382C51E39F55794AE95536060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966606, "uuid": "3326b75c-fb21-477e-aa83-61e0e325d8f7", "value": "3072:ClCx4c5kI5D5uMGPMLHC7/r4ka08zDO+i64jRnXzsogUsNe0thRFAi2VaqyY/eQd:VcNrK5Z22HzFGiBP1CVnmzmQQnUX3Q0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695966606, "uuid": "2dc52d47-8c94-41d3-853f-675b7c3b84b3", "value": 148899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695966606, "uuid": "cfe5b418-c8a1-4660-b9c4-f311c7380216", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695966606, "uuid": "e7c4cd2b-c359-47bd-8f16-0ea3190442f1", "value": "hajime-like", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6726d4a5-5ed7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695998973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998973, "uuid": "ee927c2b-d198-4c1c-aab6-04c931978250", "comment": "Malware payload (Formbook)", "value": "ff5073e7ca0e1ec86ee0268f040af237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998973, "uuid": "94f053ce-64f4-4211-aa4a-b0f75a0a99fd", "comment": "Malware payload (Formbook)", "value": "8b8f90243e714bc9f2f2bdd1a70bd0f884b7915aa7d04bb456603ae82e871e8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998973, "uuid": "3845af6a-6597-49f9-b310-fafaf14545d1", "comment": "Malware payload (Formbook)", "value": "3adc47ace5e0638da3a7231be4ebe316b1b4356f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998973, "uuid": "f42ccded-f0fb-43d5-88e9-1dc32de710a8", "comment": "Malware payload (Formbook)", "value": "de81b504bf2bfc8404ea4a9889c38dd8e87446021734ace3eb9b6616e3e1a9876e81ab12ed140524606c0ce7b63d3970", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998973, "uuid": "c0d7e34e-00a6-4cff-9f90-06251570c833", "value": "T1637412A5B6A0C9B7D46A17B02D3AD5FF259B3E01AC966E073BC07F0F7876192AC1D050", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998973, "uuid": "f9228453-25b7-431a-bc18-abe5c93f5b4f", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998973, "uuid": "f8086c38-7639-463f-839b-4c617e8f5bfd", "value": "6144:GnPdudwDNA/zUz6mvUwSaLHqhcSB6xhyLWshdUDBweVyP2IjksQNFFa8/SLm:GnPdZ8U9UwS6OcKAoTUl6fksG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695998973, "uuid": "8fd053af-2606-48d5-ab50-e42d33c26f98", "value": 356821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695998973, "uuid": "774424a7-04a2-4278-bd27-8916e60f17a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998973, "uuid": "dd226e24-1c15-4bef-8580-395729ad959d", "value": "borilpokonta2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b62814-5ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695978709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978709, "uuid": "ff44910d-fe43-498d-b7ff-23fbb2097357", "comment": "Malware payload (Formbook)", "value": "71f2f0538d0c2bf963cb1637a7bb5d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978709, "uuid": "ea523c10-f3bf-49ae-8984-291981e61deb", "comment": "Malware payload (Formbook)", "value": "8c2ff4d66cded092948535bcbcbfa5d554208407e507b58cc2d253352a9156ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978709, "uuid": "126f08c9-2560-4b0d-bb88-2609d77dadf1", "comment": "Malware payload (Formbook)", "value": "0929f488809b7f255d5aa62b4de9b3db04d2fa5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978709, "uuid": "ba932961-2d5b-432a-bbad-6427219432f3", "comment": "Malware payload (Formbook)", "value": "140efdbd0ccc0b0bb495cf54a0c4f5939d09fdd6903053d0177ff5f209c0a46d40ceade1f0c60e69197fc3cccab4f079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978709, "uuid": "1fc11af9-3287-4217-a581-639d17ac0084", "value": "T1DED422D4FFC24BA5DA0D1F7863DD656A43B2B4519412E7B8CF9A284F2E3572C6221B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978709, "uuid": "3d1daa4d-0df2-44d6-93cf-9ccf39455b75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978709, "uuid": "8f0fd928-9a14-4e68-b332-bbef123563d7", "value": "12288:Ug725EPel6an0/1gy88S4xLwWcpFXnZladTmQ7EGlKV:iSel6an6E4xLw5nXRQ7IV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978709, "uuid": "e353f298-301a-42dd-a0af-ff77099bd3ec", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978709, "uuid": "e330a7c8-a8fd-4458-baf4-d301ac30e9e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978709, "uuid": "29bc18ac-841b-49b2-ab4e-c58ac953c72c", "value": "Doc_file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e9a8e4-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024311, "uuid": "e901bd57-f0b0-46d1-ab44-68d9da843d39", "comment": "Malware payload", "value": "8dab64228a6a9cb5b69755cb6431834e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024311, "uuid": "09c0b6e3-bb8d-41d7-87c1-f2cfe5267d5e", "comment": "Malware payload", "value": "8c59843fd5d0aa2ba4a937cd4d6357ccbaa926e538a6f5bdc7f27a41ac66a03a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024311, "uuid": "007967aa-cd76-4080-9d05-51a8519f248f", "comment": "Malware payload", "value": "3ae8c30999baf6e3c86fa2a596c8de988e489a58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024311, "uuid": "5a4dca03-0d50-4e01-9ef5-d3845093db5e", "comment": "Malware payload", "value": "e672bb19d04feb4d6d757679a81ec753986ffa94cfda3a9c96477e0f1a6f75129eb837b53d699cd587c5c26d18df9052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024311, "uuid": "1a960c47-03ef-4e1d-8d57-d9a914e36e48", "value": "T11634236D6D1E9CA6FF9E8D18584C614380AF924BCD5637580753F08A98085EEDFB88B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024311, "uuid": "07956e69-c3f9-4edf-8a6a-93c19ac8c4d8", "value": "6144:c9JDBR+k1CtlVr8ZBaZkgG53y9AOfQCg+MYddaHNy7X:c9JDBR+kYlVr8vhySOfQCg+DdrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024311, "uuid": "b480a7f7-27e7-41ae-b834-65f77a9acbd0", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024311, "uuid": "85608998-5e03-4a58-b1cc-1368672c0eb4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024311, "uuid": "17ad40a3-cc47-41df-b89f-02ab61686fef", "value": "288322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e342e672-5ec5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991450, "uuid": "dd1dc48b-3d15-4c7a-b645-a9c69b84de0c", "comment": "Malware payload (Mirai)", "value": "61940299deecca4de7ffaf4dca161947", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991450, "uuid": "f27bf576-0f7c-4fcb-b2f0-c13e9da6457b", "comment": "Malware payload (Mirai)", "value": "8cdaeb0c370b52c2496fe6fb90acb5d0f9a5107bb472d6ec7cdf74fe7257042d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991450, "uuid": "8cd647eb-47e3-45fc-b263-787b39725f40", "comment": "Malware payload (Mirai)", "value": "78753b601656324fd54fa05a08e9814dca1778b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991450, "uuid": "57158f90-83ca-42af-b63a-1b0ce12b3dc7", "comment": "Malware payload (Mirai)", "value": "0d706f672267ee14cea266fe7a3979a5860c4186dd4ff643297573afeb36cf44466a2918e6f5dff81e21a6b540bf2f9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991450, "uuid": "2231ec0b-cdfe-46f8-b003-cd4a64b67431", "value": "T112334931B97A2E17C0D9A57E62F34724B2F1524E35A8CB2E7C320E4EFF14944A6536B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991450, "uuid": "d031a6df-7264-41c2-86f5-e8603ebb6599", "value": "768:wYHoeEiq9ppBV3lfAmuCaLeBb9fVI7VOCGN5FDxstO+NhIxc2:wYHaiSppBV1fARfLeBbfULhdD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991450, "uuid": "ce5beeb4-e36a-4d7a-9c23-40153097d56c", "value": 50372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991450, "uuid": "ffe02163-ad73-4c78-a536-ec2be8a27a02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991450, "uuid": "6b9e1240-c1f9-4fda-8e1a-0902a627568a", "value": "61940299deecca4de7ffaf4dca161947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edaa710-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987336, "uuid": "e7c75d27-eec2-4713-a4e8-6d6ad114c0fa", "comment": "Malware payload (AgentTesla)", "value": "b25838326e736fa60139c281d4f9cc68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987336, "uuid": "c0261ae9-7c59-4e79-98fc-311b4cab1384", "comment": "Malware payload (AgentTesla)", "value": "8d044f2ded3328a63e79a14a5e2b2b14cb428070b2c30d95998b9d34482ee77b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987336, "uuid": "faedbc9d-ed07-40cd-a7f5-270a6b09479a", "comment": "Malware payload (AgentTesla)", "value": "79a7fc1dce944eac32054e541e3aa4415a4bf043", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987336, "uuid": "296fdfd4-f3ca-41de-8680-fcac01840e62", "comment": "Malware payload (AgentTesla)", "value": "326777232f07d289e160f54bbc97f1bf3569378d7c15a081f8698d5b6d7f8618d06f135032c94973b7f982d661f23893", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987336, "uuid": "5b2a5e4d-6ef1-487d-8833-390edfc4be0a", "value": "T1F4F40103A7A605C1F5BA22719971153103B3BA65D93EDF2D0CCC50CD2BEBA91BA54FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987336, "uuid": "8b278e85-4b5e-4ac0-9c1b-b6c3a37b31cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987336, "uuid": "9282d857-2030-4c7d-94ed-ac2c2b9f8bf9", "value": "12288:XcfAckjivoBQP/QXTrxiiusk1uqHyr1AqESpiRXkMJY1E4syM6:Uk2iS/Kxp9mdSrrIRjxyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987336, "uuid": "d1945343-39f8-4100-b230-25d7ee299270", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987336, "uuid": "29aba825-1183-483d-86f5-d3413fc75b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987336, "uuid": "b2853562-1b4a-4ec9-a6db-e68c87879cfe", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb62ee92-5ed6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695998685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998685, "uuid": "00e19b47-f394-47a3-b195-db51f1142bdb", "comment": "Malware payload", "value": "fd128ec183aa8d4db76e08153a4a43ab", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998685, "uuid": "c7855218-3c47-4d48-988b-d160d2b5f93a", "comment": "Malware payload", "value": "8d90210125ab2296815f5bdd9af3bbfdcda75d6024e01b078e582d9b0b498e12", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998685, "uuid": "ceb937dc-2767-40e0-bb5f-df2faaff8d37", "comment": "Malware payload", "value": "99f7d1bbd3801627f9f0480e236e93bafeccea1e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998685, "uuid": "6dde2322-4f8e-4d71-9d05-80f7fb94ff90", "comment": "Malware payload", "value": "70344d4846d31870eb1a37ebf300a0905903f15b73b24b12183759163fc4f667fb21ee752106039227363e25ca71c048", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998685, "uuid": "613f5cb0-c4b0-4c32-8738-d2282c305154", "value": "T1B5367E6AB29380E5C40E88B0CF2A5AB156243C6ED7F593FB21C979E477316C43A76F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998685, "uuid": "92d8303d-e11d-4d57-a7e0-e2fb883dc191", "value": "4bb67cff82a9a24c9c7488a5cd9e3b12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998685, "uuid": "8b3f1771-8005-4beb-b26b-8e173678c63d", "value": "98304:HPkOBvvt+WFK+me83iqrWU3NpC1lj/cjh46pRBYVRyz:HPkOBv3L2Gj0N1gRyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695998685, "uuid": "52f38979-3b37-4c44-b53a-f459e5e37a3d", "value": 5252744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695998685, "uuid": "619c27a2-802c-40c6-a25a-57b831ccad45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998685, "uuid": "8fd28793-a8e7-4c7b-80c9-eda0c4b5d0fd", "value": "fd128ec183aa8d4db76e08153a4a43ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a97303e-5eea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696007005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007005, "uuid": "7ce3b84c-f5c4-4d18-9aba-c1c8e26d2785", "comment": "Malware payload", "value": "be88f13ad2e21025d52e61a57bc1fe12", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007005, "uuid": "9f682b08-d5f0-4e3b-9ffb-187de125a280", "comment": "Malware payload", "value": "8e811ce651e84105b197539e75d3f7ee69b58f68cbe2f15521669aadf7d23cf3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007005, "uuid": "993f906b-555b-4040-bd4b-76e06d9de9a8", "comment": "Malware payload", "value": "5983aea6039f7cf36cba6eb5680fc1bd6d433ed4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007005, "uuid": "37a56af2-fda4-44fd-8634-b66f22410952", "comment": "Malware payload", "value": "2b35814761141f322c69997e5839e521fac3b01de98248652f9d169b624a63bb33f6e21691e697fa4ae7c25f910a4732", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007005, "uuid": "610d26be-33d4-4377-93d7-419512f26f1d", "value": "T148357C1BA26601BCD4BB9178CA235A47E775744603709BEB17D04AAA2F13FF15EBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007005, "uuid": "64aab1ed-d0dc-4978-943d-836a9825cd4a", "value": "907e684baa019f5bd80cf160486e7eec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007005, "uuid": "98cdcca1-e1b3-47a5-9379-8102cef9b8a5", "value": "24576:caSL9yrK87ycT+RZCP8Z10xlcyolNVJ5QD3oi:5K87ycTsZ5Z1IPWJQD3oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696007005, "uuid": "f3ba649d-72ad-4e89-acd0-87579356738a", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696007005, "uuid": "16216ae0-fe91-4788-b1a0-fef21b0d4a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007005, "uuid": "e5ad4082-8e1b-4586-973b-cf06bcecea03", "value": "be88f13ad2e21025d52e61a57bc1fe12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67627f83-5efd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696015294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015294, "uuid": "22c1388c-b713-489f-b895-06798e3f63e3", "comment": "Malware payload", "value": "be6751b8f8134565d9ecad08b1ca046c", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015294, "uuid": "0ae55b70-24c6-46b3-85d5-94361b240385", "comment": "Malware payload", "value": "8ec573afc951b75a19db13be3675c4a0ff27ea8ff4158143fc281c1198497971", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015294, "uuid": "849d615d-5aff-4a8b-bdc9-9fd4b16ccfe5", "comment": "Malware payload", "value": "804d737b7e3127c781408d461a37fa773eaca193", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015294, "uuid": "9986813b-cb6a-45fd-a74e-7904d81b4b5a", "comment": "Malware payload", "value": "c716872ccd953fff0509fbc55da2de57d864ff1b8876a9d2f1b1d256b160bc09db9dfd0f6cef5bd3c330ca55f5842abc", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015294, "uuid": "94006a2d-9234-4ff7-a6bd-5fb1dd2d172f", "value": "T1649633C52187EC8AE84E9C33D17B6DC1962950E2F12BA83497CDE340756BEB0C1576BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015294, "uuid": "527a3e5d-6bc6-41a9-9dc1-ec6c35c82954", "value": "196608:EfquHkhhSif3HOly+bTLWgEOyhSu+ds7Ss9AMClGdM5euASKnRcw:5dt3Oly+be8+7xBcm9nR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015294, "uuid": "41eeb93d-87be-45f5-aea4-0b1449aec5c6", "value": 9430630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015294, "uuid": "3a056fca-fc9c-4f29-b2f4-356f54ded0c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015294, "uuid": "a1ec74ab-83d1-4332-a10f-f70167cbf04f", "value": "Chr\u043em\u0435S\u0435tu\u0440.appx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ca6b54-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024153, "uuid": "2243b9ac-4359-4277-9caf-f871361dd876", "comment": "Malware payload", "value": "660e7d61b33daef2028181688ae0550f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024153, "uuid": "e2c533fb-7148-462f-bb62-23f3f986f251", "comment": "Malware payload", "value": "8f4f1f500026db3d8e60cfbe6b42e873c79cdcb1245239564c16233305cc56cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024153, "uuid": "85a7c6d4-cbea-437d-a2df-916fefdcad9e", "comment": "Malware payload", "value": "ace7a808b8e39650cfe802eec965f0cba7292227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024153, "uuid": "8dfa4453-fcf6-46e0-9151-fff83707d8af", "comment": "Malware payload", "value": "37e33ed70529c4886b1f2263a2f304ec9fe30714010b26a100a1ee8e9e499ad4d4197b46d005c1a138f3f0483a567143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024153, "uuid": "09ef4d1c-31dc-40b9-a43d-cfefc8840412", "value": "T1383423657F81C33AD25B9443D8B16C1C5D5E3FFE4EB8DA25622A25824A02DF0F6438B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024153, "uuid": "675bc02b-8be6-4279-80d7-84644861351f", "value": "6144:xZ9/YOhZTAE5c9F01qMfArY9F/PIomFbjtrCPnIoI3WgZ4:xTQGra9FGqMfAk9F/LmFtrFoIj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024153, "uuid": "09894fc9-1157-4933-90ad-43e457ababf1", "value": 251920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024153, "uuid": "754df154-af3a-4103-9850-eaf8f329b5c0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024153, "uuid": "f27a6373-be01-482c-a68c-8ea60058167d", "value": "28831.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bcd15d-5e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1695974704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974704, "uuid": "07199acf-da95-4fcf-9281-ca236d8aef30", "comment": "Malware payload (Tofsee)", "value": "0e7c0372aa82d019c894815d14caa6b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974704, "uuid": "72e69c58-5484-4eed-834f-5c8538af1025", "comment": "Malware payload (Tofsee)", "value": "8feb4ad22d2cd7ac7d59458223b6035ceccb7a1a177208582cb44b65d0ca7eff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974704, "uuid": "1347dae1-bac3-4be6-8f98-6cd1243f3841", "comment": "Malware payload (Tofsee)", "value": "a89c52ed348b75c864967de9b5fca6a5e3667015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974704, "uuid": "7897c7f2-78e1-4b2d-85af-9d5ccf7bc947", "comment": "Malware payload (Tofsee)", "value": "1cc7a0ffb697a3b8a54fe0afd8d8e552392f08e97a999e6fb993237b7e40cf4514c8e17cb4adac5512eaea588f16f173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974704, "uuid": "4d336be1-6cee-41fd-8628-0c4c6db396c5", "value": "T16344AF12A2E2BC61D5674A7A4E39C6E43A3FF5718F69672733185B2F0C701B2D263702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974704, "uuid": "7db72dae-b944-46da-a399-12972c9572e0", "value": "bb3e0265f6d3c51a35d3f2ea7c8ca6ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974704, "uuid": "3616be2a-cd6d-45f6-ad4b-bb7d6b57268e", "value": "3072:GXK8zyjB5AWS873nnq0+pNhy1BvfeGPe3XV0Qy/AX65G9CcPpDz1TZsktu1:ukl5nS87qbpNYBvdPehy/q93PpDhTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695974704, "uuid": "c1b0561d-23b7-423e-bfed-e5216d64e3b7", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695974704, "uuid": "be934df2-67c7-4781-aace-ca730b448a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974704, "uuid": "935b0758-2d51-4468-ba60-91ca6c4ca079", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5599c35f-5ea0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695975321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695975321, "uuid": "a980c039-9985-4f3c-ab0b-caf29b0c0e0b", "comment": "Malware payload (Smoke Loader)", "value": "abcfb0731d4b225adb83a42e45fe543f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695975321, "uuid": "61b33786-ad7a-47e7-9e09-eded3171bc76", "comment": "Malware payload (Smoke Loader)", "value": "9072d0cb6d5f4ce2e85009eb965abd3c964b277bacec1277be23f46acde7c091", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695975321, "uuid": "e6632413-8c6d-467a-8372-6a3a6b73599e", "comment": "Malware payload (Smoke Loader)", "value": "cafae4227fd495d48304a4137b206e64a5fc9402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695975321, "uuid": "22fc8006-aabc-4443-96a7-1eaba271df73", "comment": "Malware payload (Smoke Loader)", "value": "a6ce85feea50978c07ca34ad0895077015d2d21d5c6b3e93392c54e0be825224c5497ea65ff6810de815956d819681d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695975321, "uuid": "91faab92-9141-41c3-ab18-379ea9c9b0de", "value": "T13744AF1362A2BC61D5674A714D2ED6E47F3FBC714F596B6B32285B2F08B01B2D263702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695975321, "uuid": "96b028d7-1b6f-467b-a41e-5c95d88c16d0", "value": "bb3e0265f6d3c51a35d3f2ea7c8ca6ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695975321, "uuid": "2c116c7d-5f5f-4ad1-987e-a546167ca40e", "value": "3072:gXK8wvjB5AWSmW0nX3RutLlInV+A8XeLIRo0rPWYLi65G9E7NmkOpDz1TZsktf1:Ugl5nSq3h+rJNrLc9MNupDhTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695975321, "uuid": "8c42438e-62c2-47ce-bb8e-829fa1103319", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695975321, "uuid": "1b07017f-d0df-4cfe-9b49-35c1a19131bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695975321, "uuid": "723d6362-1b77-4860-b742-93f99ffdb2e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bcbd53-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695987166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987166, "uuid": "78bf8de4-277e-4427-9a70-477e28e1a6b5", "comment": "Malware payload (Loki)", "value": "9d6cc78ddf9907650e9a0ebb4af61a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987166, "uuid": "a57eab87-6a56-4db1-bfd7-a89301747fc5", "comment": "Malware payload (Loki)", "value": "90731ecccdf95af30aede1c928da5c09feff63c5645762c80d85d4ca418aa225", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987166, "uuid": "402452aa-b3ab-4b3e-964c-2a150600c986", "comment": "Malware payload (Loki)", "value": "1421d49e15a83b623b78691898f3badb868196fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987166, "uuid": "a0197b4f-5158-4006-9f43-52e83f09c676", "comment": "Malware payload (Loki)", "value": "59264542be44858d1d8f2606200ee5adb2d233d8ec6742b081c78443ced84ff63443bc0aa8386dd32e6ab048fc364ad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987166, "uuid": "e5582108-69b0-4a17-9658-b14b4bda4eea", "value": "T174C4F102ABE551D1F6BB7274A9B1103107B76A118939DF2D0DCC10CC1BEBB61BA94FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987166, "uuid": "c8933485-106f-4cda-a061-a5e8d44f256e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987166, "uuid": "b84c7355-0cb5-49e5-9bce-121e1dd9071e", "value": "12288:MchAckjaKqOnwr3499tfnOX8xRXQF8vBFuJh7:rkUewrfX8xBG8JFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987166, "uuid": "92e0e660-5c43-44d2-bc62-d5a45cb9c399", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987166, "uuid": "4377d203-69da-4581-8144-27572ac7726d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987166, "uuid": "852ee205-1920-4980-a6b0-9e05f95e8c34", "value": "9d6cc78ddf9907650e9a0ebb4af61a5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0212c5-5f1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696028888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028888, "uuid": "4f6784a4-4270-4981-a6c0-ef023c8dd94b", "comment": "Malware payload", "value": "027fd7f7551f40b72a612f94da41d973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028888, "uuid": "fe59ba53-1002-4e31-a8c9-99469fbf729e", "comment": "Malware payload", "value": "9119602dc4b71bdd06f4152572f2a903c003482a90aa53fedfe36d786c318a4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028888, "uuid": "a4cd0a2b-7bcf-4a61-aef3-b0c3fa1204b0", "comment": "Malware payload", "value": "2ea4f739bcef8c60408fa47bd641053ae855b236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028888, "uuid": "9c48969e-5cb3-4f3c-98a0-4de0ebbeedbe", "comment": "Malware payload", "value": "a7c6184e13603b8e4de016d109a4474cf586df81d44b3f7a0e4ec8299d256965b9fe5ce076fd9e440a0ddc77d397cac2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028888, "uuid": "8323169a-2079-4f19-9c32-a18c4de3879d", "value": "T18534AE0E62E2EC60D56746328D2EC7E4762FB8618F792F6B33145F2F18711AAD263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028888, "uuid": "f147eb5b-9340-460c-a7a1-2ece2dbd47fd", "value": "18690df0ed1be01972dcb3dc78c42692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028888, "uuid": "e66322be-caf7-4916-839b-6aef473083e6", "value": "3072:xtXrSmy3Cfw2n8vzb3MEdH+6YCFGOXXB5mpVdm3Hg52B4QwJrYTq:7jNvn83BpFBApSrVwYTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696028888, "uuid": "30852d9c-b3e5-4f96-bb7e-dfba137f4321", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696028888, "uuid": "ccb77c27-a0d7-472b-9789-d41ae8e5a96b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028888, "uuid": "7175334a-19d8-42d1-a719-84156d62b249", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ad7d2c-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015808, "uuid": "1973d83e-a526-47c8-b4dd-484fa94f335d", "comment": "Malware payload (Mirai)", "value": "acee2589eee69725ed93c01aed9f3366", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015808, "uuid": "d1a7e820-b5b2-464b-8700-9363f6f09bc3", "comment": "Malware payload (Mirai)", "value": "92366a59442462dbf7ee06c5073b543b19be23781efd72542345f6662869e616", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015808, "uuid": "c6343c48-eb97-49d6-980d-bf7727c03a37", "comment": "Malware payload (Mirai)", "value": "3085e550903e623b1291afd66918ce7bbbc2fc7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015808, "uuid": "dfb65152-3e7a-42ac-bd2b-118371ec678d", "comment": "Malware payload (Mirai)", "value": "09146ca6a0ad85e874e7f7fcc16dae7a63a1d53005b578d9fb4c16560c091cfe7e01c6de955c09a7903e77d14b033f55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015808, "uuid": "3363329e-2c50-4cbd-8dd6-8ca305dd89f4", "value": "T1FE333BD6B902AD7CF98BE67E80270E0AB53123541053073777EBFC937E321949956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015808, "uuid": "07a63c70-74c1-4ea4-bb8d-8e41ed2e8dc3", "value": "768:8CeKEfhe5Xdrben4I1fN5KQnaodgFHx+iPuvWeffpqmUJT6r6Lu380Dy:dsfIBZeXl5nKFx+imvppqmUJQ6Lc87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015808, "uuid": "39b3e50c-a40f-45ff-a602-75359965a36a", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015808, "uuid": "54510a53-86e2-4e7c-a155-c78a28c4eca5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015808, "uuid": "8ef038c5-b2b3-4378-97fb-5121e2b994de", "value": "acee2589eee69725ed93c01aed9f3366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fdd0aa-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024145, "uuid": "428ed1bf-5218-42cc-b994-80b477a96f95", "comment": "Malware payload", "value": "85cbadefc4e28f206777c2e682f7faa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024145, "uuid": "ebf0e090-1243-4847-b040-dd95fcef322b", "comment": "Malware payload", "value": "9292f95dd1b23175ce32bef293854afee18c2c445bab99bad3c4ec504b1e825e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024145, "uuid": "fb1114b1-b59f-4ffb-ad0e-ef5c671ef676", "comment": "Malware payload", "value": "d4558f388ec6b5fb8153f4d757956e9494dbc350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024145, "uuid": "265d3b9a-333b-4a9f-a5a7-0716282489ca", "comment": "Malware payload", "value": "481bcf4c99d2650a702944f2350c586735baaa9d82649302d23078c636c98aa06efed117784d4175ac71cbf7d32329bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024145, "uuid": "1a46dca9-899e-4e15-9495-be8daae205dc", "value": "T17E34233C3A04EE06C127918F49212D896E5C5497E793EA4542DB5BCED8AC12C2F9E1FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024145, "uuid": "89bae96e-cfd1-4871-b011-b75485802a18", "value": "6144:kUljsOduPQKpmecQ4asm2bKGrO/50wHY0kFxTcuB1WEkdpn:kU5dKQgvts1rO/50wHdkFxTcu7WPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024145, "uuid": "dd127956-e4ff-4ac5-b837-3f2bd1e0b3f8", "value": 251920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024145, "uuid": "8b79bb18-08b9-4382-82f5-cb5f0079517f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024145, "uuid": "95b1d73b-0a2a-42ed-9113-607299cfc60f", "value": "28830.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc3694f-5f1e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696029638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029638, "uuid": "42ef8532-8734-44cd-b874-2162eb1256b3", "comment": "Malware payload (Amadey)", "value": "797eb7c3d81c3c97a385c891f8f06e85", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029638, "uuid": "13f9f193-11ff-46c8-b72a-01808a1ab233", "comment": "Malware payload (Amadey)", "value": "92d7a53e967455a68bf6cb6ddf8a8c13cdb6f82237b18b801ec006c1a1d22080", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029638, "uuid": "deef07e2-9e15-4508-a444-0124e4c981f7", "comment": "Malware payload (Amadey)", "value": "eb102a3fdb0d9faba2b584d4675cc360aeb68095", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029638, "uuid": "75d072cf-89cf-4e24-bf8c-f18780f58b64", "comment": "Malware payload (Amadey)", "value": "7791f27bb5398b0740a902898e22b0b249c3b30003738c92cfccef21cbb602e6c2e58a66a461533720bdcf56213a6e4a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029638, "uuid": "85e73ccb-eb83-4ae9-a11a-2dce09f249b9", "value": "T108352352ABE5B572D96617F805F312D30336BDB188A8414A7785EC5B0CF29D2A83233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029638, "uuid": "819ecef5-6293-4ce4-9753-e37fba0c57f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029638, "uuid": "e49439c5-eda4-48b3-ac6d-651dfba03ab6", "value": "24576:CywQzhQGYKe8cOnJQ5TKdt8vWzBs15HSfB2u0X:pwI/1JQ5ebWiBsjHST0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696029638, "uuid": "c0c3a2a0-6d77-4801-bc83-feeff9fb3109", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696029638, "uuid": "0f1db847-1d5d-4e0e-b336-8a5400327464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029638, "uuid": "5337363e-ebc2-4011-99f8-62306949faab", "value": "797eb7c3d81c3c97a385c891f8f06e85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b367aefd-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015851, "uuid": "ddb39f3f-0d4b-47c5-a12e-166b6c66ab72", "comment": "Malware payload (Mirai)", "value": "ddb6f5792fd09b4fafe3270a038515e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015851, "uuid": "ac4b2e06-cb4c-447b-8387-d23b58a9635c", "comment": "Malware payload (Mirai)", "value": "9352ef8dc6868371088056f931dbf53a38cf0bd6a1a3768a7c7eb4c03b96cf51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015851, "uuid": "1c3e8536-5db6-425a-8731-880de4a8c181", "comment": "Malware payload (Mirai)", "value": "63c40a8050e718bb104baa07d0eeb9454f1de9c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015851, "uuid": "9a437f1c-6848-4387-aa21-cfbc3eff5955", "comment": "Malware payload (Mirai)", "value": "995cefdd7088cdec37b7df85ed35ce298ac1ad25870e8c25bde62c885d57657bb676a020633ea87d8b23bc7a7a3be9da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015851, "uuid": "fd62b26e-2348-4caf-9031-d84cef0601da", "value": "T1A2C2C07DE9A4BC46C9ED08388CDE13B4099D76C6B68E4FAD93261DC46B211CB3C9E474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015851, "uuid": "473ace6d-0510-44bc-9330-11daf40f6bb3", "value": "384:PmWuv+78AdGa2nS3xbjJUFbviosPlozhfbIAawprR9gICSk3kImQ0KnEzrEcftwP:P7ddenS3j6Koolozxfk5JmsEzrttgWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015851, "uuid": "b46e3ecb-b574-4172-b527-5bb00e543b86", "value": 27252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015851, "uuid": "8b79d1cb-cef5-4918-a236-ad8593490e5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015851, "uuid": "1b0dcabf-3c56-479e-9073-2107939edc27", "value": "ddb6f5792fd09b4fafe3270a038515e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af53943-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986551, "uuid": "624cc7ca-6d37-474b-a683-3fc3bcec84a8", "comment": "Malware payload (Mirai)", "value": "fef15597dc915806d2d7a8c84be8a564", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986551, "uuid": "64bae00d-f60a-46d7-a4d7-de70d61124a0", "comment": "Malware payload (Mirai)", "value": "9399c62f415b44f30badb3447e56aee1c5d62fc8299da0d1b8f66a5454d3f785", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986551, "uuid": "64fb1313-02cf-44db-8b46-228b3c34b4af", "comment": "Malware payload (Mirai)", "value": "55fa25a7b0fb0627f6af8317eba9cbb2700407e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986551, "uuid": "f9a2a205-4d34-4baa-8919-ff7db21d3f64", "comment": "Malware payload (Mirai)", "value": "9d9362c7d45f36f9fc77b449e9547cc80dd1122865661b3735142d48a668414f59ec9605014e1dc614097638d5cf7bd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986551, "uuid": "544365ed-e889-41f3-be77-8c3e64f93608", "value": "T180C36A73D82A2F68D195D074B0B08F792B53A59482475FBE14B6C3B44483DDDFA0ABB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986551, "uuid": "80de4243-25ab-454f-9a10-cbb33c89fc84", "value": "3072:X72L23pB38ZmjU3prWwQx2HLHCr7CnMb9Rm:X72S3X38Zg+6wK2HLHyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986551, "uuid": "426f4b70-fb18-4871-b737-146d2c86c743", "value": 124032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986551, "uuid": "3c9ab873-2dba-4fea-99fc-4c8f83e35168", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986551, "uuid": "0e35e132-08cc-4a1d-9176-a871fbd29a0c", "value": "fef15597dc915806d2d7a8c84be8a564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156efc9c-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1695986810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986810, "uuid": "4cca57a2-c8ef-4681-8ddd-ef438a148bd7", "comment": "Malware payload (AsyncRAT)", "value": "71935fd1454ec6da1c334b11faba24c3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986810, "uuid": "8d391c7f-5c67-4627-8a3c-7754a78efda5", "comment": "Malware payload (AsyncRAT)", "value": "93d850d70429bbbd23d5efb0a15018aa971e183eb8964fe8a3b03ef2f631ec5b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986810, "uuid": "5fc07460-aef1-49db-a618-13fa64af6a32", "comment": "Malware payload (AsyncRAT)", "value": "cfb6f6cacf1e708d686db019d35ec341cc48c11c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986810, "uuid": "59002108-ba28-43e4-a36a-ace0328d9387", "comment": "Malware payload (AsyncRAT)", "value": "88375762342bb9d270c7f7e1dbf30643676ecfee780e3c466a6d8ea1eb0351968b3176976115801759a5bccb33d36b66", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986810, "uuid": "3b56a38b-648e-4422-9e2c-08f19aa76174", "value": "T18AE4D003F98D87FDD76649313935A731687CBF231E258A2EB3C0ED6C897018D6525AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986810, "uuid": "f4513c2b-a555-423d-8b0e-16468d457464", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986810, "uuid": "fa2f7d71-8b31-4acf-a5a1-65697df7e516", "value": "12288:TcrNS33L10QdrXPebJPhknGEzXe+o2GAhoWx3FS7866/DnGlF:SNA3R5drXPYhkG+XpOA3FS7grnSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986810, "uuid": "d610b89f-5a6b-4376-857e-9d84f2933fd8", "value": 708718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986810, "uuid": "d7fb383b-286d-42f4-b454-831200cb01d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986810, "uuid": "5040fe5c-07a3-405c-aea0-35aa4a5cac6d", "value": "Odeme_Plan\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b87a40-5ef2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696010406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010406, "uuid": "f33c18d3-1e1d-41a9-ba45-635c72bff00b", "comment": "Malware payload (Mirai)", "value": "9c7243427108567f4f539efeb13dd16d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010406, "uuid": "c85e3417-2db9-4f9d-ab32-956d2ebd9152", "comment": "Malware payload (Mirai)", "value": "95112797fee86aef5e02db130b55370374f9c92dc879644387450e78df3b29f0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010406, "uuid": "56b20e4f-e5fd-4e8e-8d38-33c0d149bc97", "comment": "Malware payload (Mirai)", "value": "2343b3ee9278279de26ea6d146ca2a1c3c1957cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010406, "uuid": "f62aeeb4-6e6b-4b07-89e2-703b1d25e94f", "comment": "Malware payload (Mirai)", "value": "c4bfc30eb8a8dd2fa56e41e07ce22dddf4a85c13de331bcdfea4428e44ff413f874348a144477875f36f29cd2708c444", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010406, "uuid": "df9cccab-9c89-45c2-8a15-0160ef4ed02d", "value": "T16E33F25591A18DE296770976C04BCDCF328168FCC5F6B4A605242CBD3AF21479DE70EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010406, "uuid": "7ec0c0e0-8173-4d4f-a119-3cf9dd90f12f", "value": "1536:Mcj1pvpY/XC3Dj2771VrHSi+oaLXh2dHhy492:dzYvC3H2771NFaLsjX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010406, "uuid": "b412b8a4-7ae3-4daa-8e85-54ce5b6345a6", "value": 53960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010406, "uuid": "d88248f9-40f6-4503-9fe4-b98d773d78d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010406, "uuid": "b936b70d-9588-4937-abc4-79e2ce96bc4a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e945b1b3-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024532, "uuid": "25d48a70-aedf-4e8e-95d3-a89f71d1b9b2", "comment": "Malware payload", "value": "e2a129cbcb2ed23bf13275072ffb7984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024532, "uuid": "6eb61e84-5d16-4ec4-b911-677474dd4064", "comment": "Malware payload", "value": "9597601c1bd5dd6d77ced71717a4e2eebb2129f47196751f9f8207b5d0850b31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024532, "uuid": "be3f2022-bb56-4c8f-aaa6-b2d5f78cf707", "comment": "Malware payload", "value": "e431a1d72b64de2dabc7701abb49fcec830f308c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024532, "uuid": "4f351a9a-58a6-4f5f-ae4f-31813388079a", "comment": "Malware payload", "value": "7d2e965f962f02d6b15a8035289b1ccfe5be9b7170b90a0e1357b940145fee23d5bee246f8e61361e96ecae4630c4ea2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024532, "uuid": "553a4e05-cba0-4165-a6a5-74f82da9f90f", "value": "T1D23423B27E096732926DFCEEF8EB058459931461DC6867CECF60DC37FA5246211A28D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024532, "uuid": "e54de64d-e82e-4c7d-883f-a92a58b6784e", "value": "6144:C309mhLsjJi3nuCRg/+5jt2HVQ5Cj8SDPpKFkRijrhUBkVvr:W09mhLcmuCRc+94j8ooSRAr2aVvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024532, "uuid": "049ed767-834f-49b8-a45a-cf5bcdf55719", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024532, "uuid": "1cd62237-85c2-4d7f-be76-c0f4eaf89c17", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024532, "uuid": "6aa760c5-6998-40ab-a4ca-30ea2b1c84f5", "value": "288348.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34936132-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695977413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977413, "uuid": "07e2967e-137e-4775-b06a-b410f7788a07", "comment": "Malware payload", "value": "6beb7b485fcf483ad365e2eb794ab3d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977413, "uuid": "b57e42a3-9978-4eff-86d8-e863bcc3c813", "comment": "Malware payload", "value": "95c601597e0c5cc6ed9b77c20993bb1509dd263184c037dede3be4c32f57f3cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977413, "uuid": "9f3734f8-84bd-4830-a33e-ff5ac08abe86", "comment": "Malware payload", "value": "b0235b5da86bbf6bb75164bb65cc1e4a5720ae49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977413, "uuid": "2fd21654-bf1c-4920-b602-dedef7ce00da", "comment": "Malware payload", "value": "94d46e586822a2a87c29c5970b579e40760584450a1700c522ea3f7a327cfe2412bb04eeffe97a1990e1e64540fac632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977413, "uuid": "7753eaa2-7522-442f-bfc0-6779703703e3", "value": "T14DD46D2D1BE89E06ED8F83B5E3505EB98BF5C131B399E79628C8EDF21C87B149441853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977413, "uuid": "5fcc403c-55e7-43cc-a718-c20c09c9b2f6", "value": "12288:H3oUqg29l6BHYfS3WkPayWwXr2x9tjXoD84xeuPAV3Fr0oYiNv:YGJ3WU+7tztV3Fr0Fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977413, "uuid": "fd32957a-fdd1-4757-b0de-699b95644184", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977413, "uuid": "31192b1c-f620-4a63-9a92-2cf3b5e1a153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977413, "uuid": "f59c86e1-2c92-424c-9d59-0d190d5ec578", "value": "Ycswddp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61727118-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024304, "uuid": "718d111c-46d7-4dcd-b5e9-740b7058d2a9", "comment": "Malware payload", "value": "a9a7825657b7058d6b2a03b6bc6b4a23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024304, "uuid": "b5741f39-782f-4eb7-b073-9927060ccd6d", "comment": "Malware payload", "value": "95e564c60a402b9a125f4d6d88b2d2e4b557013049b1d044857a59c31b7d3f89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024304, "uuid": "3440c48f-3763-4c26-95fb-5f4a6ae50dcc", "comment": "Malware payload", "value": "b97a03623960092e74d9b06e7e17e2c5ee76d711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024304, "uuid": "54ef6ca4-f51d-4973-9c2b-66d101d40034", "comment": "Malware payload", "value": "53ecea37eed09852f40f273b3e7042ee5652174f2cbe39485669dce365a7f4afce8a64504559ad82e3f158a4493afe63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024304, "uuid": "7cb4617b-f9e4-43b7-8860-d9fcc09e768c", "value": "T19434233FB9980E8671E605446EA6181F736B2C249D3FE0A5A37047EA77F9474B0E078D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024304, "uuid": "c1bdf446-e241-4d34-92fc-bf026b5ac4c2", "value": "6144:ZyKO04Vw/SOxV0VrXJ7qkI2u4u+OR+o0z198:ZGnpOHQzk9h4u+OQnX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024304, "uuid": "5b135dc4-8b5b-4901-b4f1-c26bd7b8a14e", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024304, "uuid": "e4cc1b7d-b368-49f2-a841-aadf68a85909", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024304, "uuid": "ffd5cec3-effd-4deb-93fc-5e990fe6f18d", "value": "288321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76257a72-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1695986543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986543, "uuid": "db064f5f-ce0f-4102-9970-b1b1d07b4183", "comment": "Malware payload (RemcosRAT)", "value": "088fb6348df56679bf0dec9e9a7f910b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986543, "uuid": "e2f45dc4-7173-42be-8482-10376ba8b2f1", "comment": "Malware payload (RemcosRAT)", "value": "95e580d3fd668dcacf5ecb57f32e5116512c711c36d4f09e9b1cd89a568589eb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986543, "uuid": "4e519846-e857-45f7-9aa7-386a9e3652e2", "comment": "Malware payload (RemcosRAT)", "value": "017d9b0272ef35d8dc5d2dc90b9c85c9240652a5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986543, "uuid": "566dbbd9-4be8-4d79-bca7-dab25edd9a7a", "comment": "Malware payload (RemcosRAT)", "value": "3ae85e3f739e96abed485b2bd53f147066c62339363e370d7018cf0be4d971448d546bed87b8a51f48452a0b7316a490", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986543, "uuid": "aa963eda-083d-4c6f-a6b4-f3e821a20509", "value": "T169F4331EFD2DE14DE15BC63258128562C7BCB8180DCF9A0F185BB4DCD6637768EA0B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986543, "uuid": "fb48f50d-7c12-4a3c-9af2-9f241da46e21", "value": "12288:1NkvzRSXR/gQHl/MPiZSZ0T7yFVtJ/5j+IKIAqCWSvvte81ORJgZuIoxoMz3:Xkvz8XR/gSl/qiZoy7utF5jblIvvk4OD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986543, "uuid": "3ee13303-d019-4492-91a6-48bce139df61", "value": 742674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986543, "uuid": "a4a588b4-193c-4beb-ad55-ee653e79a87b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986543, "uuid": "bf82bbee-9dd8-4488-9b51-abbf31e07960", "value": "doc506254756665455.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3704f4-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024540, "uuid": "28bea6b1-2248-4c96-9dcb-8245ba7c2dbf", "comment": "Malware payload", "value": "6e595e3fdd11ab02d69f2bf933a50965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024540, "uuid": "cf841bf5-693e-425c-93df-45f55001e0cf", "comment": "Malware payload", "value": "95e61de0b60fa3842dda2766867052b7c7afab23d21f051039ad0a12f5ca91c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024540, "uuid": "0d9c028c-7c6c-45d2-b75a-43b92a11ab77", "comment": "Malware payload", "value": "be70b470442455b6105645838f11bf8cba959198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024540, "uuid": "03efa07f-4ee4-4c02-9ae6-c2b28d4385c6", "comment": "Malware payload", "value": "e365701775789f7a5d65f49df7199d2bbcf061fbd787fee3a7bf1ef2ba29f7644d8dee4174562b93d06e09eb4b6e4a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024540, "uuid": "f668f7b9-3569-4ba3-a963-f864487fe824", "value": "T11A34233FD89B3F779106949BEB8893AE11BFC5456E4E01639A299A0D4DDF21AFCE1040", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024540, "uuid": "009aef70-1f8c-4868-a348-489e23cf0ed7", "value": "6144:ClFALRZCxEJ2dnyWUQhDZDuZRumNTJUXbxLikTOO9Vo:aAixg2dnyPQhDZqW0JUXbxLikd9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024540, "uuid": "1122fe0f-2bd1-4f19-bade-3f41b177de58", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024540, "uuid": "ad801edd-112b-4da1-a2f5-f7769dac26f1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024540, "uuid": "ab80d315-0af6-47b5-9d40-48ab1a40bde7", "value": "288349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeae551c-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987067, "uuid": "4651b878-a76f-429e-8d07-054df30ab330", "comment": "Malware payload (Mirai)", "value": "353d85d1dd182ae8fe540d58c54e3b93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987067, "uuid": "20901c38-0555-4ae8-9d6b-ac7a9a91912d", "comment": "Malware payload (Mirai)", "value": "960942522b19165dfd5babee3519625024d4903fe3bc37e52a5ce44511f2935b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987067, "uuid": "db3f3b42-0563-4fc7-9cbb-fe73f9e87f07", "comment": "Malware payload (Mirai)", "value": "0afaf00b6a51cc5babf14e0fb78e44e7af8369ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987067, "uuid": "b83b3fbd-760c-4a1d-9337-82b89fa11b04", "comment": "Malware payload (Mirai)", "value": "0242f508b501303db1bc576c3c728a8102dbf7569bdc9b3e9dc4b26c112d34239989d3d3b7aa46eac4cc3bf3423718b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987067, "uuid": "115bb6ac-b6db-42c3-bc59-53e4ddcd7b27", "value": "T169834953AE275F17C15BA1F062F18F710B22BD694E9B1EBA6471EAE85103DC8F2053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987067, "uuid": "32636a66-e5d3-4714-b086-ce2f2217e18b", "value": "768:25z3+D8TZFyggK4nIOia/oZHdCGgONF0gdxf5CFn+lyAcEI:2F3jTZFYK4nISQZdCGxfcn+lFcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987067, "uuid": "730b2171-eab7-4546-a2b5-e3d6c9e6b925", "value": 81956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987067, "uuid": "f60fd630-bb70-4222-aac7-4ced3cb67420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987067, "uuid": "b6919172-7a1d-4168-8833-0ea2efb40f8f", "value": "353d85d1dd182ae8fe540d58c54e3b93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cca652-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695977067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977067, "uuid": "f8ba85ba-4873-47f4-af6d-57c4627aab70", "comment": "Malware payload (AgentTesla)", "value": "2a26f1b192f0d51df9d89d3ab1693911", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977067, "uuid": "f54b73c4-a614-46fb-86c7-fe794527c4b7", "comment": "Malware payload (AgentTesla)", "value": "96138bd8d744b5e55b944fd9efb53faf37d661f4c4eda6ad2a1cc2746dcf3bdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977067, "uuid": "66178df6-e4c9-47a9-888d-9083843429c0", "comment": "Malware payload (AgentTesla)", "value": "06ab2dfee93cbf58e7931ded0a6fc8255693b6f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977067, "uuid": "f614cad2-df1e-4e52-bb57-901bec9eadd4", "comment": "Malware payload (AgentTesla)", "value": "eb9c4bf71b1927a340a1b89890b42b39e8bce69eddd7af53fc0f7c0eb66ae5fc9f01a19a9dbf2b562ecd95c81c69ecf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977067, "uuid": "0c138938-d3bf-4220-bb34-93de1f6e5cb0", "value": "T1E0E402026BD51285E1BE62B2AAB0423153B3B645D83DCF2D09DC50CC1BF7B50BA98F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977067, "uuid": "e0ab287f-cc3e-4577-95b0-b856f0f63c96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977067, "uuid": "d85a2f12-e75b-4696-af7e-70eed32aa051", "value": "12288:CcMAckjJqVfwBZTgs2ztThLattcWli9VtG1ME1y2c03l8CsLsHXR1ue+r9Bj:AkwwBZkHocWlihGvvcGl81sHXR1P+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977067, "uuid": "bee63e86-fd16-41a8-98c3-dfcf6f160a53", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977067, "uuid": "98c7d4f2-0538-4854-9348-aefac5c5feb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977067, "uuid": "810a2324-1ad7-439f-9623-c3e17213119f", "value": "447.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988a1a3c-5f21-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696030839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030839, "uuid": "61fb3048-71b2-40d2-9cc8-2658cc214380", "comment": "Malware payload (RedLineStealer)", "value": "afb3537e1eeac708908afc4fe7629a0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030839, "uuid": "389571b2-6830-4ed9-8afd-0365ba4ee426", "comment": "Malware payload (RedLineStealer)", "value": "963453f600c86b83236aef6b566893ce060f0f6f04b59d9b8ee0f79ae0550fde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030839, "uuid": "7bae77c9-ac51-454b-bb08-88646b4e984d", "comment": "Malware payload (RedLineStealer)", "value": "25b2519080aa083d661f9d593f7c0d2595c7d074", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030839, "uuid": "cae18b32-651e-420b-9b61-b03d89a02074", "comment": "Malware payload (RedLineStealer)", "value": "d64addb9de4e049e379e8c72fdf73845a7be407b9ff5a111f408f68da8b3a53841ad4f327bf82ab70e9f8db7fa348bdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030839, "uuid": "c1cef764-9410-453e-87b3-6d5bedcf619f", "value": "T1DC349C11B4D1A432D57315310AE4DBB65E3EBDA00B629EEF63A40F7E4F242C2D631A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030839, "uuid": "17f7852a-1ef3-4a51-b065-46a3214a9737", "value": "dc563239367bde3bd3527a2dc91eeac9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030839, "uuid": "e0c1e547-43f4-4701-a542-0758a394723d", "value": "3072:0KG3ZE5Mno95B0Z4tu6pxdJKnyqx/doHzaGLnaVRZiTyaUDeAg0FujDvVwzKCgRy:0U5frpxdonyq4zaG2u5AOneKCObfquqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696030839, "uuid": "36fa8bb3-7c80-426a-b173-64a99285871d", "value": 246136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696030839, "uuid": "4bc951a5-7632-4429-9f07-0495be966c14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030839, "uuid": "7559fe45-52b1-4486-abf0-88e1c607c290", "value": "afb3537e1eeac708908afc4fe7629a0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7525f179-5f04-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696018324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018324, "uuid": "182311dc-6fca-4d40-ba27-05044ec3973c", "comment": "Malware payload", "value": "b70343531061ac1faecc210766552922", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018324, "uuid": "82aae628-96c6-48d5-98b5-738f75f727aa", "comment": "Malware payload", "value": "976ea53789f952c3a9f99edfef1df5e11f9fb8bcc46e36f2666313041987ca18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018324, "uuid": "dcd3c138-ff88-4fb6-90de-7f232f3ffa51", "comment": "Malware payload", "value": "49da08e65189a69a98d7c89539759370f6b7d4fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018324, "uuid": "cf0fec73-62d1-4143-8355-b48c20a06421", "comment": "Malware payload", "value": "93f92c89ffb3463d714d21d68aea44298f1d48dfd7ce079599881dda471b69bc9d7a0aeeaa55c0e0ee758d78707ecdbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018324, "uuid": "3a6c7d30-4b7d-475a-bfd6-ba2503605b91", "value": "T1C6B533113EC5C0BEEE2250314F5DE3F0016A875E4F2A5CEB23A85D5D6DB88C7957AA2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018324, "uuid": "17c7687d-2ddb-4c1e-8911-4c720c731b70", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018324, "uuid": "9433917b-903c-4518-bde4-a4eee1855742", "value": "49152:WfTSp0B5wSXoZ6lxwkNm9dwxscb8mmU6ZIJjs+8i:WpB5weJlxwr0xscKNaNs+8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696018324, "uuid": "7f0c4438-4a99-446e-a78d-e5d5d6bda9f9", "value": 2285954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696018324, "uuid": "54886988-2f90-443b-af5d-e271022b2f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018324, "uuid": "a3c943fe-243e-4b37-91ed-e2c6766db30b", "value": "b70343531061ac1faecc210766552922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df055f8-5f04-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696018312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018312, "uuid": "319ba06c-9e3d-4f22-bbd4-cd8bece184e7", "comment": "Malware payload", "value": "07d3370f9ca798615e91d61205e0b6ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018312, "uuid": "f103cb7c-5087-4384-bb54-2d64243b9789", "comment": "Malware payload", "value": "97775b6d80535de7482269ee9bb7374f33ce99a9b500fac1eb9235295d655999", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018312, "uuid": "f81501f9-74cf-4291-9e72-6884b85c9901", "comment": "Malware payload", "value": "779c980417ca0ce3eaa98b905bb0f4604b784105", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018312, "uuid": "0f15a78e-6a2a-4317-b078-f958da0e23ff", "comment": "Malware payload", "value": "6d8cb2657de6362faefd339be2107e66bfc1675ea3b44c437cc8e4ab78cd3f5e052cf545b319dba20e2ae7c3524743da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018312, "uuid": "6d9acb19-4069-4b8a-b705-8407ea93dfc8", "value": "T110B5333171E5CCF9E04666308BB327B743B6B3496F1095E363C8C94C5E788D6D23A5AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018312, "uuid": "f472e9b4-03a4-4a93-809a-15f9f65e5be1", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018312, "uuid": "29fe9f9d-ee1f-4a51-b33e-06fad7105134", "value": "49152:Wfh2oHpjtlyng2uVPszkRAfo9hsdBbYbb84s5E2:WwoHrlyg2xzkR5YdBbYbw44E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696018312, "uuid": "e019e946-4e43-4d9e-902e-7162578003e2", "value": 2310168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696018312, "uuid": "8c6e6ce5-94d3-4c0f-9846-ebc44a7a2148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018312, "uuid": "82c570a8-93ff-43ac-a8f3-cfaa5bdc2e31", "value": "07d3370f9ca798615e91d61205e0b6ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2f615e-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015922, "uuid": "2988f12a-49bf-4505-bb1d-27b41120ce3f", "comment": "Malware payload (Mirai)", "value": "7fe26b416307d973c01668909480edd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015922, "uuid": "4eb1e5be-b191-49f4-a759-7a55bdeb9df2", "comment": "Malware payload (Mirai)", "value": "9782f5719b30d2de8aeee15ae38596f6f65ae8daeb6fcbc854c8268593261e09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015922, "uuid": "1d501d68-6eec-460a-8c63-bfd7a97b3ca0", "comment": "Malware payload (Mirai)", "value": "612e85409ca43e34ccf33026559c55b824e23fa3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015922, "uuid": "c5c5e076-3db1-466c-9276-4c91fdf9504a", "comment": "Malware payload (Mirai)", "value": "76a9ff7bed3f0d1ca83dbb63a6577e715db30a19977304e09e5a2711984293e44366661cf5be1890e07898463945c579", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015922, "uuid": "41af0937-9847-4ec0-9811-112db929c705", "value": "T143E34C02B31C0E47D2632EF03A3F27D193EF9A8125E4F644655FAB8A9271E325546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015922, "uuid": "bae92471-ec82-4b04-b7ba-68446a8aba13", "value": "1536:1gO0kAwtKLS+k0yIfxpovm0hEqMgdmqC+tdUGSuAMjkDpLvAfWJYfcrSamsWnACr:bppQJfxqORqfpdUTMgMfBhbHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015922, "uuid": "831cf059-4f66-486f-b773-1992430f070e", "value": 150020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015922, "uuid": "811ad04a-3bf2-44bb-aa21-dacb116efd8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015922, "uuid": "6f3fa012-3067-482e-98d8-3b79bbfc4b27", "value": "7fe26b416307d973c01668909480edd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47eb262-5eca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695993627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993627, "uuid": "38de7b93-0188-4945-ac3c-fcaee245dc17", "comment": "Malware payload (Formbook)", "value": "ea462e6077aa3e3c7573dd51206c7e4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993627, "uuid": "87c016fb-6690-4cff-9ad7-3c66ea417268", "comment": "Malware payload (Formbook)", "value": "97d8da6df2393f88c7a4b101dd496add87bd218a859b5116fddd253e05cfbd97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993627, "uuid": "2120cabd-d06e-4af9-9a1c-50e56c33b681", "comment": "Malware payload (Formbook)", "value": "0bc324074cdaac8dca42d82129dd6949e7ff0c47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993627, "uuid": "993f5775-94b0-4c11-90ef-e4a56b3ba37a", "comment": "Malware payload (Formbook)", "value": "a64d7d77c362c76dcb6fca7d9a90d2630af83bbe5cc6d0c696dc5ce52624481b53ddc723397746c96a40d0abb5b1725a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993627, "uuid": "524d0f1a-abc4-409a-b6a2-846f82826173", "value": "T1D1055B557BE8CA17D0AF2B76F8B14B0427F8E44AB276E74F174846EA6C473401D8436B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993627, "uuid": "72b0b326-abb3-439a-8120-b2476e787281", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993627, "uuid": "2b17c37a-5b2d-40ff-bf0d-756fed36defa", "value": "12288:YFE9CAFtdmT26QGo1cZjvzeeZyLmigfRW:Iob56vo1cZj7eeZjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695993627, "uuid": "7f9e1b33-f51b-4f42-9620-0ce5f6e33146", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695993627, "uuid": "c40f7939-1d8d-422f-ae69-0a808e6f86ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993627, "uuid": "d8a726e2-6244-463b-99f3-4216357f40d2", "value": "ea462e6077aa3e3c7573dd51206c7e4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89ff0d1-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696010304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010304, "uuid": "0ef288cf-e4bb-4497-97d5-45e6f10a28fb", "comment": "Malware payload", "value": "be26514b8cf6881f0d7681700e5d4b6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010304, "uuid": "a4c4e100-51c0-44ea-a492-7d98c005e3e9", "comment": "Malware payload", "value": "987dbd7fa4385dd3ef5b1521e97ba734889ca8b4a8e6cdd76a991fa13aea8812", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010304, "uuid": "0b88c6fc-4201-4ee7-bb60-2fa4f80155e5", "comment": "Malware payload", "value": "157b8d4cea66fbe2f40a0832fb662e545073ef3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010304, "uuid": "619c2ac5-67a4-4f72-96e5-5c04a6e0b34c", "comment": "Malware payload", "value": "c31042acd35998ffd50f6d7b95624e2a1b5d0894926370968b4bb9a666181b36d7da9492cdfcc0b938b7870a3d18b4b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010304, "uuid": "be648c3e-f742-40d0-84a3-cb956febee3b", "value": "T17823399AF8028D7DF94BE77E54164A0AB93063D152831B2B13B7FEA3BC731592D12E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010304, "uuid": "95fb6df0-7b24-4f0a-a8d1-a44faec9dd75", "value": "768:G4SeUp1dxT8dM2NXMgZjySxuqVsxLfkMYazQwq8DbqSdG0:ZS1T8d31jySgquLfkMVzQr8DbY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010304, "uuid": "0017b92b-13a6-4f96-8c7d-2b3bd739249b", "value": 46672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010304, "uuid": "b4926731-7142-4cf0-98fa-13416d0d6751", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010304, "uuid": "8500e84e-4631-4226-a952-5d5fe03231c8", "value": "be26514b8cf6881f0d7681700e5d4b6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd30f62d-5ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695988487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988487, "uuid": "4abd38e4-6d01-4760-b7f5-1218cc2da9ba", "comment": "Malware payload", "value": "fbc7830cc23ed7d2db57abba36ad8d8a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988487, "uuid": "9b51647f-d288-477c-bf1a-5185e73b54ad", "comment": "Malware payload", "value": "9940b1d84b94ac4fb36aa8916cd988b9570cadd319c95866da02ce62dad4aefb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988487, "uuid": "fac2dee7-99c5-4270-809c-5c686ddafa30", "comment": "Malware payload", "value": "e354b6fee363347c16663f0d25761c289d7a0384", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988487, "uuid": "8d2ec6c3-6d5b-4a08-a40c-219637b027ab", "comment": "Malware payload", "value": "b4e99add5f2f8b2e9c9fa0d2cbf5df4bfa364f6fcd5fe7d3d67a61ee112e57d2d29fac0c2fe16dcbbd268abe2430a760", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988487, "uuid": "8484532e-a453-46a3-9096-027ddd6a2585", "value": "T13473BD1992674FAB090251C8AC5CD5297FE4044AF1D3B291F6884DEDA0CC712B1FDFB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988487, "uuid": "32b73162-5146-449e-8f6b-0a221b3fc45c", "value": "48:+BBBBBBBBuM39ckNBBBBBBBBdfBBBBBBBB7BBBBBBBBEBBBBBBBB4sBBBBBBBBrf:stckTem2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695988487, "uuid": "480f28ad-34f1-4e5f-8e64-8dde5a43594e", "value": 75250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695988487, "uuid": "d5fc85fe-2008-4dd0-ac92-b97a7d34f04e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988487, "uuid": "cfbd89de-92b8-4d8d-a37a-f3cf07c2dc5a", "value": "lnvoice#44393.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cb1fb8-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977488, "uuid": "86d7e47a-6d12-47a2-8459-85a96fa736f8", "comment": "Malware payload (SnakeKeylogger)", "value": "24726d59051982bcb1ded3daedaacb0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977488, "uuid": "38a796d8-cf34-4820-b7fa-5d0472bbd08d", "comment": "Malware payload (SnakeKeylogger)", "value": "99c5c57ec66db2b568df0891d6e8d4c6420e1bcd629ef55f7148659c9759e3eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977488, "uuid": "981abfe0-cac0-4849-b9a5-20aba27269d3", "comment": "Malware payload (SnakeKeylogger)", "value": "fc2e317d419062860f98f3f0df2f95fcb5ce7718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977488, "uuid": "1f593d69-4bba-46b2-ac91-98f4c2155384", "comment": "Malware payload (SnakeKeylogger)", "value": "a366250d2f5d6074bdbd74a558b43a1cc21eb680233dd866df73cb839c7dfad56e33549c7349ee71edac8ecffd283958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977488, "uuid": "5d32859a-e39e-4e9c-a75d-ef86e99915cb", "value": "T194A24B82A68066B7FDB503B454370E51077ABEBA8E50670F28C47F7B3DB37530516A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977488, "uuid": "a8b55989-de70-41b8-bccc-4fcbab0f8358", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977488, "uuid": "3de650c6-a8b4-4461-86eb-91ba59dd3ec1", "value": "384:eU5ewSdw/L2APL6yRqtxAx+roEOsVK/KO+sB6fOK:FqwCs3RqtGx+roAYP+97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977488, "uuid": "08d82062-952c-4cf0-8729-b0a6c0b24519", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977488, "uuid": "8711f234-5c20-43dc-97c3-7bfedcce0b7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977488, "uuid": "b49b0824-6794-4763-b488-321b759d2468", "value": "Ylvclgj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c696d1-5ee5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696005197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005197, "uuid": "c1473b0d-1c84-45ab-b80a-aadfa283b348", "comment": "Malware payload (Mirai)", "value": "d00a84c672bbf26ecce218c6fb764b58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005197, "uuid": "19f3c2cd-c723-4c77-95f0-6e21b91891f3", "comment": "Malware payload (Mirai)", "value": "99edd8b20c6a23f9b62b6cf9c3322db926e0ffb0a700d68cc824b3f6e9d0ac56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005197, "uuid": "aba0b8f1-95d0-4c7f-ad1c-24926e196c88", "comment": "Malware payload (Mirai)", "value": "7665c4462ff0ad976bcac4d0e1136a296b3b26f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005197, "uuid": "0176e8e6-af23-4b13-a0b0-f0a5f8b3b301", "comment": "Malware payload (Mirai)", "value": "9a49d7771311f4d7dd09a0395bf44a5fb688f3c80b72ae7cdc13f23d780ae52b50719a2ae3957734cfd4efc43b937f67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005197, "uuid": "38286595-9165-44ac-a52e-348fab6cc3cb", "value": "T126A2D025D346BEF4DFAF9D9453C2C2C27BE542C7278AC8E340EEAF012906046B789D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005197, "uuid": "1989b1c7-2c14-4980-bdf2-730158670f9f", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5ZM4uVcqgw05VxJa:mRxsSVsMD6xiJJE5zRWNM4uVcqgw09s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696005197, "uuid": "145b2ccc-3f10-4b08-96a9-225464c2c374", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696005197, "uuid": "ce08c8dc-2d9d-4dd2-aec8-b248f5c58e1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005197, "uuid": "493edda3-c1ee-4ca2-95ba-2238fcbb8f37", "value": "d00a84c672bbf26ecce218c6fb764b58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264c527b-5edd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696001441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696001441, "uuid": "77ef1258-fbad-4736-a779-adbf979a8ac9", "comment": "Malware payload", "value": "51d85dc5d5e4138cc493c6f26ce5c8b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696001441, "uuid": "6ac4468a-2a75-4d51-bd56-fe9662d987ae", "comment": "Malware payload", "value": "9b01dcf90c0e29e2adf08ac0fbf1c12f20a5f97611230b3c0aeb0447f30236b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696001441, "uuid": "af8bba49-9ed7-464a-b1e6-a0a4070dfe9b", "comment": "Malware payload", "value": "29aa2ca17722e88a6caa25e69c9275d787905918", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696001441, "uuid": "e5a55c7f-b601-4ee6-a427-0565c06e5cc4", "comment": "Malware payload", "value": "83c4da9026248f4bbc40fddf98041a4ad64457ec99e411f9325708782859782722caef1f1aa590cab1745054a482436d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696001441, "uuid": "be541ab2-35c7-4aab-afdd-c10d05624ec6", "value": "T12F03E195D5266870D9522EB0C9FA8289F2A85DB8D0CF7B5847134906DF034816AFB71B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696001441, "uuid": "fee2067d-7b7e-407f-8e93-f60827439967", "value": "768:TIjUA7Ccc+yzr+arzWGRRKrpcDkpq3UIY6xxLKGeCcL4JOn4ZBSWDUvvPZ:ToYzrzrzzRRw6NxdZvc8s4rSB3PZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696001441, "uuid": "093ea942-1727-4f3d-9364-453cfa4544d5", "value": 40844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696001441, "uuid": "49eff769-502c-4326-8d22-0920a656eda8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696001441, "uuid": "0cf80e2d-8fb4-4e6b-b6d9-70945f507386", "value": "SecuriteInfo.com.Linux.Siggen.9999.20180.13131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1742a088-5f1a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696027615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027615, "uuid": "899fe636-f77a-4eab-a644-fd91810d88ff", "comment": "Malware payload (RedLineStealer)", "value": "d3380e6a63a09aaf0c92bc4b4f76f066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027615, "uuid": "3e051ed8-4dee-42de-b4ef-91b03c035a97", "comment": "Malware payload (RedLineStealer)", "value": "9beecd87678c6e4a2b9b67bbc4dd6d19bdf6f57979e8767a078d9b1c92261ecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027615, "uuid": "273f2445-f546-4e39-873c-16de2c146390", "comment": "Malware payload (RedLineStealer)", "value": "bc7ce96851e662212c7c054d9f91cd69c3900763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027615, "uuid": "dbb5c66b-626f-465b-9b4a-b3707fad8c17", "comment": "Malware payload (RedLineStealer)", "value": "533e9ff281436ea6ec3fa2f466108c4f3a95aeae34ae82da273050eebf013a2e32ecc89c5d77f49cb7f66b09554a1c10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027615, "uuid": "28e7a4d9-192b-4387-94fd-ba9ba43155df", "value": "T1BF847C536893C0BFD4732B3159E0A5EDBC7CA03D094ED1AB47F20A39BEFB6448162596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027615, "uuid": "b49e3dc8-22b1-4bbe-8307-913599e39b22", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027615, "uuid": "9a0b7e4b-727c-4a46-ac51-3c559bba8118", "value": "6144:kHXFo/N5ExgFbNOUAHEHIXbLvZAOZ39Vz0nW2kRu1THo1vxOaSVs0BC+:YwDExgFY5vxLn0WhxOaqs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696027615, "uuid": "ab4b27f9-0e7f-4dbe-932b-d3de9ff6b79e", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696027615, "uuid": "c0e0ce2c-6a65-4ecc-b42e-bd381cb01564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027615, "uuid": "894c61fd-871a-425c-b6ee-f61416f56c64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1974a3e7-5ea3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695976509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976509, "uuid": "9487d568-55ed-412d-864a-0ce59735e63b", "comment": "Malware payload (RedLineStealer)", "value": "6df7c9165f69ecec76baec955bc7b2f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976509, "uuid": "b10afe8a-af03-4937-8a75-f06c9c6fdbff", "comment": "Malware payload (RedLineStealer)", "value": "9c3a3a02d910ffe4e5c551609e0beb2e4c9be48e03e36409e1bec501318a880b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976509, "uuid": "40c05ace-801a-4f0f-b9fa-cf5e01ba45f1", "comment": "Malware payload (RedLineStealer)", "value": "6e3457087baf55263653aa5e63fffccbbd4a8361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976509, "uuid": "458c7a20-78a8-4ba0-8e69-4f15ab600fb0", "comment": "Malware payload (RedLineStealer)", "value": "a65b297b23e61cb91842d12995dd807e3c2e28a7c52c33c872bbb7fd9483e38a564031a0fb28b6cd9f748ad38f5f629d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976509, "uuid": "4aa8a4c9-ba30-42f6-9e5b-9c9ceccd6909", "value": "T105F40221BAC188B1E9B61C351EE1B772777D79300B358EDB4B404A2E5F715C0AA31B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976509, "uuid": "667269f6-5808-4e49-87de-716678ee40ca", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976509, "uuid": "6dca96d7-3c53-42de-9888-fe4201a03625", "value": "12288:f3DkEGDINi1EwkG81/fRRCYZY0nwap+O1PEya2wFNMw9N+dahG63QNEpoNt:/DkUNi1EvGcRRhYDapOj2INJ+dagxlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695976509, "uuid": "23f68676-da63-43e6-8f92-aa34ce6dc9bb", "value": 780913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695976509, "uuid": "b052ac6b-ad8f-4a62-9bc0-ae8bfe9bf03b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976509, "uuid": "c51a1727-5d1e-4768-a63e-e3a6cafcd681", "value": "NEW PRODUCT SAMPLE LIST.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7123b51b-5e93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695969784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695969784, "uuid": "83592ca9-d03e-4b15-a1cb-6dfddf7b347b", "comment": "Malware payload (AgentTesla)", "value": "185e23ca56721b8b50c3e6a91b3eab22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695969784, "uuid": "a8083e0f-9fc9-4136-b18f-9a9884d47be8", "comment": "Malware payload (AgentTesla)", "value": "9c484e689454e58c1be04533e41e340df87af1f280bcaac24d830f3f19aef193", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695969784, "uuid": "bdb6eaf6-534c-4edd-99fc-ccd77e6ecf9a", "comment": "Malware payload (AgentTesla)", "value": "92688cc34064e05c22645578da9ba528f8b0c47a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695969784, "uuid": "b5f403d5-3798-4621-be41-9126b2935763", "comment": "Malware payload (AgentTesla)", "value": "58d8b141312739cb2d58ba8952c3606aba6f21b4d345ba8d4fc052024b69b0505bf52023a1f0ce5046453f76baca48a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695969784, "uuid": "2387337d-021c-4380-90ca-6458de560427", "value": "T1A4C423B25ABC6C4F3D16BE1A40CE6E3975CD2F18E05C17B3212326AAFEDB1404B9E455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695969784, "uuid": "4b8640c2-275a-4f18-b454-b0fc5debd80a", "value": "12288:O7CA1D5irXJmFVI+om9DrPpaIOhLdZx/TsdsWzclT8bJWB1ju5LAcZ0:OmA1tijsFqNPhLBTsd754K+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695969784, "uuid": "4c5b7059-2f4b-4ea2-aedc-00226258663d", "value": 583108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695969784, "uuid": "cadcac19-47ae-4720-91ec-6087c306cc19", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695969784, "uuid": "721bc459-8ee3-4741-8991-368d726b7be1", "value": "FDA + SOA.pdf_______________________________________________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a9b814-5eaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695981870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981870, "uuid": "2ecfa13e-920c-4d1a-9cfe-6cd0f503a0f4", "comment": "Malware payload (AgentTesla)", "value": "aee4edb54123e693d8d5ab04fda43411", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981870, "uuid": "ed9282b2-201f-4052-8bda-dd2f8f1a7876", "comment": "Malware payload (AgentTesla)", "value": "9ca15a88bcffa7a3aaf699b6b00fee7d3c0221745b8200ae00a4b1bc76afcedc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981870, "uuid": "292515b1-e9a8-4e84-b9a2-4c3e9a54fd21", "comment": "Malware payload (AgentTesla)", "value": "59c61b863cef3f5d270db3a9ca5d67acbc2a85a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981870, "uuid": "0e926e8d-4b4e-432d-b07a-ed3af01723fd", "comment": "Malware payload (AgentTesla)", "value": "5aa108323513b13acbbde02c77ad24065db7b9d53f5fbfa1881f19c00945d09b5e7e8e74d2565132a2460a7f72d4864a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981870, "uuid": "e1573948-bc9e-4602-95d6-ef74ca3943ac", "value": "T1ACB3F16DD78B02698F524373971B0E8996BDB62EF38251B1346C933433E9C3D02666BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981870, "uuid": "b6b4788f-00ae-449f-b682-672add594285", "value": "1536:jC6q0BnpP4ugzxcIuyLufRrHtitAc2PbAeuoPvOCf:jCYBn+ugzuIuyLsrtSmTAeuoHOCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695981870, "uuid": "df7536ae-8dbf-4044-82a1-3823bfa48f95", "value": 107996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695981870, "uuid": "3b76e33c-c5b5-467e-ac2e-6398198a3dae", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981870, "uuid": "de566666-e84b-4b4e-af5c-9ba1cc1086f8", "value": "SUPPLIES-283628.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f9243c-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024390, "uuid": "a31d4e1c-e06a-4045-96f7-e554a14e79e2", "comment": "Malware payload", "value": "74b569dc72fc7f00d0d8c46996f1d9e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024390, "uuid": "08e98d09-18b2-4b9a-a08a-8078bd0e5a2d", "comment": "Malware payload", "value": "9d58ee37ede6b2f35e2c69edc959e7653a14521eb81c4cf8581c9ce408ca2b8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024390, "uuid": "21ee9367-b91e-468d-b104-7510ef25fa09", "comment": "Malware payload", "value": "8d9dd8a028c464027d034dc3cf9637b442ffd746", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024390, "uuid": "2c540fc2-e7e5-4bdd-8cdc-f5b85ecf0837", "comment": "Malware payload", "value": "8868f6a1b44437b45632d3f5fe998a41a09e4723907b6288331af31a199a3d86c2ed2b7295fc5b848a32b15982f1a06d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024390, "uuid": "3cf2371d-8113-4932-b5e5-c25921cb3b26", "value": "T14434225E5D120BCAC0857647D66972922D8EA78D893B67F72FC0D6C26022C794E70F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024390, "uuid": "fe282bfa-91a1-49c5-b6c5-68d9481dc0d9", "value": "6144:xRwsIuPt8LADpJmkUoua3WOX76EufNT4gmrsmgs6C:xRLNV80FJmkUouSZpuTwYm56C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024390, "uuid": "5079da84-249a-4ac4-bbfb-deed8f08ed17", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024390, "uuid": "227dd6f3-2126-44e1-a77b-82154310668e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024390, "uuid": "9980ec0f-6538-40fc-8f53-45c1b46b4241", "value": "288331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cba8445-5e91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1695968784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968784, "uuid": "04407603-c515-4030-923d-88c427e3d582", "comment": "Malware payload (RustyStealer)", "value": "796df401bb0079ccb98462f2dd4ab175", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968784, "uuid": "41b63fac-14ca-4356-93e2-920aeb85ca4b", "comment": "Malware payload (RustyStealer)", "value": "9d75c835386e861b900e9cd619fd254b8f2002ba8a33522ec218ca29a8a39bc2", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968784, "uuid": "7c7d3cc3-0466-4c52-ab5c-608823fc236a", "comment": "Malware payload (RustyStealer)", "value": "66ace9e7d4eb81ab3a3f7c627e94819bbaf1d9cb", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968784, "uuid": "9f8a9732-2b6f-4173-9fb6-0541bd2c961b", "comment": "Malware payload (RustyStealer)", "value": "a5d5e3cd8d64e42bde036e145d6d975cf8e3507bd3961a420e872a7974fce1cae00bd76f2b46ccb4cc9c5d9d44bfdc44", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968784, "uuid": "e0ba6a9a-8a82-4d4e-8766-e49ac254fdb4", "value": "T1423633704B7BF980F68C05BE4160ACFAD18719419A68872B1B5827B7490BF7D43D37EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968784, "uuid": "710c86dc-7e65-440f-8b59-a9c0610cb705", "value": "98304:A/Cs3DjlU4u7BqpgBJ7QgkvD9yywoP8wwnoMDfVP2sYowUC:Uzq4hWBhrkvRwTwio252sYowj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695968784, "uuid": "b8388e00-2b11-4ea0-8cfd-e3910709a0f5", "value": 5030121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695968784, "uuid": "ca02d9e7-00cd-401b-be71-d7523a09b637", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968784, "uuid": "65cef861-3f0d-4417-8aed-a09d867f0bc3", "value": "prod.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55f7f31-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695986622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986622, "uuid": "de0c58e4-93fe-49a0-940e-67f1ae97da3f", "comment": "Malware payload", "value": "49d7af9c571aa514fdef9bee300ee8f4", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986622, "uuid": "d58c7f9b-4947-4ee6-97df-a7b3c0bba878", "comment": "Malware payload", "value": "9e67ff061e36125ab33d66d3109bf869db2e2ea66f9ff061c2fc0ccfadc2a272", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986622, "uuid": "fbb08492-dddf-42f3-be5b-e33c44d948e4", "comment": "Malware payload", "value": "502153fb0c0aa6ef99f938f72a0ed636261ea284", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986622, "uuid": "98529820-6d48-427b-af25-71acb6cf1a0d", "comment": "Malware payload", "value": "c99a21426df3e623905de51ce5f57009d2c246172003f5f4912bc06820131270b168cef1abf4057204a8265ecf516dd5", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986622, "uuid": "87eca1ce-e073-420a-a601-04e0c294f952", "value": "T18641020562DE5329F3B3097BD87663A1C963B45BF6B38B0D01909C8DA8382409C22F39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986622, "uuid": "4be885f4-4b1d-4a66-b793-0a8e94419195", "value": "24:8a5iWJCnIcV0RA8vU+/VYZBmk7hq0bxi85pymZSmUH:8a5Yyi0pYZBmk7hqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986622, "uuid": "1e9f61a7-54a5-4ab3-a9ac-157e3ca96757", "value": 2200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986622, "uuid": "0aacd56e-321f-47e0-bbdf-cbeaa721cb7d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986622, "uuid": "020d85c8-dab8-44a5-a1a2-ea19ed813241", "value": "4DH.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f14ee30-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695986799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986799, "uuid": "1dd25648-edfd-447b-951a-71220d9c860d", "comment": "Malware payload (Formbook)", "value": "acb6eabda1756c3bc4e6a7d8da483421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986799, "uuid": "04752cbe-a881-436a-87a3-9ac27059844d", "comment": "Malware payload (Formbook)", "value": "9f7f9da912054d67fe208a590cfb2978bd6b6d28afd6ff60a191e955dd104ec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986799, "uuid": "66491eb4-e27f-430d-91f4-0c75f73ec863", "comment": "Malware payload (Formbook)", "value": "139c7e51a50b00660e59c7f25cc6212d0efb35a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986799, "uuid": "15d516a0-4330-4332-af3e-082e9386c751", "comment": "Malware payload (Formbook)", "value": "9d56202a1a46fdcf250b9ad3a4e071efbbb3ecbdd8ef5e8c355a4f0567789b64088a81050de60c9581dc7d8d70bc65fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986799, "uuid": "567c6028-d3a3-4cdb-93a7-d87a6b2a43a0", "value": "T19D64135576B1C4F3E8B21A30A8FA411A1AFDE64658B0FF5703E0F65E7D232A0DC19762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986799, "uuid": "bc4ed436-2a31-43c7-ad58-92c49ece679a", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986799, "uuid": "14352837-e4d0-4a77-9eb3-c370da55fd07", "value": "6144:BnPdudwDs9Tli2DJIv3hbguVtvyLX02DCRe3BBs8Tt21CqAY7wTChGSUigbgV:BnPdwzi2Dqf+u+Egv5QnkTS/Hl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986799, "uuid": "a5837515-9239-4468-9340-79b209e0b74f", "value": 331410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986799, "uuid": "2a15c4ad-cad6-4631-ba97-5839e35b58b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986799, "uuid": "22774162-f6c7-4187-b753-50a8059d308d", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9824e410-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695977581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977581, "uuid": "e58168ee-17b8-4ce9-bd27-96b522385864", "comment": "Malware payload (AgentTesla)", "value": "d3c0249433ad9d2b1d3ac22c4a605922", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977581, "uuid": "8aa0e847-a295-489d-89c4-7e2a72431043", "comment": "Malware payload (AgentTesla)", "value": "9f9dd91a9d7373e39a8e7adc7e7ff1adba045e4590798eaf47f2a701e8036331", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977581, "uuid": "f77f4768-3604-487f-a15c-8572096011d9", "comment": "Malware payload (AgentTesla)", "value": "3584b31d6977bd5155fa5ee7a9c56ed6fea709fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977581, "uuid": "ed63a4bc-026f-492d-bf5e-101478a72dab", "comment": "Malware payload (AgentTesla)", "value": "a92ba5adc133c7ca921a2a55909cb592c4202e8a8f22c16c869f887d442d7d62d14257a0ec3d1e0deed0769a5ae8766a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977581, "uuid": "f09349d1-9e34-4414-8750-42c8f91a603b", "value": "T19F05CFF8341683EBE3A49BFF418761756D5BAC211B3203E9BB3C39704EA19AB0D55871", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977581, "uuid": "c9c0e20f-0f5c-47ff-bbed-e84d5783208f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977581, "uuid": "229254ea-4cf4-4a6c-82e3-355fe1c8caeb", "value": "12288:V05fVsbR2DorOWw86zYrXW6iVST9e6c3li8ogBNS4rxG:KtO2DjWwDkrm+GlRogBNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977581, "uuid": "613818cc-05b6-4b31-bf47-f9a7bf6c7e90", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977581, "uuid": "5aaa6203-e072-4fdf-ba1c-4702430f556c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977581, "uuid": "8a362fb8-8589-427b-978c-a0192866c973", "value": "Freight Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2fb6767-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695986672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986672, "uuid": "4630774c-a23f-4b5a-a543-421296cbc30c", "comment": "Malware payload (Formbook)", "value": "ad42c8d84e3bcc2ddb75d234a4ba7482", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986672, "uuid": "7701fbc8-37de-4baa-af4c-14adbe0277df", "comment": "Malware payload (Formbook)", "value": "9fd85511cbc4c6e3336f1a9bb3bd38e8ff46e3ccddfd1799b0bc0ed3a24dc05a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986672, "uuid": "10b8809f-faaa-4ed6-bda6-710c89a5fab4", "comment": "Malware payload (Formbook)", "value": "5f35d69505c74175a763d28f7d4600e8c6005e69", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986672, "uuid": "96083c06-6b8b-4d1f-9a19-94066bd82bde", "comment": "Malware payload (Formbook)", "value": "f5047f272c4b32b6b6ce65ae31a56c167b9fc2d2a6579f39c12d34ff44483275bf720fc7fe34bd72a598a9f82eb1e7cb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986672, "uuid": "1e88bbc2-6575-4491-be15-f43343ece814", "value": "T1D274EC2029EBA44CF2737F635BEDB6E95F6BF7E15716A06D240003075B62E80CE65A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986672, "uuid": "45af848d-10ab-4116-b1d0-c528cc0e2a21", "value": "6144:Glys+Z7ZTZtZKZWZnZIZqZ+Z4ZWZRZFZoZ/ZZZ8ZrNyNONJNfNjNKZFj:C+Z7ZTZtZKZWZnZIZqZ+Z4ZWZRZFZoZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986672, "uuid": "24cacce1-e7e5-4a9d-b93a-3e23567b4835", "value": 353654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986672, "uuid": "b8dc6b3d-02a1-4f63-a90b-c04ecbfb73b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986672, "uuid": "c6d72ef4-ea21-476d-8641-9710ba0bccde", "value": "809444631SP-112.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00eadb92-5ed9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695999661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695999661, "uuid": "5f8e60bb-5958-4ac5-bf59-d8ee6eeb23de", "comment": "Malware payload (RedLineStealer)", "value": "066dbf69cbfa16c46a2142a257c95f1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695999661, "uuid": "f05d76c8-9f09-4d63-bf2d-89c929ef22ca", "comment": "Malware payload (RedLineStealer)", "value": "a075c57c5e9ab478af53bbfa19faf2fecb404abd0d1ba953e84d347d5093f906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695999661, "uuid": "1e0b17db-961f-499a-b29f-8b7dfb9af156", "comment": "Malware payload (RedLineStealer)", "value": "0300eb287c3e29642877772c348c6b683b86a305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695999661, "uuid": "f1c3857c-bd2a-4146-8419-a754d513f560", "comment": "Malware payload (RedLineStealer)", "value": "83535ff22791a0d09fd5f4596d405601461eeeb0d2231f7a55b8d8211c744fd65f00d210125c328bc7c337a0a1c09e44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695999661, "uuid": "4c5b023c-ac5e-4d0b-b119-30c2e9619a26", "value": "T1D7A5336071C3E4B2D0F3503090EA9A39DD74757D871984EB36E9BBAB9E603E526321CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695999661, "uuid": "d85ffd50-abab-4cb3-abbd-db61fcc3421d", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695999661, "uuid": "9f23bbe0-f5f8-4caa-b2be-bfa2fd685bc4", "value": "49152:wkQTArh5KH1JME1y9fb95r/6LGoc30b9KJp9D06dkRNLkL+mrcTuZqy:warh5s41rL6WY6SRpO+dTuZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695999661, "uuid": "064ac256-1a51-4949-87ca-9ea6e70ff7f6", "value": 2159104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695999661, "uuid": "a432cea1-081c-4258-bd8e-0741b60f4626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695999661, "uuid": "60bd324f-79b4-4d65-a1b0-0efdd93e807f", "value": "BIN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360ed85c-5ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695978704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978704, "uuid": "8ab4a461-c370-4e86-81c2-10f2c14ce742", "comment": "Malware payload (AgentTesla)", "value": "ae22baef59073c96a180c6421ea14406", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978704, "uuid": "7f5baa06-f439-4778-aaaf-0fb293106d16", "comment": "Malware payload (AgentTesla)", "value": "a137cff915e45fd894f48951ee7fccf5d7b9da31539a8fe0b287f1720a8794fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978704, "uuid": "7de5e6c7-2af1-454b-a662-7bdb4aab131a", "comment": "Malware payload (AgentTesla)", "value": "8740ab8803572393f9c58f85e52a194a0ab0ec67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978704, "uuid": "20653e72-8b44-4d9c-901e-31e6888844ea", "comment": "Malware payload (AgentTesla)", "value": "fdcbee29a0a48ce3957ed0a9baf1e7f33de62e199cbd155f406bb5a0e1b925abff5e3e876a97c9d921c66bcb165c5d48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978704, "uuid": "ee74c1cb-bf4e-4a95-b9f2-3c2e91b0b84d", "value": "T108D412987DE90B20D88D13784A88722B43B177259826E77CCECE54DB1F7339A6C61B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978704, "uuid": "80fdf15f-f859-47c7-b941-15354b501a23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978704, "uuid": "390a7817-8444-4adb-9f78-abba2df387f4", "value": "12288:z725x6l1W34pOLpHL4ziwfUjM/mE8pOukGCBOBWgd4Y8Voy8:Gz6TWIpypHQiwj/f8nCkBRd4hVoy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978704, "uuid": "59d51b85-94a6-49fe-bd26-282e2bcce943", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978704, "uuid": "fa90b2ca-b5ff-4a15-9258-2b77e12d55cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978704, "uuid": "b3482cfa-d432-45e7-9265-6c43653f0363", "value": "Scaned_Product_Catalog.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46dd4f37-5ebf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1695988611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988611, "uuid": "831cea04-3b9a-427b-b5d3-dc95e8a07604", "comment": "Malware payload (XWorm)", "value": "afca5eaa6d402c37a8aa7d93110c97f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988611, "uuid": "22f11081-dd12-4f4f-860b-478ee73b88b0", "comment": "Malware payload (XWorm)", "value": "a1d6f223fa3e037cea557b5b5aa79bea29060a9a323ca9974806a04ad05a3dc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988611, "uuid": "1549f515-c262-4285-bf30-8e39624aeb63", "comment": "Malware payload (XWorm)", "value": "e5d797b50a51b9595a85260ec353768ab1515258", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988611, "uuid": "e7306314-5116-4415-8f09-027aa00593fb", "comment": "Malware payload (XWorm)", "value": "3b7e15af646df7c253194aa6ed27523c757e388d339e9bd007f758e1b15f9edc4972e31e0ad78063b4bb33cc50ea47ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988611, "uuid": "9c6f6c35-32a7-4a95-9f60-165974978cb0", "value": "T1D294125477C69A50F1FE8ABD8872F108633379AE4450CB7E4D4AB0A83C917529F51BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988611, "uuid": "9932a835-c848-4fc4-bf3a-7609ab7104dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988611, "uuid": "fca05638-8ca4-4a3d-9a1c-bbf0f622770a", "value": "6144:LJgOMsar5xbivcUblrM2KDBXQseSDCOTMAtBMA1kqDzumBFTLv++GDZMj:mOMxWcqrlK1XHeSDCOIkBzbD59BGVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695988611, "uuid": "e70dba5f-a5b0-4a5d-bbfc-7509ac1ba0e5", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695988611, "uuid": "496a1bcd-8fc5-4553-87db-b449bc981aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988611, "uuid": "8f7ef757-f94d-459c-b588-c7d55c20581b", "value": "New Order #No-1251.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1421ea-5ecb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695993752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993752, "uuid": "323a74e8-90ba-492c-8a66-0255f9f6d242", "comment": "Malware payload (MysticStealer)", "value": "e187555fb5581d1568eddf7ac7b79e82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993752, "uuid": "12a5d4ed-503e-4ce2-8d03-3b65aa356bb4", "comment": "Malware payload (MysticStealer)", "value": "a1f687030c0e6bd6884cb8ac0db4a617709d07518c5e98622d1944628d9526c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993752, "uuid": "ff879872-8332-4f75-a633-55177526abd8", "comment": "Malware payload (MysticStealer)", "value": "b11ed3d7c53e99ad8a3e8b74d115c82aa687c12c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993752, "uuid": "5d55f26c-3398-4dad-abeb-e0a7bdaf93c6", "comment": "Malware payload (MysticStealer)", "value": "9989c440144bc7912872055e99ad7514fa35cd4931316b19eb01a0ced7d8c4daac3aa25fb9a6f64ec19cfbb2b7d541ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993752, "uuid": "92510ddf-87c1-4f66-ba53-50e459bfca17", "value": "T18F74B05171FFC0B2D87218350980EBAD593D74200DD116BF9BE8DEAEAF27382B291576", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993752, "uuid": "1d01ae2b-d212-45d6-9fa2-75fa4738ea57", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993752, "uuid": "26e724fc-0804-4d9c-b763-fefd446ef15d", "value": "6144:uSTeW/s5GqrO5aXnfEGIXWPvZAOpyzviKtC6TQ35M4NZ5/Vs0BC+:4mcGqrOk86xHb3L5ts0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695993752, "uuid": "0426f737-9192-4666-a986-2f3f981a6657", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695993752, "uuid": "1bccf5f6-2f5f-4ea5-bdce-d4e153e1d47e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993752, "uuid": "2e659a7a-f730-4608-85bf-58e0b3599dea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524f93e5-5eeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696007528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007528, "uuid": "445524c2-c34b-4704-b24d-3ffcc058bd0a", "comment": "Malware payload", "value": "4e122e78f143209e0dc9786aef96458d", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007528, "uuid": "23b8923e-5fb1-47e3-896e-811175d8b2ec", "comment": "Malware payload", "value": "a309e5c350395db0a40d42e80f24a4df66ec30e39a714349a2eed27cb827a322", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007528, "uuid": "7e030d61-0d2b-45bd-ad3b-d35e51cd32ba", "comment": "Malware payload", "value": "2b485dc41b9e636f0baa6d9bb6cfb4835519945d", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007528, "uuid": "d2d4fffc-f21e-462d-b75c-8abf7f94682a", "comment": "Malware payload", "value": "ef9c56374c71a9b17ff73744397ef98c2d9367277e6a75a802731079b814a840c4e32fddeea1f05480c19647bb1f34bf", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007528, "uuid": "b8416245-6098-423c-aa73-4470021753e1", "value": "T1D261BF932151B8EA414283BE3E4D6AF6807FC224A55A6044F78C4F9DF9DDE233A8D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007528, "uuid": "4d11c770-f26f-4460-bb6b-59527a1e1182", "value": "96:+GTBy2CHuSA31jCQfLhL0HxmAiBrVMVVdLH:3Y2ZxmHxmAiBrVOPLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696007528, "uuid": "d249b5c2-6e27-4648-8da9-7b12ded39811", "value": 3289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696007528, "uuid": "7929d935-baab-49a7-8ab3-4bb3b5da9252", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007528, "uuid": "e47bf734-4bc3-4e47-82e6-73408e95d5d1", "value": "gEuhLHV0.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0d0de6-5eeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696007596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007596, "uuid": "a2936aa8-ca88-4047-a30b-c186512230a6", "comment": "Malware payload", "value": "d6a782cd2e4b92e06bbc8204013f3d68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007596, "uuid": "f6f6e6b9-61b5-44aa-ac33-d6dab5742fb7", "comment": "Malware payload", "value": "a3519e6c142a1a4e08f6c71b02ce3bf50b3182fdb6131da271fae77c7a4eba6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007596, "uuid": "d8cb85bc-3f19-4ddf-96f6-ddb2200e5704", "comment": "Malware payload", "value": "9f1823bb5ff000dea21e3e43a0bf821434482ff3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007596, "uuid": "c732b618-9baa-40cf-bf05-6e81de52270e", "comment": "Malware payload", "value": "d6bc3606e3065366d678862ac333050d176d6558c599f946f0427d103902e611bb03681292fa92afdcd8df48d0fe992a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007596, "uuid": "3440cca4-7030-4c0c-b8dd-4de7d6b066ab", "value": "T187C50140B1ED6DF4ED95D2382196DE905DEF1B9EB303E849AD4CA0E824307B679B3D21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007596, "uuid": "db92af7d-a924-4fa2-916b-a3d26e5ff7a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007596, "uuid": "6a2eb66f-f963-4fa6-b0a9-d257ef001bab", "value": "49152:oLdSRmCAGo0rfIDYlrglqWh9iO9EMJYamBLMpLNH:oLw7A7ufLroqWh9hEuYppML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696007596, "uuid": "1233fc60-1108-4d06-8767-f85a14da1747", "value": 2624368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696007596, "uuid": "b33754b5-013c-499a-be31-caade7593409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007596, "uuid": "731d6155-4ea7-4f9b-a39e-af8c0f24667a", "value": "d6a782cd2e4b92e06bbc8204013f3d68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e897ee8-5ef3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696011011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696011011, "uuid": "417ac452-5034-40fd-a3df-e2d3369a3669", "comment": "Malware payload (Amadey)", "value": "ad72c09f78a810a2f4c223050f7a6daf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696011011, "uuid": "cc66bc21-c59e-4cfd-ab3d-0f09f6e5dfb4", "comment": "Malware payload (Amadey)", "value": "a35afe26b8ddfde1245999d5706f7520f5b472c1d46f61e0451b74d8c3169f39", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696011011, "uuid": "2fd99fbb-f8d9-4a3a-b058-7215d900b635", "comment": "Malware payload (Amadey)", "value": "68a828a84316d74fbe5ee645efad444c8218c0cb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696011011, "uuid": "3f5e16b1-0f57-4ccc-971b-46499d59c1a3", "comment": "Malware payload (Amadey)", "value": "a9186f68d712f750d2d101f192b84e4914c0b0198eccbc5d84959f243745f0020801fc7523c028a2031a26b416dce80f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696011011, "uuid": "c935055c-bbea-48f3-b5fb-c4309e1649e1", "value": "T18534AF11B5E18472DC7325364AE4EBB99A3EBC3009915EAF67F40F7D8F30281D621A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696011011, "uuid": "db7b6c04-802f-4ead-a705-6a53de5b30ca", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696011011, "uuid": "2291422a-50ef-42e9-9fd1-e06b6650f6e4", "value": "6144:PHz4SHy5uoBMFGV5PEkIXEHvZAOwNGvrMSVs0BC+:kCmuoBMUOMxZvrMqs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696011011, "uuid": "598a1220-aadf-4c78-8b8d-cc37b3b1a2af", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696011011, "uuid": "29705d84-d73e-4faf-ae29-2b88f2fe4af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696011011, "uuid": "be76f4b4-74ad-41f2-ba94-239602370356", "value": "ad72c09f78a810a2f4c223050f7a6daf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c676d0dd-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024473, "uuid": "d3f1268e-ddfe-4f65-90b1-47f71a8096c7", "comment": "Malware payload", "value": "19eb919ac6be31c6b498417bb6b8b73d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024473, "uuid": "28626f62-1f77-401b-bbef-4f2d20c4d4f3", "comment": "Malware payload", "value": "a3e1cca00539fe85dee17a0916aa95f203a387fb2300d8dd14ce3d5f77f414ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024473, "uuid": "6f3bbe1e-7ec0-44e0-8c80-ed9376d57f64", "comment": "Malware payload", "value": "5362461726681618a1188d7d804994b9b6f90979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024473, "uuid": "44dffcf8-1da4-4c5b-aaf0-f871e5f10655", "comment": "Malware payload", "value": "c453b5dbe8b23cb66a260161890b0b7ee67191c7366008358059a8b0f43bf3fb2b8bbb4029fba0b86f61d7b62ab30f48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024473, "uuid": "ee99bc56-2f54-4bc3-96f1-fc71e598bbba", "value": "T189342305AB94EB676EF4318B5F0D1376B3037A422785840AC8E153CE5B173B9BE18B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024473, "uuid": "d2d384f3-14fa-47a2-8051-e2ec1bc5b8a2", "value": "6144:yQ72DUFRREeknElhxvTzflEiuDD6hk3FKGQII1U:52DUFRRE5ybDiiD8FKpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024473, "uuid": "de6f2b29-1f22-410b-a992-d6c78146affb", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024473, "uuid": "e6e021bc-3d53-4654-a53f-6db22477c081", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024473, "uuid": "55c11aaa-cb68-49d0-b082-a6be42f7d2a1", "value": "288341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821c5862-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024359, "uuid": "98181fdd-5014-4e6b-b58c-abdfa054b5bb", "comment": "Malware payload", "value": "dea5b093cce19a7cc8b7b48d5cb9b29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024359, "uuid": "2d4acfc3-02b5-4f14-ab4c-aaf8048cc953", "comment": "Malware payload", "value": "a3e6533083988223d35fcb2b75840e644c5f506e266e568722efde7e457aa9b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024359, "uuid": "2a0efb87-0dd4-4bb5-8404-2a5f4c4ab826", "comment": "Malware payload", "value": "830a640b8a543f29391e7f8ccb3b96d260730fef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024359, "uuid": "85a392f3-47b2-4880-95bd-94408db90964", "comment": "Malware payload", "value": "39ddaa684347925f7bf8d505b35b838170dbd3114911a81dc8c6353ca0d855711cddd02379509182f27ff7eb09aa2c90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024359, "uuid": "ad9fb146-dec0-4488-ae85-edb3231f189e", "value": "T1FC34232225D6B6C1A64B4CE83FA85E1D44E5DC38093BB31395035EB7E143A864E92F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024359, "uuid": "6a09ec22-32a1-4a1c-b449-1222536b2e3b", "value": "6144:ZTs8VPhR4VsMOpXiLmeXoF1xJOBf45O5vNAE9MTsclPDz07dMxgY5h1:ZggPEVsLXUxQJ3eLnc9z0PIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024359, "uuid": "112baaba-e5a9-49fb-9f81-a1b624864831", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024359, "uuid": "74ba2228-2d44-494d-a2e6-f801aef0dcc6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024359, "uuid": "0ce692a7-4df7-483f-bfda-15dea0481ab0", "value": "288328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5d8979-5f1e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696029339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029339, "uuid": "629299fe-b399-4075-bbd5-adee889ba934", "comment": "Malware payload (Amadey)", "value": "0ba9be99249c799edc960efa09a3f9c4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029339, "uuid": "50622e9d-16d6-43f8-9560-c9446ee1a093", "comment": "Malware payload (Amadey)", "value": "a42ad74b581876acfa3bb799f6c1e6a4e8a494a397e7b6c7da954807d1275254", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029339, "uuid": "63123589-921c-488f-8f18-cefc0a0abd30", "comment": "Malware payload (Amadey)", "value": "ececc3558bf66123ddbb2a1d377d0c124b94437f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029339, "uuid": "31488cd6-c842-45e1-be57-0f40855785e3", "comment": "Malware payload (Amadey)", "value": "b8e39110d078e29bf1a3d9f881638efd19ee60af13cbadd695a6ef38166f637b84f7bb6b4ed5f44ef2fec60bb80bfae5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029339, "uuid": "5075cb8e-a93c-4c12-b873-e8e8afc921c4", "value": "T161352316BAE86161D8F6277054FA13C31B753D705D68832E2386AD5E08B3D90A632F7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029339, "uuid": "4593f393-b35a-4cfc-9c09-bca5ce6f1ddb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029339, "uuid": "fbc5c633-abea-464c-b6f4-e01b432534ad", "value": "24576:Py3EN1pH+jhKB2/ZJd8sHey3hDaru6iL8oIM36cYN:aC1pH/B2xJeiWru6iQo96c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696029339, "uuid": "6a4374de-0040-461a-84cc-abffd63e50bd", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696029339, "uuid": "2a50310b-935a-49ae-b162-d72c29ceffff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029339, "uuid": "bbe612af-b37a-423c-a304-96379af093bb", "value": "0ba9be99249c799edc960efa09a3f9c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370f7204-5f04-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696018220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018220, "uuid": "8b467c2d-0c39-4211-bc5f-57e0257c3ee0", "comment": "Malware payload (Amadey)", "value": "9291bca826cef1aea38b5ef29194b4a7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018220, "uuid": "e9cdbc0a-2032-4438-8933-32c52e486631", "comment": "Malware payload (Amadey)", "value": "a4a72aa6e13e8a2a2dcafc11b4ffe3cd1ac26ea18d6ff09d29a8943eea7a2c56", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018220, "uuid": "cfd300af-2c7b-4c77-bca1-b46571892f00", "comment": "Malware payload (Amadey)", "value": "be86f884b0f532736baffbf01ad501c5eb563c64", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018220, "uuid": "c3826e00-0f28-49f9-84f1-d63d3e45c2bf", "comment": "Malware payload (Amadey)", "value": "399d5eeb203f4d61a381acc8ff05a710bf89e76d9020f4da53dbe2c337b34a2153e6e653618bdeeada2232872223263d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018220, "uuid": "34af4cd9-8b7c-4b49-bde9-d56166fc1c39", "value": "T1EE34BF11B4D1C072DC7215360AE4DBB99A3DB83009A65EAF67F40F7E4F34681E632A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018220, "uuid": "f63f1ffd-611c-4370-9a6e-36ea7932da2b", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018220, "uuid": "f68ac889-b315-4970-a063-f9a53b4ba1e9", "value": "6144:JRDz4SHy5uoBMFGV5PEkIXEHvZAO7MpBWVs0BC+:ACmuoBMUOMxhs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696018220, "uuid": "23b86799-b858-4570-9df6-bf5386d2b744", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696018220, "uuid": "d3c3d406-33ad-45ac-bc51-a8f36ab7d2e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018220, "uuid": "c41b3793-34f7-478e-a6fa-b4ecb07d9c47", "value": "9291bca826cef1aea38b5ef29194b4a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc43852d-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024483, "uuid": "6d0de59d-e91e-49e5-884f-beb9b79b5bec", "comment": "Malware payload", "value": "876e730299809527a892819c3bd1ed6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024483, "uuid": "b5a4f91a-150f-4be1-bc58-5c8cce170f0d", "comment": "Malware payload", "value": "a4ecc3e15dfadf6e78eb8c0bcb322cfc4e2ea710374ee0b7814da9098292ed4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024483, "uuid": "4f295ce3-d975-46a6-b95c-23efeddef89d", "comment": "Malware payload", "value": "05e3e2c5afb17ccb449f889a5a2e800777492a9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024483, "uuid": "8d73b4ff-09f4-4efb-8b0a-178f0f3adb7b", "comment": "Malware payload", "value": "eaafca66f100d6e3668fb4740cf4859036ccafe3cde922ec99a854870285762900cd2a48297bfab33c946fea885af1a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024483, "uuid": "92175aab-5dee-4b08-aeb5-d5400631c6a2", "value": "T1FA34230EE7F11E407881389BE8D1B59A51BF404FBE08689F559E10B1F36B83A2D5B693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024483, "uuid": "3602166e-2279-4f69-907b-d53580e055e6", "value": "6144:K6rpuIaVENzZ5YAF7n4gcqe0wQGFwHZzPWVjXgF0DE76:K6YENjYpgcqeIGFwHZyVjXgF0M6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024483, "uuid": "b4018b4e-39cd-42ae-871f-420ab794126c", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024483, "uuid": "e4aa3a98-19db-42fd-8364-ce1d58878dfa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024483, "uuid": "92d186bf-6c3f-4b81-9206-c40564d90bec", "value": "288342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47aaf656-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986894, "uuid": "ada48a1a-9c47-46a7-845c-b4d80bd17f32", "comment": "Malware payload (AgentTesla)", "value": "df16bd302d7399c046cb139483ad8999", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986894, "uuid": "97a2895f-d7fa-4518-b836-3906897dcde0", "comment": "Malware payload (AgentTesla)", "value": "a53c05c8b0af4a3ba533e91ce92cf6f438df667a2ab15bccd7ea7a743eaeea29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986894, "uuid": "a772033f-f0e4-440f-8d05-7001c54bc93c", "comment": "Malware payload (AgentTesla)", "value": "4e153fc531166101822d64ed42a3871b406ddb32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986894, "uuid": "dac1b250-bfff-442a-ba2d-99ecb4edd7ad", "comment": "Malware payload (AgentTesla)", "value": "aef5266301bf2e1b946fd4342dcf26d022bc68befc6293b9e352e3a7eab23dc442066bdbcc0bb97b7c4dc12590b0f82a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986894, "uuid": "f1e59a57-d5c4-4f75-8974-fc34d2118470", "value": "T118F412022BA515C0F6BB633545B2113143F7AB62CA7CDE5D0CDC619D2BEB361AA14FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986894, "uuid": "4d763f5e-8a06-4897-9615-3b3c3672b8cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986894, "uuid": "acbf1178-42a5-4977-9ca4-585a3e4ffa73", "value": "12288:icxAckjh4OckuLtvdau4E/eBFP+iCP0KbvIGCLpeoAoeK9OUNJnwtyLjw5wVd:hkOtrLR4UYFmt7bfCLphAop9hJnwtyLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986894, "uuid": "27c60a8a-4fb7-4dc3-b1ff-4af821d8be98", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986894, "uuid": "0c0ebe6e-5033-4860-9936-e86a03a721c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986894, "uuid": "28300c20-ec42-4818-bd41-0e97db316d9f", "value": "DHL Parcel - SGS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3144364-5eb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695983719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983719, "uuid": "37890d66-aba7-4a3f-a853-e2e0bb9b3e4b", "comment": "Malware payload (AgentTesla)", "value": "37404d6df0a039dc790897f52ffc7538", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983719, "uuid": "30232828-dd98-49fc-9ee2-a8e3442ce757", "comment": "Malware payload (AgentTesla)", "value": "a5888a484f812f66cd39e16dbbcbb0891fd7f88e28a02660acfbe95635055696", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983719, "uuid": "d4dacc35-454e-48d2-a444-dd496ad9c1ab", "comment": "Malware payload (AgentTesla)", "value": "1db0068b1e9f31b8e1d3a4e6db3abe844293d028", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983719, "uuid": "b3ee9f63-222a-435d-a7e3-427ffc8563fe", "comment": "Malware payload (AgentTesla)", "value": "ff58415660c31db34169d48d6baa6912df2fb1544c8000f8db4c56913cb04273bbff08701f43131e288782cd2573e75e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983719, "uuid": "4abfff4b-3c54-4e2a-a262-5aa238eacb41", "value": "T123D401066BE12184E5BB6235A972013153F7A661DC39CF2D1CCC809C6FE7B90BA55FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983719, "uuid": "5a49a960-5cf1-45b6-a787-1fd3c3ee6410", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983719, "uuid": "d287eb22-d2f0-4137-9709-19037bfebdf7", "value": "12288:uc5AckjWGAoTxkR83kBkI/ISaDCz7/HJh8Z01a3XEpenZFGE7Bcd:pkZAoT08U2IgvobD91aKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695983719, "uuid": "2844ebcb-9027-42bc-97a6-e8dd577de946", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695983719, "uuid": "0f29df93-512a-406b-a17c-fc9b09d5f1e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983719, "uuid": "0bf375ac-ab66-4d8b-9f73-23c7d7506960", "value": "SecuriteInfo.com.Trojan.PackedNET.2032.14651.24123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed32517-5ec5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991094, "uuid": "52407746-16e7-4760-b1ab-b526d41b7c86", "comment": "Malware payload (Mirai)", "value": "cdf107d0e2d7d26893217013e464a0ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991094, "uuid": "731140e1-9401-458d-87d6-b5b2650431d1", "comment": "Malware payload (Mirai)", "value": "a76a9550497ea252366a9ef364af2b72e91587b28a76baf7e80572eb13225cd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991094, "uuid": "3fa4dee7-d7d3-4c6d-93cc-bb1a119a1fbf", "comment": "Malware payload (Mirai)", "value": "d1127a3c694d0f2d736b8d30f5c20b3f32d5a13b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991094, "uuid": "24e81c93-7c2b-4964-9522-fda3e4801d99", "comment": "Malware payload (Mirai)", "value": "e01cb083b4c7192b356d9103b0d710799190e3697d1c77582643d073674e6f582e8303ca3bf90936bb9db4b71f1deb25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991094, "uuid": "8592d67b-1cce-4f6b-9be8-b05eef66bce1", "value": "T138231991B8C29A02C5D4637BFA5E41DC372563E8D1DF33079D222F507ADA92F0EAB641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991094, "uuid": "46152d75-78cd-4ee5-83f2-9fcc8fa0e5fc", "value": "768:fwrkvr2RHxgrOzQkD6LOoOK0mgkCFKkRgLNdihHrxPAcKJwTTP0OdA/h28ZL1Mh3:Ckvr6RgOXmgbhHFPArJOj0wA5OOHgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991094, "uuid": "41d24dd2-c93c-45d0-8e7a-4e2c4a36a75c", "value": 47828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991094, "uuid": "07711867-dcb9-48ef-ab20-25fd3725964e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991094, "uuid": "18b3dc42-c57a-4dcd-8e95-0ec8426a2ca0", "value": "cdf107d0e2d7d26893217013e464a0ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0526d2d9-5ec5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991078, "uuid": "a94a0e54-5141-486b-b62e-49654e25c54f", "comment": "Malware payload (Mirai)", "value": "c4f49206caf3493d46e849b9d5f60b97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991078, "uuid": "17be1a03-8293-4fe7-99b5-d48036dd7508", "comment": "Malware payload (Mirai)", "value": "a789142aea8104e12b8e7e96c3ddddbe91bcc7ea456dadf7ea941cc4a01a2166", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991078, "uuid": "fd2f6532-33eb-472f-a610-e7ad6eb2b3bf", "comment": "Malware payload (Mirai)", "value": "912d36655e997f51ac55eb1f2341919630d036da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991078, "uuid": "45a73d99-8c08-472b-a8d8-5428c77b4bfb", "comment": "Malware payload (Mirai)", "value": "ed4e5314f6cb7360aaef854c3e593b6631b14641682e8e195b4db255b3b84c80e205d7c181faa8befe0c5432ff9fb26a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991078, "uuid": "150c8bc5-5384-4ec0-92ab-eba3b9e3cd12", "value": "T1B5337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991078, "uuid": "3c91048c-294a-4973-9353-98ca32651dbf", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvE:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991078, "uuid": "3734aae1-247f-48e5-9fed-fc12ba636292", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991078, "uuid": "bf064be6-93cb-4661-b925-af9179bf7374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991078, "uuid": "f6322ec7-df23-482b-a986-c4ceac2f62e1", "value": "c4f49206caf3493d46e849b9d5f60b97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a099fb7a-5f1e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696029564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029564, "uuid": "bdfc94f3-9948-4001-8f76-36e6056ba4b4", "comment": "Malware payload", "value": "ecf7cf59bdba10cf0479d3345504f334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029564, "uuid": "19ca48f9-6633-4a4b-aeec-89dc09cb1fcd", "comment": "Malware payload", "value": "a7a22bca755a347a91faa5e15135cb07320bd0b1e73450f1ce4d73dad8fb77ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029564, "uuid": "ee07e2b1-8b26-4969-9520-25166ff068d1", "comment": "Malware payload", "value": "bf1bacb0057b930aba4c0494ab5e28956f50a8dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029564, "uuid": "d6309747-b945-414d-adef-a44ebeb4c026", "comment": "Malware payload", "value": "c62088525e77245bbbe57d396b1b939e1bea21509b507aa4ef1e1e51f27174860e4be624ca664237473eec120d7a288b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029564, "uuid": "9c870846-3a85-4aca-b1e9-c6b539392ad0", "value": "T1AA658C7038CD7567DCEE107206EDBC2486EDB9BC472605C7A6C4DEEE96F02D12A32586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029564, "uuid": "185c32d9-536c-4473-9ac8-dbdf8ec55688", "value": "500aa68029ae375a898af1edb3f40b87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029564, "uuid": "df16c61c-b070-4ff3-b6a6-d8dffe71f2db", "value": "24576:zhyzyicBpqoZTg1SnZtq6PwsBVavJHCwDFNcNvgbhn5F9b9f:zzBpqoZTg4tPNA5hnDVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696029564, "uuid": "573afae1-6925-4f28-8e96-795846cf959a", "value": 1487264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696029564, "uuid": "395bebcc-ce9d-4686-a8df-6f6ab90dc265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029564, "uuid": "07001600-3ada-4052-b94c-1116b08e6a67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86ed55b-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991056, "uuid": "54e5e927-2993-4143-a218-4c4f71b5fbf8", "comment": "Malware payload (Mirai)", "value": "ed93891a4b9d5f24d7c0a072e41e8c81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991056, "uuid": "4b67b0bc-2c1c-49bd-a274-5ae89ab32bcf", "comment": "Malware payload (Mirai)", "value": "a7adb12b06ef632890c7e4794e247fcb2d501bbde97044648ce43e3046d77494", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991056, "uuid": "4c7d772c-1f86-438d-9537-3e3a2016b75a", "comment": "Malware payload (Mirai)", "value": "c8549c8e7279f63c29665ea244e5fff67d221a6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991056, "uuid": "2e3d56db-1667-4197-94c9-043b6cf11f11", "comment": "Malware payload (Mirai)", "value": "235b7c9ab6d1a82608cc17404a9fcd1b6c4d8bdf6ea1e204b73d600ded7cda11833c16fa8c6e31e18c3540aa974b3787", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991056, "uuid": "5053f003-6dfc-42af-931a-9255a933cbbc", "value": "T131B2E162A1463F62D770213A797CCA0057AB57F8E4EB72752524B6AC4BD2C4B60B810E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991056, "uuid": "db99cad1-a0cf-411e-a692-0ca5afd6033f", "value": "384:vZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdLfAhymdGUop5hKl:yX1De9kONQG5xD+jHMDzu7As3UozYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991056, "uuid": "bbc308f0-ef17-448f-b3dc-feed90c398c0", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991056, "uuid": "88e106e6-439d-42c5-9bec-5aa126474ebb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991056, "uuid": "ebd66ea8-e7e7-4c3d-95f2-540333a332e7", "value": "ed93891a4b9d5f24d7c0a072e41e8c81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92cb57d-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991031, "uuid": "5b1e83df-b524-4338-a73e-55dc843a4ffb", "comment": "Malware payload (Mirai)", "value": "fb1fe809afb8076ab8ef7bbeff1a0249", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991031, "uuid": "e3865d10-ea8d-4a4d-bc88-cf460a075145", "comment": "Malware payload (Mirai)", "value": "a879964d18da659794a3fff482027df63fca745c08750676fa4d8f18715d5391", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991031, "uuid": "ce3d9006-92d1-4d28-a876-3511a829ae0b", "comment": "Malware payload (Mirai)", "value": "8b64a4b9ab77045757161e2748b449b20b0b14f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991031, "uuid": "dd6fc14b-3dab-4ef5-93f2-321284592e6d", "comment": "Malware payload (Mirai)", "value": "b5f2db7a54bbaa40ec3f3e9751635601c7487797910e92c0587cec1f574d73edc163a4aa312a0858af40037a8427afbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991031, "uuid": "a7e473dd-a124-4315-bdaf-6a798635b45a", "value": "T12A53A71A3E21CFBCFB9C863547B74E309648339526E1C685E19CEA015EB070E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991031, "uuid": "f9ef4fc3-da0a-48ec-adda-39e91f96acb8", "value": "1536:WNrNhDOB/AwPpWunn+HxlOkxqzW0sD+mk2eUf9:WNrXDOsun+HxlD10sD+nHUf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991031, "uuid": "2bbde14f-8b6d-4e11-975d-e1cec4ee0be0", "value": 63388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991031, "uuid": "ae549edc-7df9-4e72-8e72-e90192fb9243", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991031, "uuid": "d3e96c6e-c166-408d-8ebe-c383882b8157", "value": "fb1fe809afb8076ab8ef7bbeff1a0249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93b0c0c-5f1d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696029256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029256, "uuid": "6c8ef994-e437-4359-94db-e3442bb56a56", "comment": "Malware payload (Smoke Loader)", "value": "2ee0431b5405907456ce05f9add19888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029256, "uuid": "82e6a816-3517-4944-88fc-4a189d62ea6f", "comment": "Malware payload (Smoke Loader)", "value": "a89879f3588fefc68f0ae7e4488158e3e8dbb959fd011b4cdf7caac915e9c4f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029256, "uuid": "f017f677-8c7d-4ac3-b5f7-682f3b2f7583", "comment": "Malware payload (Smoke Loader)", "value": "8201de54a3fb0289949e18e3ac2ed3f159b27df2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029256, "uuid": "07475880-ac9d-443c-8191-10ce6ce967fd", "comment": "Malware payload (Smoke Loader)", "value": "469e2a4d08739a5d5263dec882370bf659b7feaa4516f7c5ea70fd4bd4ee87922609fc6d6580bfa5474b92de3e1c2ac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029256, "uuid": "9a942ec6-6a95-4495-885b-7a08c720af7d", "value": "T157349E1A61E2ACA0D46786328D2FC7E4773FB4A15F796F6B23186A2F1C711B1C663701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029256, "uuid": "8f262907-e4e2-4a87-a608-1aa980651d0d", "value": "18690df0ed1be01972dcb3dc78c42692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029256, "uuid": "651f3b59-dcb8-4641-8947-66e5b9e4853f", "value": "3072:qXrBK/m3yDqodPy99fVL/9F8ybVXgDP5w7NqfZ0aqhR+g52BnTEGYTq:KtS1DdPyXVLjjbKxwRrT6NYTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696029256, "uuid": "f3c68093-b8cd-428f-8e06-5d46967854f1", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696029256, "uuid": "49a6ea93-5914-4f3d-9f5a-82a559363d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029256, "uuid": "25095877-e508-461e-a2e8-981d205113d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e21a26-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1695986814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986814, "uuid": "5f88dd78-fe35-4213-95c1-340584e014d6", "comment": "Malware payload (AsyncRAT)", "value": "84dd33ccd82243d952a680619656f161", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986814, "uuid": "93d092a1-f646-41f9-afda-5fcd691592e5", "comment": "Malware payload (AsyncRAT)", "value": "a8f442096d443911bda7256530dbd78e887873365b4d66d2709389cafd9c064f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986814, "uuid": "6451bf2c-eb25-4e91-8e94-3c39d9f417b4", "comment": "Malware payload (AsyncRAT)", "value": "2871693c0d764e2ec90d9677ea79045e40bbc34f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986814, "uuid": "6df9a7f6-1e8d-4d36-b6f1-6929868e8fe8", "comment": "Malware payload (AsyncRAT)", "value": "e13cc73e3626e45a3825ba2fb55eee790cc5ced9f2b68db38315ee73623c380b7e9a100899145805949fbb6631f3c1eb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986814, "uuid": "7feb73a4-ef7a-4ae3-9dad-001e7def5a03", "value": "T10CF46881A6D54361D16E093225AD7AF055EDFD2C1A20CEDF66F4EB18C93334FD223A62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986814, "uuid": "fa08503b-5d34-41d2-bf85-b5ffa80d9706", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986814, "uuid": "66406e8c-05a6-49a2-89c5-504af346bfed", "value": "12288:PcrNS33L10QdrXPLWwrwnTAX6pDzy+UtOgK68cBXNKwG6yCc057:WNA3R5drXPbrwTAuDu+AO/67HXc057", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986814, "uuid": "d36b51d3-7d9b-4139-8dff-af4d6d915d5f", "value": 759669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986814, "uuid": "52585a53-142c-433c-902f-4559dca9088d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986814, "uuid": "d2b4b7b0-8af2-4178-966e-95b44998e20b", "value": "Odeme_Belgesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1075f6ee-5f07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696019444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019444, "uuid": "a4aa29fa-584c-48c7-98b6-b9ff1eb616d8", "comment": "Malware payload (MysticStealer)", "value": "959f6f1ba1caa0728e4f70eea43c3f18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019444, "uuid": "a49617eb-d600-4957-bcc0-dd8bd8c5a430", "comment": "Malware payload (MysticStealer)", "value": "a9a3fbcaf842de2dbc60fc6e42d13572625bc8ca8464c73425fd54625e52991f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019444, "uuid": "a5e9be5d-e8c9-49ef-a2cb-6bc7beba7a08", "comment": "Malware payload (MysticStealer)", "value": "26ae9ae5e0455a9661f22bf209077b6b76763b6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019444, "uuid": "9f9138d4-0ca7-4ac7-aeff-89fe7045a1cb", "comment": "Malware payload (MysticStealer)", "value": "0339c185c12ec1a9740c7ba5c3afe52fe6cc2ec5eb5078ecc68a6388edb1fc4199c9e6cf73f56681a8209bebdaa5220e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019444, "uuid": "ce9a987a-5e49-4013-b04f-52c4a77d6359", "value": "T1AF74BF2279DD8373DCF0583109DCFB668C7DEC109AB5499B63B41EFD2A606A0E5325B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019444, "uuid": "5a0391e1-5156-45f9-a4d8-0cb28f3fbbce", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019444, "uuid": "37bb82a9-1f53-4583-8721-9e88b6252434", "value": "6144:0g3W8/s5GqrO5aXnfEGIXWMvZAOu0PioZ/A9NFo3h2kDGxes0BC+:A8cGqrOk8Jx6oZ/ANo3h2kDees0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696019444, "uuid": "4f8d3fb4-0964-4028-9eab-d83fd0d9be50", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696019444, "uuid": "5aa75dd6-4794-467e-af74-5288b78368f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019444, "uuid": "f8cf4b77-de1d-4ce5-a82a-6896c7bfe4db", "value": "SecuriteInfo.com.Win32.PWSX-gen.17897.19097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1134cd-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024270, "uuid": "ba1c70ea-d9b8-46da-ac77-b74fc2ca284c", "comment": "Malware payload", "value": "73cf8ffeca81d259c79f93181cc53739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024270, "uuid": "56a42aa8-5b63-42f9-a051-f9f0e2e763d7", "comment": "Malware payload", "value": "a9aa5139022077544badd80206df668199ffcf9fc5bd1b3829f8f07adad86578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024270, "uuid": "5588631d-7dae-4de9-971d-8801b75bf52e", "comment": "Malware payload", "value": "0e50c56470fecf5ae37e87b70c79297a7c24e9ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024270, "uuid": "7d4dbb42-6f07-44fa-bd13-941e9441d87f", "comment": "Malware payload", "value": "b27886efd754b6befb0ac3789e0ea6d1d4467020c5b0eb6802072d3d28ae672a1724273c5d29e7d8a3b4f963c87ca807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024270, "uuid": "481fae64-d04f-4a56-9252-1020c897d336", "value": "T1113422B0423BEFF0FD87D6439AA1E1EE69413C22D79991BB530AF64662B3F171211532", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024270, "uuid": "6ab12f86-8bc4-4b01-a443-eb14995dafbd", "value": "3072:lEYhvSR+6FWR2jzyuX/6DSNeSCNQXUl3bTi2d6oNJns1FxRrCwntS:lEYPR2d/6RjNQEl3p/yCwtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024270, "uuid": "5ca3c366-1bb5-4d07-b40e-c49fec8bc0a2", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024270, "uuid": "d57984e9-08a7-4089-b07d-a01ca5d749dc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024270, "uuid": "871057e1-7ea1-48ae-8eb2-fc0d4987e460", "value": "288316.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba1dff6-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977184, "uuid": "3c64ab9f-44e1-4bf4-997a-84809ad45ad1", "comment": "Malware payload (SnakeKeylogger)", "value": "a482c55e1c9752304022e21bc1030894", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977184, "uuid": "4e4a912a-b9b6-4188-b0ac-2bad0148490d", "comment": "Malware payload (SnakeKeylogger)", "value": "a9fc57ab4ffcca4baa8f4fe69708ea3d63d5f85f5f5916bd7870fe547f368e02", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977184, "uuid": "5f96f4bd-63ce-4524-b47d-dd845df59648", "comment": "Malware payload (SnakeKeylogger)", "value": "832234dd48fc70bae1fdb55ec46487f96bec8188", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977184, "uuid": "deadb678-67e4-4c4e-b133-12bb7afd91f8", "comment": "Malware payload (SnakeKeylogger)", "value": "2f46d50e941364a577d9e785ce599e9872cacd8a77ffdb8649f3ad09fabe16ed0685fddb505b0829a030717f20c97518", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977184, "uuid": "618196fb-a618-4f78-8cb4-565547ae4ac6", "value": "T165C4F12166FD0B6BE2BE8BF104355A0857B1B5AE2426F60C4DC370DF06A5F848B45FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977184, "uuid": "2a14700f-92c6-4ef6-ba54-ef5d104885f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977184, "uuid": "ecac7247-5d3b-44ae-9351-addf0a6a103b", "value": "12288:8HnyiRJU/Wc//ZXrM+w1fMfc+WMU6ujEsqbb3drn6q273VWSQ/kRIA:cyFemVr6S9ujENXyw6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977184, "uuid": "55478879-8443-4ea1-a29a-44aa6712bfd1", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977184, "uuid": "1001172e-da84-4e92-b0ce-178ccd3b7f6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977184, "uuid": "3c584545-11cc-4d1c-8e84-3be58d72b78e", "value": "DHL Shipment Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa634393-5e83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695963008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695963008, "uuid": "0ca4627b-fd7d-4f2b-886e-8bbd96ec36e2", "comment": "Malware payload (Mirai)", "value": "1fea3f130d422dd48fe0fe44b00e4fa0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695963008, "uuid": "68b9a8f3-e67e-4202-bc40-9367f74ed598", "comment": "Malware payload (Mirai)", "value": "aa5053c4192af6935da27a066370ff3511c5276108ff10afdf679f0f14ed932d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695963008, "uuid": "8d51042f-31b5-4372-ae8d-18ea34ef44b4", "comment": "Malware payload (Mirai)", "value": "357afae114c77c36e8b2dfadcfe46e25e5226f23", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695963008, "uuid": "57c34e19-09b1-491d-b959-90b8da8e1ee0", "comment": "Malware payload (Mirai)", "value": "9020eb90782573c4bc14359f3fc0f6421279eb8c0a914d406f648ae4a9ef9005d32d32a012377318b2c956398870ec79", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695963008, "uuid": "a0660696-ed79-4c52-af16-cd17d6f6cbed", "value": "T111C2D070A2ED18B1C7100572F7B856C6BE530F7DF6FA389021418BBA7941D0A29EA9D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695963008, "uuid": "dd52597b-f9bb-4c20-b666-72655de76746", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNERKY0shymdGUop5h0:A7soTAZ3alkXLvFh8nNEb5s3UozO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695963008, "uuid": "fe790dc6-3e46-409d-8071-4bdb60e9daf5", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695963008, "uuid": "662e7689-84b7-4fff-ba3f-d663446081ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695963008, "uuid": "6127713b-6c23-4eb8-b75d-c8567fcd2b8a", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e17ef3-5e6b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695952688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695952688, "uuid": "855aab86-825d-4588-8e46-2ee4ff2b7a82", "comment": "Malware payload (MysticStealer)", "value": "375110db919fd2e3611e20296aa949a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695952688, "uuid": "cb318625-3354-4767-bd50-c32ffe339548", "comment": "Malware payload (MysticStealer)", "value": "aaa3c5b775b2c49556c360cc93321eba5a6a8623a6d8fa36400ff4c9d644b519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695952688, "uuid": "792f4b06-fafe-4830-9818-3e47770a70ee", "comment": "Malware payload (MysticStealer)", "value": "0e3788e44dcee6167dc8adcd003c43cea633f0f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695952688, "uuid": "2d605cb7-792a-4d24-88ab-2316720ba22b", "comment": "Malware payload (MysticStealer)", "value": "01810b6f3f47222e2d7a664da525838fb03d521bb0f86caa19eda70521b3443976842553f314aa4908f247be10095777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695952688, "uuid": "7903ee28-0c6f-453d-b5c0-d4b8ba69dca7", "value": "T1DE259E1178C49176DDE310BF83ACB73546ADD4B0071916DB06E85BFEDF206C2BA32A96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695952688, "uuid": "312c08aa-dfc9-424c-b3b3-2e2e20bcab36", "value": "d215e7ae5c8053185b6f0c1eed2c8e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695952688, "uuid": "aefecaf0-f37e-42b4-b5ab-d6b543cd8807", "value": "12288:e+WAorYgBYDKzcx9jkmP8buy7/0RDMmZZxnyUuyyuHz3xgL7p/9:enjYDKzcx9jkmP+/knxyazhG7p9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695952688, "uuid": "66849bb7-88b0-41df-af90-7754581e355e", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695952688, "uuid": "f39c93f4-9fbe-42b2-a1cd-a66782f1c67d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695952688, "uuid": "d7ee83c8-740e-472a-b963-98ada979e629", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde65d81-5ec9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695993106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993106, "uuid": "dc5210cb-e856-4382-9570-e202c259e084", "comment": "Malware payload (AgentTesla)", "value": "5d5a750c6c99cae5b8ca7d277b1dac50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993106, "uuid": "90a1470c-1258-455d-915c-6b9cbbe3594a", "comment": "Malware payload (AgentTesla)", "value": "aac3f57b4e6c0f64c4861436705478fa30fa06d61087847f2bdc1c6a50141038", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993106, "uuid": "04711608-38c4-410a-99a5-e3be0d855760", "comment": "Malware payload (AgentTesla)", "value": "a8a1f251ca41eb3e2ad5c7ad355af089a67bbb1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993106, "uuid": "66513ee9-ab4d-47b4-8ce6-682dc8c023ad", "comment": "Malware payload (AgentTesla)", "value": "9b1dd92eba2adb46a253a7c26ad9cb1e55125a3bab09e65318f25536ae0c247cca069b3748694a94fda29ace5c39b5aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993106, "uuid": "4c4e358b-4f6c-4cd9-b89f-267895ba1afa", "value": "T16E3431137E44EB11D6983D37C6DFAE5417F2A0CB1673820BAF48AFA529412476D6E32C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993106, "uuid": "f22a6ebd-5cc9-45ea-b2b2-8ebaab322ccb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993106, "uuid": "11e24304-2b49-4c74-b8f7-23643abf9110", "value": "1536:Gm+TMcykl6m8GiFeYizWE6SRm00Q7BEN0mdDtry5zMlDFyPvrtaOAEoigaHOZTbj:vKMcrcpt2WthL9NxYMSvAEyZY1ncv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695993106, "uuid": "11da1c08-737f-4669-af11-ad6862697567", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695993106, "uuid": "58f1d272-b368-4edc-90dd-f7c77b874a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993106, "uuid": "402d3200-0aae-4573-ab70-c75e69478968", "value": "nix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8cf1c8-5e68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1695951335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951335, "uuid": "a8ca93f2-ee0c-4017-abdd-d59e6ddb3530", "comment": "Malware payload (Tofsee)", "value": "2bdaf5247ae0a9c549d5b028d3bba314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951335, "uuid": "287f8b91-fc80-4d55-b0ee-5c1c90c6b0e1", "comment": "Malware payload (Tofsee)", "value": "aaedae1fa452a304d3065e2ea1bd6d2095de07a22b18a06205bda38427646659", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951335, "uuid": "38d4700a-23f9-4268-80d1-abbe7472f6b2", "comment": "Malware payload (Tofsee)", "value": "59377777f6c956c422dbdb222730381aadacf475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951335, "uuid": "78086b39-0e03-469d-b7ab-b5dc7a6edccf", "comment": "Malware payload (Tofsee)", "value": "9b61075cef797a10eb8730782853bfa469ed34706b1fae514addfa4a6d8cc5c892c504231ca97e6d920739bd0db97054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951335, "uuid": "f4f545c6-3e0a-4925-bcc9-cae136e93da4", "value": "T144549D1277D0FC61D4665E319D39C2A42A2FBCA19E6963DB33983F2F49701D19A63B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951335, "uuid": "71530463-5bfb-403b-926b-2656bd292dbe", "value": "d749dd3982d2564e67503d7c8e1b49ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951335, "uuid": "02459c60-3c69-4871-afde-9eb18b750cc0", "value": "3072:gF/1kYoF9O/aT6c7s0gXdqR10zRylbcbVvWs2h1DsAw:W/1gFE/aT57GxylYNcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695951335, "uuid": "58baaf5b-6788-4081-84fb-25db19c870bd", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695951335, "uuid": "99363356-3b5f-4e98-ae05-594c46d772af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951335, "uuid": "5f43fb83-183f-41ee-9f3f-a98c98500480", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb3aadf-5efa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696014015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696014015, "uuid": "bd2adbfd-daa5-4373-a128-10d55f295e1e", "comment": "Malware payload (RedLineStealer)", "value": "d516adde1e35e7bd6312689d4512c83b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696014015, "uuid": "03432a0b-7c84-452d-b802-ef946acda8fa", "comment": "Malware payload (RedLineStealer)", "value": "aaede6629fd9fb8cf88fcea08c992b38be88aa35eb91fc446cdf0e39ca262f67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696014015, "uuid": "8437071c-d5ac-4fbd-9ea9-617cdd62bf6f", "comment": "Malware payload (RedLineStealer)", "value": "4c45d91c69ad111093439675eb134ac458f93307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696014015, "uuid": "0783047d-4dd3-42e2-9dae-8c039d0d8e92", "comment": "Malware payload (RedLineStealer)", "value": "7fb8dfa8f4631162e8063b3a57b6e94668f75fd8205a2832ed6d562297bdba8249da9d4eb97d7d677d7b91a0b4145bfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696014015, "uuid": "8a78823f-61ad-4274-9f50-a0142323d996", "value": "T1B534BF1174E1C472DC7215360AE4FBB95A3EB93009A29EAF67E40F7E4F30281D671A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696014015, "uuid": "f8e68a38-b0fd-4de8-a537-b0407c766b34", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696014015, "uuid": "b714de0f-24c9-4748-b440-562875bab2c5", "value": "6144:UIz4SHy5uoBMFGV5PEkIXEHvZAO+4aYLVs0BC+:uCmuoBMUOMxHs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696014015, "uuid": "b984569f-31d1-43ec-b9ea-ad90cf94b049", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696014015, "uuid": "c00688c8-a47a-417c-916d-9af2c14b6014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696014015, "uuid": "fcffa342-d40f-4261-b5ee-b0b9dc7e554f", "value": "d516adde1e35e7bd6312689d4512c83b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6178ef5-5ea3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1695976879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976879, "uuid": "17342913-1c35-4a68-923b-916208001ddd", "comment": "Malware payload (CoinMiner)", "value": "e95e666035b3787ea98b894253e608a6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976879, "uuid": "b075e627-4469-4ab9-9ddb-4a7c78e3dc1d", "comment": "Malware payload (CoinMiner)", "value": "ab4cdb60909f34d673fc6bc261a54910d21ecc68ba5f591ebe5da372aca2df62", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976879, "uuid": "c1672c1e-87a0-46a5-9c78-810ae727fdf2", "comment": "Malware payload (CoinMiner)", "value": "0579d7cdfe626702634322376d84ad43227760af", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976879, "uuid": "3f16d7e6-9c2b-42d7-8529-c53349d717d0", "comment": "Malware payload (CoinMiner)", "value": "e5a3b53c358ba1bef814ca95b2e22ec50b7c1b14e2a2a47b996f0360de5637108607173335bc6c7b57b846ed5d083be5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976879, "uuid": "90928a51-510e-4aab-b55e-d2f60f39b566", "value": "T189F4129472DCADD4DC89D77589A4CCA198F3230D6773DDAE8D1C94D298382DA7883F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976879, "uuid": "124a145d-ae3f-4e76-afe0-8e54d211d779", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976879, "uuid": "22819ba9-e1e7-4f51-a8b2-cc34e7e275bf", "value": "12288:72NMt/TCCqhDcLDlueQrBknEk8o6CzS/3m1hEk8XlsdBjDFiD2462:yOlTC1wPluewqN3WchEk8XK9e2d2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695976879, "uuid": "106f3196-7c51-466f-8d8f-afdd415f2a40", "value": 780144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695976879, "uuid": "48bc9a8b-b261-4f31-8f9a-031beb2c13bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976879, "uuid": "eaf794a1-2428-4a5b-b760-d5a84a491d95", "value": "e95e666035b3787ea98b894253e608a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bfdec56-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986606, "uuid": "73c93c9c-f451-4fcf-8034-aca1c3d65cdd", "comment": "Malware payload (Mirai)", "value": "62cae55dc07e8cb07c9d2e058f0575da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986606, "uuid": "39ba5387-d1dd-4058-9d8e-8c8228526d47", "comment": "Malware payload (Mirai)", "value": "ab71af4ab79950dd3849e0167776f937e887b7df7f2cc5de557ede0eeb546b1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986606, "uuid": "fa102a47-7765-47a9-87c0-78dd3857a043", "comment": "Malware payload (Mirai)", "value": "776cc4b4541aeb936d027538f806ea2391cb8368", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986606, "uuid": "12532a40-10a4-4931-bfae-6094d490749d", "comment": "Malware payload (Mirai)", "value": "7acf89c4cff13047c8aabf7129ffa427cead01fab1a5cbb446199a5ebd80b5afba3d94ac37ee0372161676b452acf038", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986606, "uuid": "c87f8481-612d-4c7d-97c2-22ad797d665d", "value": "T19BD32A46FB808B03C0D62776BA9B425533239B64D3E773065928BBF83F8679E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986606, "uuid": "60343a59-f0cb-408e-bb48-3fac85a77f0b", "value": "3072:ldbWFvcwVja+hA4FeOHZxlIT5mDGN7DM/90aa:l9W5ja+hA4FeOHeFmDsHM/90aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986606, "uuid": "c4f6cc90-fb6b-495f-8701-02c533839eb4", "value": 142627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986606, "uuid": "074ce85a-b498-4c81-bfbb-c798277e3bee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986606, "uuid": "24309142-fbd9-49a7-a6b0-80b6017a8487", "value": "62cae55dc07e8cb07c9d2e058f0575da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04800b24-5ef2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696010404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010404, "uuid": "4de60d56-62e1-415b-b78e-58433a241c79", "comment": "Malware payload", "value": "2a3dcc2688bb548882986cbe08f8bf57", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010404, "uuid": "0fa129a7-61e6-4c3f-9a53-9015d3869ad2", "comment": "Malware payload", "value": "abbdd0e0b1d781966e46d4f0b9b8f1227ec8d9f19e0ba8f24ce423f9c3834b55", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010404, "uuid": "8a187fd5-2187-486d-8dd2-e5523588173b", "comment": "Malware payload", "value": "3d344a5dbd76aae019088517eb1bfce745520346", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010404, "uuid": "b3e1aa01-50f7-4261-ae8a-b234e225e2eb", "comment": "Malware payload", "value": "936a9d3052fd625f3701be3ce138973a568a41daf70d4a6c091aa683a47569a249c6c9a316f27ef3c39da5379bd6cb9b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010404, "uuid": "50279cb8-0486-44f2-a75a-038497b735a5", "value": "T1BED2D0A1C5AD3A5ECEDD5DFFA4E91AB90E1031C9228B4FAD13208CC1E96AD07348D46D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010404, "uuid": "e6d1cfef-181d-48c9-b4a4-abdbaff90fa4", "value": "768:ERlXfqzkRj1akCXgcLqTW81upIkWuhqhejSHXEWY:ETXfqgRx1CXVi1upIkWwuF3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010404, "uuid": "cf4b81d6-2ccf-4bea-8e9b-349ebf602130", "value": 29288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010404, "uuid": "568af999-0cb7-44ae-80c5-6994cfd0e954", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010404, "uuid": "199ea5f6-fe89-4eca-b794-ae94a06f43b7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61fc4658-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695977490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977490, "uuid": "4ae89f44-5759-4f4d-816b-69807f33dafb", "comment": "Malware payload", "value": "b3e7c63fa2d9d5e9a1983b23fdcb285a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977490, "uuid": "dee30f43-57b7-436b-bbe9-88b60decba8f", "comment": "Malware payload", "value": "ac3aea7a998608889c24054a37a276890a8d7a12b446be6c05373f556b6e7365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977490, "uuid": "3c85d65d-95e4-4ec1-9e10-ea34c3a6ea07", "comment": "Malware payload", "value": "489ffe53570a483f1d9f83d5cfd0f379f8d64f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977490, "uuid": "ccbf9119-3575-4e6f-b77c-b10800bc5164", "comment": "Malware payload", "value": "24d08b1e5a8e7ea9efb84e1852812ea3d02abf6ffef24275d6bb84201beb4de838d4ff3f966fcda1957df4079dca4ce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977490, "uuid": "07a0eea0-616a-44e6-a300-d36ef458c8c1", "value": "T150042914234D9721C6CA42B6F4B107264FB1C653E746B767E9B3F9F028837C295A31BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977490, "uuid": "6498b3b5-cde1-47d7-9219-413325c9c31d", "value": "3072:He6mT8+XvV0fYkwzflL/ifAc9gkZVGCD25xqbvAwQcZKaNr1LVTv3qZ8x2uBC1OG:He6mT8+Xv6fzwjg/gkfGCy5xqbv8cZKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977490, "uuid": "0829ec01-bac8-4007-b472-156ec10a3d64", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977490, "uuid": "ce07fd83-e5f6-4c83-881a-698b382a33df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977490, "uuid": "fabc9864-cb83-4639-bdac-c9badfcb09ce", "value": "Krjdir.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3212420-5eb2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695983317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983317, "uuid": "a60a2197-7775-45e7-a12f-260c6cdb8fdb", "comment": "Malware payload (Formbook)", "value": "8e2f9fa3a82f5d8853762e0afe7e47de", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983317, "uuid": "728aa03c-db16-405f-b6e2-8e79452323ae", "comment": "Malware payload (Formbook)", "value": "acc635d91ec67c0a33f954052484436aa91aceb2513caf2d3eca73fc09e0bb20", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983317, "uuid": "1d91a8df-3ed3-4f63-a3a1-d9b74d7ab2e6", "comment": "Malware payload (Formbook)", "value": "2e48f54c9935d044dbfbad461003899dc7bd0c74", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983317, "uuid": "3372f66a-6d46-4599-b29f-ad136a10d3d5", "comment": "Malware payload (Formbook)", "value": "493944ae9648f7aa917a36911b482a832d880807a19e0b784fb1815add8c3166e2e69400e1e0f51ebb367bee872e5520", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983317, "uuid": "8474f4cd-b30b-48ba-aac5-ba3055fd2b6f", "value": "T164C423C2F39E5851C4C64A893DBFE374286589885F449AF78D5D863A7C0313A2F4D2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983317, "uuid": "c5ee5cf0-c0dd-4ee0-8bc5-e2a515f43a4f", "value": "12288:cRyBAhisKcV8IiQ+P7xUN5KUk3NPx/iypGTMze15:cRyBAhJMIi9PGji3BxqypyqeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695983317, "uuid": "4a5429c1-c3e0-4778-b749-1e8a7bdfabc6", "value": 543657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695983317, "uuid": "58709331-4968-4352-9c17-c11b00bf1918", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983317, "uuid": "b45ef23f-b1db-46da-ae16-026ddbc96965", "value": "Purchase Order (PO) PO 00197086.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8063dfaa-5ebf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695988708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988708, "uuid": "9ea7bbbe-abc3-439d-a5df-1c63088d67c7", "comment": "Malware payload", "value": "864a25ddc70337ea09daff4faacef0b3", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988708, "uuid": "db8d0cbe-04d5-4081-8840-b270a71c0c8a", "comment": "Malware payload", "value": "ad3cb4b02550ea62a32ef65a0d4d470065ecbed8d2b97c33e488aeedb8efd781", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988708, "uuid": "5af55e63-f5b3-4be4-af93-604dccaf2c9c", "comment": "Malware payload", "value": "1a5e7fb83ef828d22b4eba5ced429649f9f8ee54", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988708, "uuid": "d6c2a422-8f18-4503-862e-a39657b48ff4", "comment": "Malware payload", "value": "88b82e441c7f4d3c6b7b22d36ecd7c467c217910ec6eb7e8d2c3c1387724226cfbe95a558c84399bc55aec717ccae129", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988708, "uuid": "564bda39-3127-4404-a730-52affc0ba22b", "value": "T1E313AE718FC48D9306DF6973AA3FDAB448B345609852738352B6F645376ABB348CAC48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988708, "uuid": "64283e6c-4afc-4c66-a7cf-1878fa7ac7b3", "value": "768:CBi4qJINbc05cgTrn24osOu4GMU99gmi4qJINbc05cgTrn24osOu4GMU9+:CBiB87bow4HO2miB87bow4HO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695988708, "uuid": "437d709f-f0eb-43d5-aa18-84016757bdc1", "value": 43899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695988708, "uuid": "ac8ab88f-95c4-48d3-a7a0-67da345e2c79", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988708, "uuid": "93577164-c2d7-4d69-b015-5d3f67dc7efe", "value": "Zip_Notificacion280923_jSh6jhh63t3_WKGjV2ODiaVykm.HTA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6388f36-5e90-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695968638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968638, "uuid": "10d78829-0e12-42ee-bf73-dd858732c01c", "comment": "Malware payload", "value": "1555ffd2bb5a5b071a664a28e02fed7f", "object_relation": "md5", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968638, "uuid": "1dfeeb75-e07f-4468-8f8f-6ed9aef9ec8b", "comment": "Malware payload", "value": "ad673b24eddf45329539dfa67ae345e463a3c9157882178392af156abe96ba0a", "object_relation": "sha256", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968638, "uuid": "dd582cc8-1915-4308-865e-6a293e1c44b2", "comment": "Malware payload", "value": "73b08cae9ba6487f4310ecf7259b5ea76c2e11fa", "object_relation": "sha1", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968638, "uuid": "c3c7f51f-87d8-4692-9038-14f8a6efcef1", "comment": "Malware payload", "value": "4703782d0e44a65fc7884613d1f28bc8706d50b391b612bd20b572642fcf14b66f2549c4b8a89e3ceb62d19031b3cc50", "object_relation": "sha3-384", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968638, "uuid": "a51635a7-c769-4585-9e89-e85cb88b74cf", "value": "T19AE25FA6B2D6D846DA4907364CE7C6E67722FC525F93834B3389F71E1F72A808903617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968638, "uuid": "dfa0cc54-8389-488c-91b3-24e956d6b75c", "value": "768:/P1k3hbdlylKsgqopeJBWhZFGkE+cL2NdAJ+9FL66Yt23mc6y:31k3hbdlylKsgqopeJBWhZFGkE+cL2Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695968638, "uuid": "90bfa85e-5f89-4521-8d6d-dabe7fc10b0a", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695968638, "uuid": "1c9d295a-0495-4ebd-ab3e-c0457f7394f7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968638, "uuid": "ba0b149e-e522-4b66-b314-b20fd56687ba", "value": "invoice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95de92b8-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986596, "uuid": "c53e52aa-9799-4c89-875f-0a29c1559f9b", "comment": "Malware payload (AgentTesla)", "value": "66013791a9a70b8b6429a842ee029ccd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986596, "uuid": "95ce4c20-c01c-4862-a3b2-1d7402d805e8", "comment": "Malware payload (AgentTesla)", "value": "ad6dabfbf9b343f2a04f6cdfbc34411b378212dea73d669cab262564420d6ecb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986596, "uuid": "7a836051-846c-4345-905b-a720d4c50ff1", "comment": "Malware payload (AgentTesla)", "value": "a8c5aaf7a3f794bda85717f264a65075c80a10a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986596, "uuid": "851601dc-4ca0-46c5-aa79-99efcaf462d8", "comment": "Malware payload (AgentTesla)", "value": "49c29d5033ff734f72310c651c7c882d1813d9da56af31160e4237f3a46909864600328e53be3e3cc53997eb5eadf15e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986596, "uuid": "aa36860f-a465-43be-b655-3fac39848584", "value": "T194E4336D688C3AC785AE097E571833C474CCB50A2BD935BE091C6F78B25B4CEB7D8864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986596, "uuid": "bedc9c61-ea24-4a54-9aa1-51614ef540b2", "value": "12288:Kqs/irVm8pm8UKkayx+Uu1oNR4rdCTflYmWu4K+7ZGGnaZZg9xQ9ar6MnDwI:Bqyg8rovs6WC7Su4K+7OZSnUHMnDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986596, "uuid": "49fc1911-1fb5-41e5-b515-97ac397f8145", "value": 658003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986596, "uuid": "caee5182-6752-485b-a9c9-bce558529307", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986596, "uuid": "44ce0a21-fe18-45a4-b1ee-0ea4e1068d93", "value": "PO-674394.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6491d98-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695990972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990972, "uuid": "bc600f9a-59dc-4c95-b7f3-8bde99850d66", "comment": "Malware payload (Mirai)", "value": "71f94d4cb547560642cab6011a26218a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990972, "uuid": "91e4d460-c712-4a00-811d-d970455b6b26", "comment": "Malware payload (Mirai)", "value": "adbbb0d37ea9e08add10768d2d7549ec71a82f2099dc9e843cee7d8f5ac0ceca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990972, "uuid": "143be3ee-b9c2-4dca-95bd-fcfd6a1b7526", "comment": "Malware payload (Mirai)", "value": "1bafd4c57e0ca5e130926c7a02bd2842020fc15b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990972, "uuid": "4af14d3e-2612-47a1-9d97-97fbac2a3716", "comment": "Malware payload (Mirai)", "value": "b71abf1fc0abc95bbb04871306c6f7829ba2d0b843c57c486ed16187f2ad62818a25bc5775301cb88c081669fada70df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990972, "uuid": "c4846822-a2fb-466a-b67f-1da430ed7a2f", "value": "T11DC33B46EA818B03C4D617B6BAEF41493323E754D3DB730689186FB43F867AE4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990972, "uuid": "f8e6609b-326a-4ee7-b9f4-4dc49c01540d", "value": "3072:A41MBGVL4pYkwgjI3Kh3JVCQUeaLc+N7GM/9pVA:7MBGVLGAKh3JVXUQ+NiM/9pVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695990972, "uuid": "810631b3-063c-4510-bf27-2b11f744bc88", "value": 119621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695990972, "uuid": "c92a68a2-c25a-4a44-a51b-536b2e8634e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990972, "uuid": "40a4d991-381c-4b92-97fe-1f6da5262ab0", "value": "71f94d4cb547560642cab6011a26218a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3fc91c-5ef8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696013048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013048, "uuid": "f898674e-9db5-4e63-bc61-488e0d37f485", "comment": "Malware payload", "value": "5e334b323e8da8a1c0b6409cbcded1e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013048, "uuid": "6eac0aca-ea66-45fd-b765-b354ddb001d2", "comment": "Malware payload", "value": "aeafe332760097d913ce078b3945b53ecb3d65b34d2cf852336628d26f295a05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013048, "uuid": "1560fadb-56c4-45b3-9cac-1e42760994c2", "comment": "Malware payload", "value": "125da9c711eb7bd391936d75900dbed49050155f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013048, "uuid": "a17d7e37-fc17-4e12-8aa2-0de04333cb33", "comment": "Malware payload", "value": "91e7b1cc417e5abc60fb3084ea48d9b3c7e3515cc0ab358c1f6781f7ce0f80275bd244ed1841ddcc4091f8c8b1856e75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013048, "uuid": "adc56999-27c6-49c6-9096-4d33a6fcc02e", "value": "T1C974BF4878E6C4B3E97252360EF4DFA41E6DF9100690466BABD04EFF5B236D1C242E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013048, "uuid": "8a6f5b8b-25d9-4a6b-b22e-53eb1a7ac2f9", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013048, "uuid": "0261bc75-4454-456a-9c9f-81328bb43d95", "value": "6144:1GTeW/s5GqrO5aXnfEGIXWPvZAO6ymUnT1d+bl4XM/G1KTAHVHSsVs0BC+:pmcGqrOk86xcG1d+bl4XM/G1RH5Sos0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696013048, "uuid": "b1fc8c3f-f598-471b-bff0-160a37936000", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696013048, "uuid": "49f91e5b-54ce-4ec2-8771-8d20afd6d064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013048, "uuid": "9e91ade3-aa71-473a-a0ff-e2704502aecd", "value": "5e334b323e8da8a1c0b6409cbcded1e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7ecf9a-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986554, "uuid": "d0234271-2c54-4c8e-a9e3-dd70fac6a0d2", "comment": "Malware payload (AgentTesla)", "value": "f1a04b378fb51576e0546749789303d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986554, "uuid": "c614d038-e317-4155-8f54-45951a2bc5c9", "comment": "Malware payload (AgentTesla)", "value": "aee92c23f9139b9296b6159f2953ae1625e8a31a97ae110b549e68045bc49b7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986554, "uuid": "5d5b5f33-c55d-467c-9a88-fb4e91c9b321", "comment": "Malware payload (AgentTesla)", "value": "49aed450e3278899251c62870f45628608660312", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986554, "uuid": "81ec1ed5-928b-40ef-9203-badbac71569b", "comment": "Malware payload (AgentTesla)", "value": "21c0d2027256f6244d9f5835e5af35eeadc6ba03d9eb132750f510bbaeff6b05a3d9b92e2f281cd14ced4d5a0b18a08d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986554, "uuid": "b261effd-12a4-4b45-a5eb-acacbf5fcec9", "value": "T181D43398C09809757F8C95B7208F86685D81FE9E02847F96AA7053F31887BC772D0F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986554, "uuid": "b4941976-7bec-4b14-86f6-0aae60543519", "value": "12288:RaMnIZGRLAMCf7K7C/MxVqO+enaXEmYOGbaeoOr1ecyOz8rdQEt:XiGRsAC/MHflaUZ5RtQzrdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986554, "uuid": "13c2dece-4c17-4fd1-8873-ac5276691631", "value": 624237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986554, "uuid": "8fe9af85-7ec6-48ed-bc33-30edf1404e37", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986554, "uuid": "7a7f8f63-b5c0-456c-bde4-c8407086d4ba", "value": "PO_ 47464757 Purchase.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a801f86d-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024422, "uuid": "3333eab5-283b-4a7d-8668-d11cf129b8a6", "comment": "Malware payload", "value": "96eac6995ab0de944ca2d621244c4ddd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024422, "uuid": "f54a6d04-9f14-4491-8bd8-94f78e5ec59f", "comment": "Malware payload", "value": "afd3bcbcb6fc85c3166859fbf01d6e26db5775ae9cba586e01c11effa6a2c444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024422, "uuid": "4d3a6ff0-e29b-46b3-972e-d48557bfbe65", "comment": "Malware payload", "value": "b7fb96c28501094f7db0626104855bac48f52ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024422, "uuid": "4a28a1cf-6557-48ae-a63c-c619956d5621", "comment": "Malware payload", "value": "86cddabebf4765c6abb3d646791c62065edfab101eea512a1f6c3730c4049e6b09590f1efc16b106ebb74fca346bfe55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024422, "uuid": "5f2452c1-e000-4648-b70c-f63cb3e18c26", "value": "T1F3342314669595D98B7FEA353E65B8870C4C8B6868FB4A13F043ED781CCCA8EC178CD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024422, "uuid": "6ce6e77c-1398-4a91-a56a-47cf07bdc251", "value": "6144:kvh3VX29V4hjdjVEFYg2kfX2ytjrdOKjSyQHh8/1YC:kvld2LGxS3hJvokx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024422, "uuid": "2bd6906e-0a55-4f30-9fc5-081a145814b8", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024422, "uuid": "a1dbcfd9-1ba6-4903-9a67-85238b563244", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024422, "uuid": "47a50672-5647-4657-b793-a7da7c2767e5", "value": "288335.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94045cb-5e83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695963006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695963006, "uuid": "f5291924-1719-4b07-b616-a303606ebe4b", "comment": "Malware payload (Mirai)", "value": "6e2a7427f9a1c1c195d5c00de07057cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695963006, "uuid": "5c2841e1-359a-44b5-991d-340dd4bc7acd", "comment": "Malware payload (Mirai)", "value": "aff7ffb34d2d2c44b608ae82dab3ee6d8dbb767812d4fe2bf89c05745e7be2e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695963006, "uuid": "510a86fb-7011-456e-8523-307290abbcd7", "comment": "Malware payload (Mirai)", "value": "4eb6d128c73299fb55a3d5bfeed35e6decd1aefb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695963006, "uuid": "cf474fb4-8a89-4e8b-9291-1f572727a8b8", "comment": "Malware payload (Mirai)", "value": "0445d5399dc16114e6b772edbc135b0c111567954835bb23e5751694c63a031c7ace6360bdbd1e47ef52291941cf00dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695963006, "uuid": "6b316299-cc27-4c14-b178-310d12cc4d56", "value": "T17BC2F17F76A66A67FA5C2239E435C11B03A5F42C9B9D6B6B67400133E91F42E7132CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695963006, "uuid": "120883b0-26c4-4ccf-b583-6470256bc2dd", "value": "384:Mg1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHWedh+q:RMwxdyoEUnDz+Y8tqHWXm2ed940NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695963006, "uuid": "9133d3c0-c1bf-4bb5-8d76-12a92b3c885f", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695963006, "uuid": "7ee48b58-2f28-45c9-92ff-8c11f0939c28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695963006, "uuid": "a8ec5fca-c41d-4a24-bd6e-f21cc0ac6dc6", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0109c5-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987360, "uuid": "89bbd288-24b4-42a1-8a0c-d388c4ce52c8", "comment": "Malware payload (AgentTesla)", "value": "d1b016c284e45c7a92b76dc5fa2ef9b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987360, "uuid": "b3500400-88fc-4c7a-bb82-9bb6660bd6c5", "comment": "Malware payload (AgentTesla)", "value": "b04b1dfab5fd47ece5b217f7f51dfc4b5f24b4161ff6bb442949dccacaefa6ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987360, "uuid": "da79b935-1ca9-4ad2-ab0e-3bf92704df46", "comment": "Malware payload (AgentTesla)", "value": "beeff72a874592bce7218428c90e5a6eb05032da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987360, "uuid": "2ae9417a-ead7-4d3c-8b3e-aaa9ec5f692c", "comment": "Malware payload (AgentTesla)", "value": "5603239247eaf07573573a8cbb98f0a1056a53d2dd51a2f4aba1827d907b49d494b608067cb674ee8ba771a120a3b912", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987360, "uuid": "a583808a-88ac-4c23-b002-ddfeb94c466e", "value": "T1F1F412026BD41590F6BB32349AA6113003B7A690DD38DF2C19CC618C5FEB7A5BA55FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987360, "uuid": "0e42a5dc-d260-4782-ae86-a6dd7bb4592a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987360, "uuid": "0648d4ab-bc98-4e06-a46a-3037445528db", "value": "12288:Dc6Ackj6ux1gTFr1O9K+F9lHMgNa501u5GLXfJEL2Fw1yhWvZRUA2zi14jRVz:9kmu7gaIIc5YsG9qYmy+UH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987360, "uuid": "ee99e84e-dfec-4dcd-860d-389dbd0e5e61", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987360, "uuid": "3ff02b33-d812-4783-bc44-d0a6e97c91cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987360, "uuid": "127eef0b-8b2a-4ee7-ae61-56b771c02982", "value": "222284557-045845-sanlccjavap0004-8743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04b6045-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024490, "uuid": "257d16db-67ec-4556-b5a2-85e4721953d3", "comment": "Malware payload", "value": "292ca0e7cfd1e2e8f8f270ec895d0243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024490, "uuid": "81186f42-ad44-414f-b760-43fcafe07fbe", "comment": "Malware payload", "value": "b08e2c01065263a1f8de0e6e6e06498a46273bec5180689dc90c81e72da14cc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024490, "uuid": "6dd4f51f-2c36-431e-9599-d981bee5afba", "comment": "Malware payload", "value": "fc9f4d08927c4e16120fd33d33d0806719601322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024490, "uuid": "0d645fb2-accb-4d38-8706-dbb631df7d01", "comment": "Malware payload", "value": "ddf7b0ad9a810c197f9deaa721818a8ee4cbe6229200f5b1cc6986af75e2d6e1f993a19336289f0ed8d8a442d6ad6c1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024490, "uuid": "0da6351c-a837-4688-bb08-c35a8d54c83e", "value": "T14B3423370CC2B7199CD192227C3CE0ED53F7AB1235551F9BACCA7C16A2E49AE15D2AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024490, "uuid": "b2e479ce-eaf3-41fe-8827-d44c780a4a6f", "value": "6144:Db8K3m8Vyd+xlz0TTbW3oDxixTp90gN51K8cMF92h6C+NL/Clha:HR3mkytTTC0xmD0eG8cMFy6r/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024490, "uuid": "3ab1ea68-ecbf-4f74-9649-95e865bf40f4", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024490, "uuid": "1a02a78c-2afb-4100-9dff-b9d50f3c3e99", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024490, "uuid": "a1188f96-8cad-4644-92d3-d4486b5899de", "value": "288343.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d690450f-5ee5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696005173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005173, "uuid": "d78dd4eb-bcea-46b9-a3a7-e8f8e42230ae", "comment": "Malware payload (Mirai)", "value": "6e7aa43e5e4488c823a85e4067764e20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005173, "uuid": "10971b3b-110c-4c50-a98d-9be47e25f94c", "comment": "Malware payload (Mirai)", "value": "b0dacd1b227419d2e0fe7254571ccedf76651cb0d6170867752e1c89576e4d31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005173, "uuid": "fa3841b9-efb1-4dea-a8c0-1bab32a89c60", "comment": "Malware payload (Mirai)", "value": "6d2e384acab2ddf21c5275ada7b88f22fd1b4505", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005173, "uuid": "9110e8c5-2add-456e-a92a-a00b452427b2", "comment": "Malware payload (Mirai)", "value": "07562d52f4955cfe1313f4bbeebb9df63ce2c27453ddcdabeed304e3514717f3717dff1f93cd7985ac06b600ee2c3e90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005173, "uuid": "da514d5d-9c95-4753-9737-b9a11b8c65f8", "value": "T147A2D01572632E55E3E91C3CC96A8357F9671BFCD0F6327679411620C94D24A3E38B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005173, "uuid": "dc1ef9b4-2647-4346-a2d8-12eb31f0ec41", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjtvwhymdGUop5hE:TvQn4j+ZO5fKAlxdws3UozC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696005173, "uuid": "5c0dbecf-8bbd-49b7-b301-272b2882705d", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696005173, "uuid": "7bcbcfa6-fde3-4f75-89a4-63fbb2fc4bc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005173, "uuid": "c5307cef-384f-4501-88b9-cb2774c39721", "value": "6e7aa43e5e4488c823a85e4067764e20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfb5c56-5e92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695969509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695969509, "uuid": "bdf7d0ca-2ec8-4c9c-a94f-513f48edaab0", "comment": "Malware payload (AgentTesla)", "value": "e2a60cce724a792579929edcc3304072", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695969509, "uuid": "eb62eeb6-8333-41f8-814e-e1fac41ec5f2", "comment": "Malware payload (AgentTesla)", "value": "b0f78bdc2bfc668fc39e8735344d5c6ca8f78290132b70734c76dbf436c41c44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695969509, "uuid": "f7a3d0eb-ac87-449b-ad33-5d7ef09fb685", "comment": "Malware payload (AgentTesla)", "value": "d5b1f3629656ff04f10f7a07e459f58eec5265fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695969509, "uuid": "4d14321b-e1c0-46ad-98ab-2d4c81bb7264", "comment": "Malware payload (AgentTesla)", "value": "b960de1b0317d5e469c9ddcce722a5fed28b0b1ee5c0af742afa1236bfb063fa8feabb1ae072d2da60524d93fe34d8c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695969509, "uuid": "7081fa8b-184e-4a15-8968-316c5a8ffa2b", "value": "T1ECD4126126F84B89CAB8BBF998265510A7F695AB3632E34C0CC374DF1576F448700FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695969509, "uuid": "c64c2c92-98d6-41b8-9ff1-cfe8b61780e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695969509, "uuid": "9ef48e84-a448-4a5f-ac00-f40ff271da1d", "value": "12288:1B2iN4yiRJU/WcY5dT7szGcxwtUhBBmcYCLG/o0HdwjhGS0mZ1czKLNwcInJw3:r19FeX5dTgCMw0sCLG/oadIhHvcOJQnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695969509, "uuid": "b1c9875f-7182-43a1-b4ed-276211fcb2ec", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695969509, "uuid": "f108b275-15e1-44c2-857d-7b9eae672417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695969509, "uuid": "228b77be-b7b4-456e-ae8d-35e875eb9b0d", "value": "EURO 387,226.pdf__________________________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5935a238-5e91-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695968885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968885, "uuid": "074d4912-aa19-4ae4-a2db-c142a588cf40", "comment": "Malware payload", "value": "1e5796faf6224526d77c451c873dbf56", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968885, "uuid": "dd573cae-41f8-4691-bd24-90bcc4d0aa56", "comment": "Malware payload", "value": "b2318ed57fd27f922929fafdfd3c40adf59e5220e49d7fc833b2e8414cc6adde", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968885, "uuid": "6b826372-da49-4bb2-8e1d-90d89e9a62a3", "comment": "Malware payload", "value": "e4341929be10ac40e666aa4388d12b2644744b59", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968885, "uuid": "766afbef-e631-4276-8329-b7db0b944290", "comment": "Malware payload", "value": "d43dccf70181fdbc422ad82f8bd570e45f4bf72f924017da437cdb66de09e560e207b67e999d15bcb9bdddf5e581ae09", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968885, "uuid": "007a14d6-a7fe-4b79-a988-b2f9bf94104f", "value": "T1D8418D5A90CB422546F24B6B88145CD8EF4E9C3F538D1901BE5C90DB6F344AE8A92FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968885, "uuid": "0205aa63-3f11-4922-ac9d-7c6185ae2923", "value": "48:Amzn14Lf1T5dw1T/QrpqISL+MqyI8277AQJaIzX6TpRSn//PVPgJmFot98nAKiMg:L6GT/KvAit/VP/mt9nLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695968885, "uuid": "1e2681c5-5460-49ec-a83a-cee67aea1e2d", "value": 2204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695968885, "uuid": "079e1440-bc1c-48c0-baa9-3a8a1a1015c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968885, "uuid": "418c51fd-cc69-46a0-85f9-0a6531137bf3", "value": "new.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d141dbca-5eea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (frp)", "timestamp": 1696007312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007312, "uuid": "def9e84d-1d69-4ad9-b760-97caa03db85e", "comment": "Malware payload (frp)", "value": "67e741557eaa3124261105bff38bc62a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007312, "uuid": "a9d9f28b-5d8f-4b85-8afa-4abb2f472d52", "comment": "Malware payload (frp)", "value": "b2e6a04435ab8d41a5a259072b6c29dec30caa05ed1ec2a8bae2b2670573981e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007312, "uuid": "06bc3c00-866d-40c6-8774-2e1a10f8d9a9", "comment": "Malware payload (frp)", "value": "a2a0543d6b61ac0a9380cb6d64f78b16951912e0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007312, "uuid": "4fb52936-3e62-4465-86c4-6fb334e83cc9", "comment": "Malware payload (frp)", "value": "9ca1f3ed1c10e465f26d5d763a294bcaac9c7b3b3bba41448ca0fc37ba757e023b8bc8aaef9d8ffc2607de49f460135e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007312, "uuid": "50d4dd8e-8d4d-4677-899b-b7acffddcf1e", "value": "T1B6259E1BB79400ECD42AD174CB654136EA72BC960B31AADF02D0B3692E77AE45F3E714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007312, "uuid": "92146af7-65f1-43a0-8162-46f24073cd47", "value": "f074e6ca80c6be1bf7a7c56645030fbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007312, "uuid": "68014fc5-f498-4a79-8ce9-cef3a64247c6", "value": "12288:oVDH4arSas0SRUXA5S9ZgvlZW9AxBK8ctBGOKLDcEHDqYocAXrexgPlBo8Ker5+m:24arTs0S2Q5SgitBj+RacAXUUBLeJ4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696007312, "uuid": "3f26fc2a-ac13-4cd7-8d50-01d5cfa70b5c", "value": 1047568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696007312, "uuid": "41883688-695a-40f6-824e-9c65a3a2849d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007312, "uuid": "b2270f0c-0d9f-44c7-ba1c-fc1a1aafed86", "value": "67e741557eaa3124261105bff38bc62a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa25e2f-5f0d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.Generic)", "timestamp": 1696022413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696022413, "uuid": "6bd617ef-1f46-4058-b43c-d8522a9b532e", "comment": "Malware payload (Adware.Generic)", "value": "60b0d246f24796197ec92e8e10356bfc", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696022413, "uuid": "df1fca4b-30ed-4840-8135-88be429c438a", "comment": "Malware payload (Adware.Generic)", "value": "b3440cb56c49c7221c793df11cfe845f530f87ac3ff641fcb6ff2037f5293218", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696022413, "uuid": "fa7c01cb-20a2-4437-b86d-3529414b8865", "comment": "Malware payload (Adware.Generic)", "value": "14239a06475e0f18a73ee709b0c5ac0c08aea950", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696022413, "uuid": "01a45627-9540-476f-b20e-4e8dd388eef5", "comment": "Malware payload (Adware.Generic)", "value": "75890e24a14d3df8b68be2dfb46e72da2a40f9739aad935502d3169039332ae050e832092d1d18a0e4997adf5a0dc0a5", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696022413, "uuid": "56a667ae-cad8-4b5a-8338-b16d761c70b9", "value": "T1FE86334916C5CC88EEDA24BF67233442C2BE42FBE425090CD229D4D565AFDC59DCFA2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696022413, "uuid": "7dbb1bd6-7b5b-48ca-83d4-7d47bd858e72", "value": "196608:RSU9xU62aqHx0cm7WEZV0FvOAW7X6dEbYS4Z26dM5euASKnRcC:RSsU6zzV8a3b94Zbcm9nR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696022413, "uuid": "10fea4fc-7bfb-487a-b3a6-3fe0c5178cc0", "value": 8346135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696022413, "uuid": "47369370-f4b0-4ca9-82f2-1209618b4e44", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696022413, "uuid": "f4d13cbf-10c9-42a1-8ed8-ce821163c03d", "value": "O\u0440\u0435r\u0430S\u0435tu\u0440.appx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d83bf2-5ee4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696004496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004496, "uuid": "8999470a-e769-445c-9074-22164b8d3396", "comment": "Malware payload (Smoke Loader)", "value": "0d8502fef5dd261f308d66febb9cb48b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004496, "uuid": "bc0a7db3-4109-4e75-9ac8-877e5457ffed", "comment": "Malware payload (Smoke Loader)", "value": "b3458d317bb1d899de66eb3f3a50eeeaa1b8d2c7f4bd8e425a60d3fec697f3eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004496, "uuid": "3a5322d6-db43-4715-a5e6-16cc823a4124", "comment": "Malware payload (Smoke Loader)", "value": "ce56b101459bc1abeda37dcd75bc574cb78402af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004496, "uuid": "67795a87-3aa0-4667-bd60-d54d2e4c5175", "comment": "Malware payload (Smoke Loader)", "value": "71ed53fff4d7b4b1064ac465d480db63cd4358ad97131fde5a7248a57bb24df9c729672dbbc14e66a363e6e60c39ad78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004496, "uuid": "1efd3989-9915-4f58-9704-07cc79f47d31", "value": "T19534AF0A62D2EC60E5674A328D2ECBE47AFFB4614F756F6B23146E2F18701B1D663701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004496, "uuid": "577949c2-6b56-4a74-91d1-fd7db30dace7", "value": "04b413a231387eb973c8024c0a5e8f4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004496, "uuid": "bca26ea0-0a99-488b-b791-133267d74db4", "value": "3072:6XjRI3MLxNy1MtOFMzmxyh3NzNgLGUIqsynbfzQIB5J5mJxrYT:addjyGtOFQzNgyUx7bfzQIB0nrYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696004496, "uuid": "dfab2b01-5b4d-44b3-8f95-63b6fd5b2bcd", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696004496, "uuid": "707aeb2e-0d9f-43aa-8607-ed728aa5dd61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004496, "uuid": "dc8e0597-7b82-46d0-903c-7c17e6e66718", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fe933b-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (OnlyLogger)", "timestamp": 1695976902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976902, "uuid": "5f3cb6e4-0643-4ef6-8537-944819afbff0", "comment": "Malware payload (OnlyLogger)", "value": "55a59bf8266919152495f5195c34169f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976902, "uuid": "83e19f60-8ddc-4254-b5c0-5e3b432fed9d", "comment": "Malware payload (OnlyLogger)", "value": "b422a292ac86c0b51a3c0c2271e5d1565c89914a05fe361f61331fae95185152", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976902, "uuid": "7ae405d6-8e64-43a4-9ba9-c588824bee2d", "comment": "Malware payload (OnlyLogger)", "value": "9c77f14e86d97ff796229dcba5e043d9d15efbe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976902, "uuid": "1d6c0611-7bed-4d0c-b9a0-2b4daf37cd3b", "comment": "Malware payload (OnlyLogger)", "value": "b36ce613ceebce62c0e4851ca4cf96c0f4795e9d672cd2fe469ad385f3fabef699aa22bbce6d3e18112f9eeeb7c4722e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976902, "uuid": "fae69eab-592d-4077-873b-b0a0de0afbf4", "value": "T1B764E011B9A0D432D4A745748C34E6E89E7FB8635564994B33E43FAF2C317C17BA2B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976902, "uuid": "fe15358f-9fcf-4ec7-a885-f7f42d11b8d9", "value": "14051e4df4c36cf261bf236adfea8971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976902, "uuid": "4c6958c0-57f6-4d3d-adf1-4bb48d6091fc", "value": "6144:3epP7TpurysCIqeiCepJ/Pl84vFBE5ybxsRTf:3e1uGleiCei4vFBEyFsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695976902, "uuid": "28fe37a8-ccb6-48c6-8ecf-d78f219a3afd", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695976902, "uuid": "8d0ead98-0dd6-49c2-8d74-2544d5886860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976902, "uuid": "d620ab93-782e-43ec-b75e-8cf95d6065b4", "value": "55a59bf8266919152495f5195c34169f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066679bd-5f07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696019427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019427, "uuid": "c0c1bd8b-2a4a-4a98-af2d-1162bc9b09b5", "comment": "Malware payload (Amadey)", "value": "b8166a69e2038b4091ea1789362c236d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019427, "uuid": "b1677e3f-1d14-438c-a3cd-bb1672e2b002", "comment": "Malware payload (Amadey)", "value": "b44345456b6d53ba3769b02393e8b460e118142637e7e96c92382556b581f810", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019427, "uuid": "1afb4748-2107-4f09-9693-ca3a6af9ce1a", "comment": "Malware payload (Amadey)", "value": "87678c4bdf43d1f6acc2a14e75f8513b91cd4997", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019427, "uuid": "778888e8-6e7d-4015-a228-fc83fe669c56", "comment": "Malware payload (Amadey)", "value": "a66a56c8cd28d895061669cd99d898c7881025dcd78f6ec7d9ad22e2756ae6e9d99c3ec954f17e813056ccdf33b36e32", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019427, "uuid": "2a86e927-3471-439d-8c73-948405d95a95", "value": "T1A934AE11B4D1C472DC7227360AE4DBB95A3DB83009A15ABF67E40F7D8F24281E661A7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019427, "uuid": "6ec044a3-b112-4f71-8798-23df33a40556", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019427, "uuid": "0be9af71-ea46-4e93-b671-2842ba754a9e", "value": "6144:dEz4SHy5uoBMFGV5PEkIXEHvZAOfn4xVs0BC+:FCmuoBMUOMx1ws0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696019427, "uuid": "dfab5efe-ebb8-4c0e-9121-316c502635a5", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696019427, "uuid": "7f773825-f888-4888-856b-d825a0cceb3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019427, "uuid": "2f73283d-1154-4459-a1dc-64a35fbea8fe", "value": "b8166a69e2038b4091ea1789362c236d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea6f3c6-5efb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696014313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696014313, "uuid": "2ceeb0d4-fccc-4037-a480-588f8dfc7633", "comment": "Malware payload (Amadey)", "value": "dbfc318ac14e060b31e3a16f13b76021", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696014313, "uuid": "f1ccfbb3-2d40-402c-b3fa-af781619a657", "comment": "Malware payload (Amadey)", "value": "b44ada6b8c350a4076d7d79e6043aebe9f8b133c54b2832d6859b95d67dc5f33", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696014313, "uuid": "72cd6bc8-dae5-482d-b3ca-84e04df56173", "comment": "Malware payload (Amadey)", "value": "6f01b12c197009ea1074eb52046ae1c786fa8517", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696014313, "uuid": "35a4fb55-c6f6-4864-a3c3-e34db58a88b8", "comment": "Malware payload (Amadey)", "value": "8d406ed68806822bc0e757ffbf6c07ed37c56a9113a9378ebcb34ce3c3d911927c3ed69e46a94046b608df1bd115612c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696014313, "uuid": "87264d58-7b71-4e76-957d-22050606e9b1", "value": "T1B134BF11B4D1C072DC7225360AE4DBB95A3EB93349A25DAF67E40F7E8F30281D631A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696014313, "uuid": "733e66ec-e39f-4488-af1d-1ecddd0f7696", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696014313, "uuid": "9880b9b5-6244-4f5d-9551-cf45eb08a6e7", "value": "6144:5Az4SHy5uoBMFGV5PEkIXEHvZAO4qCqVs0BC+:tCmuoBMUOMxuGs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696014313, "uuid": "174234df-082c-45b9-94bc-efda58a7c099", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696014313, "uuid": "fb9b45f1-59ef-459d-a992-4403ae8a55a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696014313, "uuid": "6ee39922-553c-446b-b159-ae3142f87e02", "value": "dbfc318ac14e060b31e3a16f13b76021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1339ed91-5f18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696026750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026750, "uuid": "9e906e70-ccaa-44b1-b7e7-319c3bb36f89", "comment": "Malware payload (Mirai)", "value": "2bb9cd9de3ab15f6cb9f181edea98ace", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026750, "uuid": "b6ceebb1-d972-41f8-9134-20225f84fe9b", "comment": "Malware payload (Mirai)", "value": "b542473d86ad490ddc0a55722dee2d5b3ea97cebd2d706f13d8c5e9329fe42ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026750, "uuid": "360c1de8-d79a-429c-b84d-e85455d74cec", "comment": "Malware payload (Mirai)", "value": "48fe33543f73b307a94d7c045ae920c427ec143e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026750, "uuid": "06ac59a5-d237-4b64-b0cc-3031dd2361e2", "comment": "Malware payload (Mirai)", "value": "03c9f9d9c9ae94ce2a9b859c94b4b4887e5fa5630c32200433a1a0ce5938cd008edd1d7c2fea94777492272ecb474eb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026750, "uuid": "7ac95d83-355f-43a9-afe3-6b3854f44a25", "value": "T105D2E1016680FEE1C5B00236ED668A9B72263D79D1D130FB973C0DF8A6E961D47F8943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026750, "uuid": "b391ef19-a511-4f50-a194-4d46f385d6ab", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXgNj9q3UEL7k:WRwynNIOQQ1KMwNiLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696026750, "uuid": "b998f2b5-456f-4916-bdfb-9d3d3c834aaf", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696026750, "uuid": "97754019-d608-4ee9-8397-117ba6dd6829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026750, "uuid": "6481c6ac-e590-4024-991b-a2dbd97954d4", "value": "2bb9cd9de3ab15f6cb9f181edea98ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24205c51-5ed8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695999290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695999290, "uuid": "99c498a6-2999-4956-b78e-0e771142c613", "comment": "Malware payload (AgentTesla)", "value": "4849feb37691a61269212d9d323e6f79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695999290, "uuid": "130d1265-4fba-4ea3-85ac-750c0e75a229", "comment": "Malware payload (AgentTesla)", "value": "b5d20396d0273d833649d6dfd15bd489eeef91990719c9d80d0c487cfc2bdb7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695999290, "uuid": "e418e180-8906-4317-8520-2e3a64228c62", "comment": "Malware payload (AgentTesla)", "value": "39f426acdd68f211edd1388cc65b2aa7772470c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695999290, "uuid": "428d8a1d-495b-4f6b-9c4d-05913eb2542a", "comment": "Malware payload (AgentTesla)", "value": "4dad11386b5f6161d7410a7a1d3fd9dabb207615db446a04e9481ac29e75bc7fa4af8371577497fa8c314a861d9238a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695999290, "uuid": "41862b14-ec66-477c-9cd9-adb8027681e5", "value": "T1ECF40202ABD91281E6FE227499B151B103F76A12DD39DF2D08CC558C4FEB791BA14FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695999290, "uuid": "a04e4b05-b831-4170-81b0-99100013c4a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695999290, "uuid": "0cc49b68-2502-40e2-a08d-53f8bed34baa", "value": "12288:zcaAckjcgwHk/JIUszy9/dtNbydafb5pHTtT88r+RZE:9kFMkeDy9VXbydafb5pHTle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695999290, "uuid": "14793202-e834-48f0-9189-063fb28e8a3c", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695999290, "uuid": "71b32b9d-f4a7-4240-882c-9ab6cbdd8144", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695999290, "uuid": "a4e673f5-ef16-42f4-9638-2ee497bb2db2", "value": "4849feb37691a61269212d9d323e6f79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1248b22-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695990964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990964, "uuid": "220be248-a53e-47e1-b16c-a127babc8d52", "comment": "Malware payload (Mirai)", "value": "4686f8aa74457f33f6e80ee994e641e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990964, "uuid": "7d1014f1-eb32-49ec-954d-6d8f65734c15", "comment": "Malware payload (Mirai)", "value": "b5fca1d1043558d3c0c46786f13bd58c753ffc67755a63935e0a257883f0fcff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990964, "uuid": "98770940-fc23-42b6-85f1-e24d71f88f64", "comment": "Malware payload (Mirai)", "value": "76b6e8f4568dae6e41be10000a38b5198bb64184", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990964, "uuid": "606e1bdd-c3ee-4432-8efb-44e17d1f7ef0", "comment": "Malware payload (Mirai)", "value": "be58bde98754f2eb4bd1b67cc81bc85526d88da0b052d189ceac29934e35d2246415232dc4f30ad9da481f2d59c8da69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990964, "uuid": "201b73ea-5f94-44a8-b952-a19db8666a25", "value": "T12C134CC4A943D9F5FC2106743477E732F77BF07A203EE98BD796A522A841A01E60729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990964, "uuid": "3b298ba3-b622-4749-a998-8439cbefa132", "value": "768:tt/Y1Z2bIXm4UC9kRwDsuwSKFHLYx4Vu4yLOYw9Di7NULNcB:tBY1ZgIXm4UC9kS48KFrYx4Vu0YaDi7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695990964, "uuid": "39a2d3f4-43bf-4e08-bfae-ce68a310d47b", "value": 42396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695990964, "uuid": "eb1d9804-f576-431e-b1ce-618073dc049f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990964, "uuid": "eaebe994-c0de-4873-aa1f-9a4dc701b69b", "value": "4686f8aa74457f33f6e80ee994e641e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e167d5-5eca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695993275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993275, "uuid": "59e6ec54-8de1-4f8d-9d0b-527f0a119db5", "comment": "Malware payload (AgentTesla)", "value": "d928fd4dc7d2859adc7e285912a701ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993275, "uuid": "9d4300dd-3351-4c47-af77-ded20d7200ef", "comment": "Malware payload (AgentTesla)", "value": "b63ebd3c1ebb2ea2cb29a8ffe48b778abb4fbebf416ff00a489252d191a1755f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993275, "uuid": "228e210e-8173-419e-aacc-4ffd1a4316ac", "comment": "Malware payload (AgentTesla)", "value": "06587e5e6a4ae4c469df7b9774e77d5b650ab231", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993275, "uuid": "be608eee-cb0e-46c6-8790-6c5c08a9ecc4", "comment": "Malware payload (AgentTesla)", "value": "a01af1be69f02d23c83cafd8dfe839a03f5493550b63024be5fe7b214eafb5172e80f0cb184acb14a16fc8b7e0e447ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993275, "uuid": "3cc2e948-9f45-446c-b6aa-5421f31e0181", "value": "T17DD4F13C5C050637E6F9C27AC5D91A07F1606DAB7131DD5A89D3378E2A37A473882B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993275, "uuid": "600367cd-7469-4112-9420-9bc29ad55981", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993275, "uuid": "8bd915f4-b445-446b-befe-8f9bd26ee17e", "value": "12288:Z0CDo5725eIz7/lVZYJr3nvfYrEjh/WyQ9ZEp/QUv0SYaHpguwiC8iw:Z0WJP/Sd3vfYCWLHIYUcSPHYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695993275, "uuid": "f185fcb2-b4b6-4e69-81a1-08d801a1b3f9", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695993275, "uuid": "b132946f-3a8a-4fa2-9eb7-42f8c103b123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993275, "uuid": "6626ebd4-887e-44cd-8307-56d31e5fc184", "value": "d928fd4dc7d2859adc7e285912a701ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04808f25-5ef2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696010404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010404, "uuid": "e2b1c763-ec9a-40b2-8fe9-808187dd3683", "comment": "Malware payload (Mirai)", "value": "4d4f317770c770920b02b4d53740bef1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010404, "uuid": "846de2df-b91a-4e67-ba57-6faa5aecf6b4", "comment": "Malware payload (Mirai)", "value": "b66ef4308d39b3631233f6a84a43c35d57930898b99f281ff518ff795244ef06", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010404, "uuid": "440cfaec-5f5f-4337-bee7-064df535e839", "comment": "Malware payload (Mirai)", "value": "bdb7e206196fd95c41b99f6d98e5b0cd621df7fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010404, "uuid": "a48f18cf-64d4-4057-876e-0967fe6fac10", "comment": "Malware payload (Mirai)", "value": "68ce34edc3c76e5183052ea9aef9a88433b668576be96d8ecb60de4bb1d6c42f200ccfb9fb271f7e82f7657542078b9b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010404, "uuid": "d0691296-f8da-4adc-9b0c-4d05ff437ff5", "value": "T161B2E1B197E94938E91DC33F0337CDC9A4E68A4ED2D0C7B1E691E8640446099EDBDC4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010404, "uuid": "9e525dbe-cbf2-41dd-b51e-faf871222953", "value": "768:kGissSfCL9lMvG0/v0maTGRjvuzltaZul1/:kGsSfajSGYsV69MTa8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010404, "uuid": "c9e9970e-9420-470c-ab37-5bc0b0134e46", "value": 25076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010404, "uuid": "437e04dd-b37a-4fad-a080-1ec656c79f19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010404, "uuid": "4ce7e0d6-6b11-4443-aa0a-7724e6eff704", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda90dcf-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986717, "uuid": "5fa191c6-6176-4bf5-ae3a-92a2b254c7bf", "comment": "Malware payload (AgentTesla)", "value": "6cfd7504fe0eb58fc7afe33e5895c6bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986717, "uuid": "dd332be6-f4a2-4165-b017-3fa661bbd6db", "comment": "Malware payload (AgentTesla)", "value": "b71ed2f933250f09d3b7836d7f77bfa4febf8d10942876f97d446f7aa4b4b18d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986717, "uuid": "e5737629-5a14-4934-b960-6ef4c868bc69", "comment": "Malware payload (AgentTesla)", "value": "ac9608a3b29e8a3d2885bed1e45299cea5893349", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986717, "uuid": "a06ac251-b97f-442e-bb11-e3fbad56916b", "comment": "Malware payload (AgentTesla)", "value": "8f52d3f50f18855cff83f176473db6db5aa4004a24229dbeab04bc634d46e759ac6f28d6128971ee1b340c25f4b86d1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986717, "uuid": "0eb0c668-8dc5-4ac4-a693-945200e8409e", "value": "T14684EF1029EBA44CF2B37F632BEDBAE54F6FFBF16616919D250003064A57E80CD95A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986717, "uuid": "6b536150-1b48-47b0-9fc9-e43e9371d63d", "value": "3072:8WsV5N6iKNYRT+4/I2JwFPIuo0XaHXaIhhlpK:MlKNMPJwVc0yThlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986717, "uuid": "bc99a15e-bc91-420f-8d0c-068db4f8729b", "value": 379388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986717, "uuid": "f5a6191f-2cbe-41e2-8ff2-1a5e5205811f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986717, "uuid": "a335b981-fb5e-415c-8bcf-3e86e38c5d03", "value": "54ORDEN DE COMPRA 088562.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512d1bf5-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024277, "uuid": "cd8927e3-87cb-4a93-8cc6-543effd759a6", "comment": "Malware payload", "value": "bc9a1bb63ce9e534f47bcf233c81731e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024277, "uuid": "8541599a-d957-47f5-8a30-27097c025c46", "comment": "Malware payload", "value": "b73f0283e0bc6a297ef060cfbbde20c7d681ff3e686751a7ed78c6bfd73b03bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024277, "uuid": "8e73f8ac-beb2-4240-ad9f-c0044b6000ea", "comment": "Malware payload", "value": "b6b4e068179971c9726b303441536c1d4972dd60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024277, "uuid": "a25896f1-6ca2-41ad-ac8b-9c0faf239afc", "comment": "Malware payload", "value": "27adce2f22bcc2e830e131fbcbc7438a891693763c62aec7192c0a1f98a16fff7fe3d0c5a359b00d545cd2c5b990cb16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024277, "uuid": "290acbc0-862b-4b99-8948-01d14e9a46fa", "value": "T1BF3422789AB593183D1303C446BFAEBB96D13FE5D579D7DD300262A523808F67A60E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024277, "uuid": "6f116055-b3fb-450d-899c-87d3b43e80f2", "value": "6144:1fxE8vyEKpp0PaBgXNQsTJjSNeDziYad/rPkM:1e8V20PrvFOIXa1rPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024277, "uuid": "c1bf3fa6-aa70-45d6-b791-4278a95e2825", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024277, "uuid": "1438183e-fe13-4433-a0ab-57f3224b5ef8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024277, "uuid": "f395fbac-3efc-4bf0-9be4-e76b3ce8c4be", "value": "288317.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99011fa5-5ecc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695994332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695994332, "uuid": "c59c4b18-4258-4cd3-b3cf-9015c51d9958", "comment": "Malware payload (Formbook)", "value": "54326c193800ac78407da899e591e86d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695994332, "uuid": "04c7adec-f599-4ae7-92e9-e8515b21da5f", "comment": "Malware payload (Formbook)", "value": "b7c2c67469229933e03fe2186b865bc18c315e498b369d74c000c64255cd495e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695994332, "uuid": "66374233-b4aa-4776-85a3-163342f820c2", "comment": "Malware payload (Formbook)", "value": "2dcc8a986ac3d8ef2db2b4f029d5ea6b5e8c25f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695994332, "uuid": "526b3ccc-753e-430a-9a4c-0c91519d7e33", "comment": "Malware payload (Formbook)", "value": "4fbd90f71babbd246c808112e882eae7d382033649f9580d2aed2e35dedb2d75a0c2b31dc796fc79e20115c7b7e9dd07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695994332, "uuid": "342502c1-9eb8-4bb9-b504-3f687f6180ea", "value": "T1B2A4CFCDEB1194E0EC2252B1297DDD77476B9C2E6858298929C77E373C62093303B99B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695994332, "uuid": "a5d8ca9e-a6d5-4e6b-8e7a-441c1fa61e31", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695994332, "uuid": "e32538e5-3cbd-41fe-9396-3ad018cb245c", "value": "12288:nnPdTrcon3RgV0GkxqFsQRv7eXXyOyYO6xdN:nPd5BgVRxaQRz2wYOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695994332, "uuid": "dd94dec5-4b1b-42fd-9bcd-66f3dddb2d09", "value": 456074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695994332, "uuid": "b37a7e49-cd75-4105-9a98-eb705ff618d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695994332, "uuid": "6001d37d-22ee-44e6-8c93-95989ad13aba", "value": "SecuriteInfo.com.Trojan.Loader.1550.15395.29676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd1c958-5e96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695970960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970960, "uuid": "5c2f2546-e41b-4ee9-af75-93cfd87d951f", "comment": "Malware payload (SnakeKeylogger)", "value": "c059b627b34942fdb9963290d3bf54d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970960, "uuid": "e0ce96e2-b4ee-4c5d-b474-b1e017cebf1c", "comment": "Malware payload (SnakeKeylogger)", "value": "b7d2b37cc28a00f2b70eab0d8d20fd07b5f8d4a908b5de1f5ad828fe80edcdfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970960, "uuid": "fbcb6e6f-aac6-4b2a-bac0-0a7c0664d3e3", "comment": "Malware payload (SnakeKeylogger)", "value": "98f45995e4891fd10a7229d89ac966be044cf8ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970960, "uuid": "d009aae8-0196-41d4-8f84-f1ddb4ea2c0a", "comment": "Malware payload (SnakeKeylogger)", "value": "2f50aa89b0a597466a25a294dc20492459c3133e65d5d2a8e06c74cbbcd4fb3b75530bb9c5d1a2096a6c7f6be52b4d21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970960, "uuid": "e67f2e74-17ac-4e03-b54f-07b71544ecc9", "value": "T1ADD4A23C21E92A8CF36596BCF3744EFF57D5796F91ABB8B7AC4CA18306A57C05502220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970960, "uuid": "5af7d377-71c8-4eb9-bee0-b26ea78a6e93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970960, "uuid": "e22af0fe-a74f-4d2e-a55e-60c2709ca97a", "value": "12288:2sXs/PP5KypE/pjWsuaTvWotigoTaqb06yyOi6J:2sc/XEypE/pjvuaTOotLoTJbbOi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695970960, "uuid": "f3a35a7d-5aff-46c4-a4c0-ee75e4c3d2cc", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695970960, "uuid": "72d239bf-5ee1-499d-9fba-27fb2a4890ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970960, "uuid": "655358c4-e770-4453-99d3-3691cad99a60", "value": "AWB 5331810761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f00a8f6-5f1f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696029937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029937, "uuid": "93e7cbec-8587-47cd-a80f-db36751121f0", "comment": "Malware payload (Amadey)", "value": "e82d7330530ce104b7814146ba063fe5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029937, "uuid": "f3986e9d-851c-4ab0-a914-e0421d1304df", "comment": "Malware payload (Amadey)", "value": "b8c0ba48d3daeda883f70f36842f654b91fc50348cf4deabbfdf9a237a2c01b4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029937, "uuid": "e211fbbe-120c-4d64-bff7-3e7bb3ec35b5", "comment": "Malware payload (Amadey)", "value": "168aa337c976baefa65dcc415a8d62d0201dfbed", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696029937, "uuid": "682ef83f-664d-4c4c-80a8-0dbee05f40b8", "comment": "Malware payload (Amadey)", "value": "a255536df3aeb28c87d85c92b12772751445aac17087e71906cc5dcbfdb1bbd401d84605fe7e3b5e417d63c58e20e269", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029937, "uuid": "1f221f88-cd1b-4813-91e5-6d564ba80d98", "value": "T1E334AF11B4D1C072DC7225364AE4EBB95B3EB92009A15EAF67F40F7E4F34281D632A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029937, "uuid": "9ce1db3f-5d6a-4c13-8b7f-71e1e32a3135", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029937, "uuid": "8b25b041-9ddf-435e-8a5e-c43d401f0db1", "value": "6144:lVz4SHy5uoBMFGV5PEkIXEHvZAO5j9uBVs0BC+:MCmuoBMUOMxgs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696029937, "uuid": "57788a0d-4a45-49b4-a73c-20426b19e36e", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696029937, "uuid": "498235e3-b883-4ac7-94c4-e7d9d3d8e4a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696029937, "uuid": "f1fffe14-636e-4c84-9b97-231f846b06ec", "value": "e82d7330530ce104b7814146ba063fe5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2181a179-5e9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695974375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974375, "uuid": "1111f051-03a5-4a11-a3aa-ca20024ff0fd", "comment": "Malware payload (MysticStealer)", "value": "7f41d7c25defc702f623a532221c41db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974375, "uuid": "9e7244c6-571c-44a2-b951-3136f7d77a5a", "comment": "Malware payload (MysticStealer)", "value": "b99f055737f6952f961363a9e766b5f6b3ec6e5fb12195d5d67e9dec63e22e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974375, "uuid": "86b5fd53-ad45-4cb3-80a7-ae22860e78bb", "comment": "Malware payload (MysticStealer)", "value": "94e76ae239f4d84e4e160d78fbc1702e19ea441f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695974375, "uuid": "cd1f11f6-8963-48cd-8312-30e9dd50e228", "comment": "Malware payload (MysticStealer)", "value": "a9b95ccb0e796cd0f7aec03dcd094d5114db7eb0d923902798d1feda00272811f7e0bd1c15f926381549741e9eb194c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974375, "uuid": "bdcebae5-e287-4251-a073-1480c962c9d1", "value": "T135259D227888B376DDE310B743ACB72649EDD4F40B125ADF46D857EFC6605C23A32686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974375, "uuid": "1773f646-8764-41b7-a74f-a42e9be1c0f9", "value": "d215e7ae5c8053185b6f0c1eed2c8e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974375, "uuid": "2ee5ffb1-c0fe-4b5d-8938-84088ecdd6ad", "value": "24576:KSuYDKzcx9jkmPe/knxyD2rhLpEzGGq0dfDonBEUJVp9:Khcx9jkmPBxe2VVEzdq0dfDonBEUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695974375, "uuid": "a568365c-4eb5-4155-be8d-1b05b8dc8f37", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695974375, "uuid": "03b73ac4-e576-4567-aab8-fbe9d4398afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695974375, "uuid": "9acfe82b-48bb-49bb-8222-70a455819902", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbb5125-5f1b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696028244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028244, "uuid": "f0c52058-3d7e-402d-82b2-d53f38d78b46", "comment": "Malware payload (RedLineStealer)", "value": "635370798a6961b1831acf192edcff94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028244, "uuid": "7983b96c-4bc1-4f87-b5da-f91bf141e994", "comment": "Malware payload (RedLineStealer)", "value": "b9c551967d6dadb2930e3044e93bfa1a9b8fd43e596969d90cbbac0e7396f760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028244, "uuid": "911978d4-80d3-4c97-ae78-e258c4ccc5d9", "comment": "Malware payload (RedLineStealer)", "value": "5f0f672182b5386e3f3061afcd10022004153e52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028244, "uuid": "de7d474b-5aec-4bbc-9ab7-37d5bf7a7e6c", "comment": "Malware payload (RedLineStealer)", "value": "5a14fd503c9a24f2df50442ef92a9ef9fe8ba50cef26908de216c5c7d4f3646bbbc38a2ffcba09ca0bbeade31e3cbed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028244, "uuid": "3642201c-ef75-4faa-815e-18bd92fd72f0", "value": "T133349E1A52B2BC61D52746328E2ECBE43B3FB4615F756F6B2B086F6F18701A1D263701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028244, "uuid": "0cb60531-d855-4344-a821-aba3ec431ed4", "value": "18690df0ed1be01972dcb3dc78c42692", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028244, "uuid": "da03803f-e9fd-4cc5-9da5-ebb07a576402", "value": "3072:RXrxotx7/U3Pr586OlwHf8vR373OFGYy/dAZg52BoVFQYTq:1yt5Ufr1LG3O0Y6yyVuYTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696028244, "uuid": "e9aa7294-2577-4ae5-9f3e-9569bd376726", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696028244, "uuid": "e66c836f-2677-4fd7-81dd-310d8e70e24c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028244, "uuid": "62c1390a-7e05-4e2c-a778-03f8a928aa11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799c7e77-5ea3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1695976670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976670, "uuid": "429158b4-ab31-452b-97f4-fbea67aa6ba6", "comment": "Malware payload (WSHRAT)", "value": "b6de2a88ddd8a054aa19818d7f0f7e5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976670, "uuid": "ffcd2206-8cc9-442e-ac65-d55c773fc403", "comment": "Malware payload (WSHRAT)", "value": "ba1a738798423e40a68ace116d390c7aca541a4b6472c9139ab27d4af38710b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976670, "uuid": "f69818c5-0dd9-42ad-b458-bb9ecd1fc034", "comment": "Malware payload (WSHRAT)", "value": "26157de03c6c6c50b57f553a925e263064c101d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976670, "uuid": "db1f92bf-c7ca-4a71-9119-e5d3c6f75e85", "comment": "Malware payload (WSHRAT)", "value": "be9f75c2771ebb55dd1551293c6b58cf276b6ab97c8f66fecc5c065cc80aa9e1613fac5d595bdebc4002570750961f1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976670, "uuid": "70925ba9-fc8f-4b04-853d-366c38782827", "value": "T1D0A5331073F2C473C8E2017448E9C67A1B66297847BAC1D7FBAD06756F212E1A7362DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976670, "uuid": "40592d4a-751e-4711-8933-49e47eafec18", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976670, "uuid": "d82da28e-a45d-48ad-a6d9-783f83c7fe32", "value": "49152:PkQTAhZM75sl9vhRFsmtkljB6chL58q/mJzhc+EbmOZt:PaLMVsPfFntkljB646q/mJmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695976670, "uuid": "deddf211-b564-4164-a695-a74b1c39ea5a", "value": 2247680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695976670, "uuid": "d4ebf3be-e9fe-410f-ab58-e768304cde4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976670, "uuid": "975bded6-ace2-42ae-834c-8bdb4e1ad1ba", "value": "b6de2a88ddd8a054aa19818d7f0f7e5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176d0197-5ec5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991108, "uuid": "8c47712a-a804-4605-81ab-594edea8891c", "comment": "Malware payload (Mirai)", "value": "9e51dbb3a848a5d302043b402335d3c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991108, "uuid": "b2724e8f-6687-497a-a9c7-c125b2f67582", "comment": "Malware payload (Mirai)", "value": "ba1ba6766677b9e33a94159679a1ae223780014ccba5c364cb46cfc85f9f48d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991108, "uuid": "5de790d6-e74a-4556-900e-43417ea7dd5f", "comment": "Malware payload (Mirai)", "value": "249d98d6101cd84c36c30221da569a983a151c44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991108, "uuid": "016ef9df-a765-45b4-8338-fda81aff6a80", "comment": "Malware payload (Mirai)", "value": "0ad8af4d43768b0956d1a699e0c6ea0a01bbe70923175863f801a550471b7efa3f85dba986ffa0747419538816f78dc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991108, "uuid": "cde21fd5-28b1-4a83-b065-3d01dc4aa92a", "value": "T191538D75D12DEEA8C0424AB4A9598E704F13A0C046733EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991108, "uuid": "2ded0c11-6f3d-40ae-ada7-d995f26d4672", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991108, "uuid": "177580ed-fc33-44a5-a9ed-995d6d85db8e", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991108, "uuid": "eec6bfbd-498a-4435-a57f-d9464cfb88ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991108, "uuid": "fd6017d6-7664-4775-92a2-154b2cae7433", "value": "9e51dbb3a848a5d302043b402335d3c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba9f500-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696010228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010228, "uuid": "fd5b9416-9e7b-4445-a762-469e0dc354cb", "comment": "Malware payload (Mirai)", "value": "7ceb8102535c2ef99a2e7a573b65befd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010228, "uuid": "7e75f96d-70ce-4fe6-91bc-9d34ff65f76a", "comment": "Malware payload (Mirai)", "value": "ba3540cb73ea4aec7cbba08aa58d6aa35f126b5fdd761c9ce499a91ccd20576f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010228, "uuid": "3da6e8ce-5dc0-46d4-840f-aa897bb6d73d", "comment": "Malware payload (Mirai)", "value": "1d05acc5f689532f32d7c794aa3c58a90d170a39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010228, "uuid": "8477f83d-4bbd-45bc-9753-3d1740ef5cac", "comment": "Malware payload (Mirai)", "value": "87b5569265d9cf0539928ca238dbec2090bf06e33339ca69659270279542d88438ede102c5556b78b297ac915bc4b666", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010228, "uuid": "00aaec27-6923-4245-892c-88fcf9509093", "value": "T169430655BC829A12C5E062B7FB5E818D332523B8D2DF7203DD212F51779A81F0EABA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010228, "uuid": "0e07ea22-cafb-402a-a503-9354c0b7635b", "value": "1536:VDsh+CUBvR01K0UOo7uPhlQt5HOveJJln:VDshUy5PUbHhJJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010228, "uuid": "22cbe1ca-1a92-4189-b149-68a6624475b1", "value": 57124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010228, "uuid": "0c397aa0-8b34-47ef-bf31-3b453b5ca1ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010228, "uuid": "89cee83e-cfe7-42bc-9c60-d3fb538353ea", "value": "7ceb8102535c2ef99a2e7a573b65befd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbdbe402-5f17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696026657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026657, "uuid": "03691579-0aba-4cb4-a20d-7b10a69714b6", "comment": "Malware payload (RedLineStealer)", "value": "62924b2b1fa6db0b7ab201faec3a33bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026657, "uuid": "75c8375a-bf80-4b73-91a6-640c79046264", "comment": "Malware payload (RedLineStealer)", "value": "ba70b9c690532d063c144b5d04100e7c8df0c4dc0ed1000dfa5a4feb741a444e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026657, "uuid": "d7a18648-88f6-4a80-868e-30b6e3edfbe6", "comment": "Malware payload (RedLineStealer)", "value": "c98fcc72a79fb5f2151051932ff6e654e662ea00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026657, "uuid": "0a5a5a6d-c781-4e01-9871-56ab307f63fd", "comment": "Malware payload (RedLineStealer)", "value": "beaf7f2d91360d862747f13eb5822ba06dc831baf165bc413dc94528a4ee1ebb991a9ddb2faa74309886763a15a2c5b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026657, "uuid": "c7d631b5-5def-4ac6-98bb-324789f0f4d9", "value": "T1FC34AF11B5D1C472DC7225360AE4DBF95A3EB830CD925EAF67E40F7E8F30281D621A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026657, "uuid": "7e5116ce-e7f2-4fa8-a986-9b1978cd79fe", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026657, "uuid": "f6ff953b-8560-43fb-825f-193eb3f1994c", "value": "6144:pcz4SHy5uoBMFGV5PEkIXEHvZAORghVs0BC+:9CmuoBMUOMxsDs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696026657, "uuid": "4927b098-3fd3-46fe-ba88-db13b14cddf5", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696026657, "uuid": "2d599ddd-ab8f-4223-b6d5-0267812a6292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026657, "uuid": "d3948792-a513-4903-822d-a8410242a7c3", "value": "SecuriteInfo.com.Trojan.Inject4.61510.25072.18479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b1a21f-5f19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696027532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027532, "uuid": "da5a9283-42ec-49bc-96ff-8c0df38b276e", "comment": "Malware payload (RedLineStealer)", "value": "3d494f1267b7a2635dcd88157caa0864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027532, "uuid": "3183372f-a34c-4e14-b0dc-dc530c362c04", "comment": "Malware payload (RedLineStealer)", "value": "ba72dd23776813767bf4ba2a34da6a8093cc84e9e72dbfc6bcdaa0e10448549f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027532, "uuid": "a9a8d2f4-b1f8-44a1-a721-20dcd04ac7fa", "comment": "Malware payload (RedLineStealer)", "value": "2906ecae62870e7b435c6bff1d431e3e268115d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027532, "uuid": "ba3686b9-de49-4484-a029-2139b7037b22", "comment": "Malware payload (RedLineStealer)", "value": "941576d81784701b71f99608ddca6e46be5176a62e76a3d5bf19671715faa35021fe9d926a443c476f4b6ee845beee03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027532, "uuid": "90bd9556-4b51-4596-a79a-6b1b4bda00b1", "value": "T1F7352312A7DDC463D9B657306CEA0BD70F377DA089A0967B3385BC496C72A90B930336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027532, "uuid": "2f4863df-c0f9-498a-a4e7-ffe0771563c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027532, "uuid": "dceb765d-42d7-426e-9a70-80d33f1f9f8b", "value": "24576:byhSj8AKhB4JjluLNPCiVlQnhmB/vZ3NpxF:OhSjLEB4JjoLN6iVCkRvZ3Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696027532, "uuid": "c61d05e8-3ab0-4f23-a5c4-4c29f6a5d322", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696027532, "uuid": "b58cbe37-e1ed-427f-a01e-3f1a657ae62c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027532, "uuid": "0276c36e-6931-4424-8237-16e3ffa04f44", "value": "3d494f1267b7a2635dcd88157caa0864.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d7cc5b-5ef8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696013055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013055, "uuid": "9a7859ab-e06e-45cd-9b4d-688e2d52a36f", "comment": "Malware payload", "value": "8088aba2e188d9b84ebf5a3b652dd4cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013055, "uuid": "1e186896-8d85-48ca-95f3-e96841783eb4", "comment": "Malware payload", "value": "bb8fe4694e32e961db930b73d43c5d3afe3169b8394b6e04a5fe53e8f6238beb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013055, "uuid": "470b1877-bc64-4b91-bf7a-86f96f50a2ad", "comment": "Malware payload", "value": "70987a6596826aef8c90cb5007f58016a97e8aef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013055, "uuid": "6ee526db-0181-454f-a034-b323dc0231a1", "comment": "Malware payload", "value": "3815fa9e3edd65384ec957b407e09c01109eb1876a7e829d5fb1f38010af3b2ce51e8044cef8fb26355e86e83e525e30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013055, "uuid": "49f05844-f05f-4a20-9386-d2274c9887f5", "value": "T11715225BBBDC90A6EDB52B7048FA03830B357DA19D3495EB27049D5F0DB2AC0A631727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013055, "uuid": "153e9545-c6bd-492d-8e10-33a3aa0c7414", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013055, "uuid": "8173e399-819a-4521-ab7a-b2d1435fb004", "value": "12288:0Mr4y90ClBFwnijyBzJLoZul+mjf/G96UB+Nde4LrMTgWLponH+vmSBDE/+jpqZx:cytBnjILxcwf46NH3nCzZj+sQrweL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696013055, "uuid": "57bb03a8-416e-43aa-b043-b31ad21a7598", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696013055, "uuid": "418c81bd-a167-4c5e-8778-d1da3d89eae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013055, "uuid": "3de0a0db-4237-4784-9240-d83feaaad395", "value": "8088aba2e188d9b84ebf5a3b652dd4cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22919a05-5ea7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695978242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978242, "uuid": "d0d37955-1211-44bf-a20e-634682c15660", "comment": "Malware payload (AgentTesla)", "value": "edc935526d07358e31cee5b17ab1d38d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978242, "uuid": "4c4b810e-5a83-438b-9dc3-cdca25a22a02", "comment": "Malware payload (AgentTesla)", "value": "bb934c8c993b5a096efb22396b82147369fa8ef44fc2da09089e590881e8c60e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978242, "uuid": "4355cf0b-aef3-4f78-bfaa-1d2b0ea3e263", "comment": "Malware payload (AgentTesla)", "value": "dcacff9a7ece7ddff062a7aee4b13a8f31c49883", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978242, "uuid": "ad41cbe2-85ba-4ad8-a134-56295791e7f5", "comment": "Malware payload (AgentTesla)", "value": "68e41aa7f28657ff3d2b4dcf32dfce35a5dc922acff67eacf939cdae124edb8aa096e457277aa145ee6f8995ae480591", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978242, "uuid": "00a97cf7-ce6e-4c8d-a6f4-50e4dcd05589", "value": "T1E1D4221874D04732EE8E47765B9C01670334B951AAA5D771CACB33EE3D3A3C665A2F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978242, "uuid": "52a25aab-ae9c-4565-93f7-4302451a11bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978242, "uuid": "98218df1-0d0d-4c77-a87b-aa2fb26387ce", "value": "12288:v725UJwCX4WItRhq+H2tshgVYAInBJ81dkpe52PRN4:KmfItR0cqshvtRe5ARN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978242, "uuid": "d0603373-9d62-475a-914a-4cc784056d47", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978242, "uuid": "f9b88318-b987-49f5-a3f7-47523a3ff1f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978242, "uuid": "492bb717-9ff8-460b-aab2-748136db377e", "value": "AWB0008897.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49da65c-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991023, "uuid": "f1d9da96-84c9-4af8-a70b-3bd1a50776cf", "comment": "Malware payload (Mirai)", "value": "f0b0063d2109ecbb9d3e7625a07bb98f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991023, "uuid": "0c208229-2fd9-4007-89c8-fb637a293dd3", "comment": "Malware payload (Mirai)", "value": "bbeb95f1b42ccf03d64000de654af311b4cb8322320d6e778727a411d4e8f34b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991023, "uuid": "9d8422c4-29ea-4619-8024-554399fd07e4", "comment": "Malware payload (Mirai)", "value": "f6845b6d78c70fcc844cef4a3c34b98118ef06dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991023, "uuid": "c2363e1a-def6-42b8-a575-77a39aa7a358", "comment": "Malware payload (Mirai)", "value": "1657f7cbdd38efa02c5d2085d343b7b859b67f5881370669a1c7390790e1f9b981388ae094807b001d34d5e2dfeb59fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991023, "uuid": "624fb66c-87a3-41cf-8c5b-eacb9833bb25", "value": "T1F5A2DF0835CDE972D170943AE23CC347EEDB83B652FE316A1E180B9CE49191AD3BD945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991023, "uuid": "dca94703-edbd-4406-ba65-ea758351a99c", "value": "384:Yamog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbShymdGUop5hXY:YToh/DxCvhdR4IjWVFbSes3UozJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991023, "uuid": "b2512497-c0e9-40d1-95c6-1c275e5c6977", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991023, "uuid": "df6e11fe-7ef5-4410-8c4e-3fea5841f037", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991023, "uuid": "5d4e77ff-9a03-4930-8458-f7514332a217", "value": "f0b0063d2109ecbb9d3e7625a07bb98f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce61457-5ea3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695976730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976730, "uuid": "7c444277-c466-482c-878b-659d486fc75f", "comment": "Malware payload (RedLineStealer)", "value": "53df0c8b56120e03e1657e366720ecd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976730, "uuid": "7ee15473-67a8-4d28-92ed-ad490e309c60", "comment": "Malware payload (RedLineStealer)", "value": "bc3a7ba547b8a0f5cc6be6748eb9fa06ae2d09ca4b3c158add5e4868197c72ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976730, "uuid": "924c30b0-7ee6-47fd-9913-9aa144feaf56", "comment": "Malware payload (RedLineStealer)", "value": "a09ccc5dfa35fe46f1203e5e95c3025ff2f0930d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695976730, "uuid": "b2b81bce-de65-4726-a686-e25320d6ef78", "comment": "Malware payload (RedLineStealer)", "value": "171b7416a93b5d9fd463fc837a702089b9c58405eee298de84990dd71fe94c658323c2f4c2c419a525006a930a9f76f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976730, "uuid": "e46e370b-981c-41a4-8f7b-13fa4cea98fe", "value": "T1087429D03384B9CDCC4F8EF561619764CA70D842A297BB537C8BA8F7385E349AE055E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976730, "uuid": "3bffd788-4a81-4f4e-8702-c496f91f7ac2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976730, "uuid": "1406222a-ab73-42cd-a27c-8315886bcd63", "value": "6144:wK9qRwxCuO41LC9Xt/bqPDo5gXJKbp2ON1a/Ti:xqWnO41X058JKbp2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695976730, "uuid": "c8a5754d-f87d-4c34-bdb1-cf86b7659df8", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695976730, "uuid": "b5f56821-e35e-42ef-b211-181aab7adf7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695976730, "uuid": "e0e0fe4d-ab23-4e15-b564-8ea7d21703ba", "value": "53df0c8b56120e03e1657e366720ecd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0098c557-5e94-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695970025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970025, "uuid": "cffc00c7-27c3-49c3-b8ca-60fbbd19893d", "comment": "Malware payload (Formbook)", "value": "45ee0796819451c310a4652b2f4c9e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970025, "uuid": "108f3d72-1b84-405b-9ec6-07d7aac08855", "comment": "Malware payload (Formbook)", "value": "bc890782390a43bb02de2a7f6d6bbc1f05cceed4e6277f3f36719edb14cb5067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970025, "uuid": "b8e05982-0eea-47d6-ab0a-a18cc09e7be1", "comment": "Malware payload (Formbook)", "value": "0fea82ff3ce07f31c5e785b58b6a1aee43d8778f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970025, "uuid": "401fb67c-0c39-4a44-8af7-ca468072b197", "comment": "Malware payload (Formbook)", "value": "a9bbeb9f41c43feb6ef74424e2abfa4f7e564952c41c1f74b6f68652b3d0305cbbc984f5e4452a7d7f7eb5284deaeb13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970025, "uuid": "706b7404-7d83-46e2-bf07-589b7c869c8a", "value": "T14F8423A17634CE97ECB34A370E3F9A1246F36C6492749B0F2390B66D3EA7381542E614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970025, "uuid": "5783bfb4-6b10-45bb-be24-d59ec5345226", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970025, "uuid": "f08049f0-fe01-4e69-9a40-aba27c34e205", "value": "12288:LnPdvKRsZayz+O73iyx48RAgaPF5dkg3FM:TPdvQsZvf48Q1kg3FM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695970025, "uuid": "79100738-3fe3-4b27-b598-0bf49383e5ef", "value": 393447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695970025, "uuid": "804f7749-6294-4455-a83c-388c161189c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970025, "uuid": "06e08fc1-2636-48d9-a6d1-14e166dd845e", "value": "RFQINVOICE09876000090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d88bef-5ef8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696013044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013044, "uuid": "0289f579-1d5e-4fd9-b63e-9733162305b9", "comment": "Malware payload (Mirai)", "value": "596267d9e26061fe2e6c7c82beb43c4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013044, "uuid": "fb85e9e4-2cc9-4e07-8739-c9cc4ff52860", "comment": "Malware payload (Mirai)", "value": "bc9a2a8bf60b5efab4458e4f0081731a6d72640fb039cc992023bd2d4eef7405", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013044, "uuid": "9421c5c5-d790-402c-8c2e-5711dec3953a", "comment": "Malware payload (Mirai)", "value": "c338de47b080ba27b1bdb94de227f5fff39cd785", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013044, "uuid": "00c7b1e1-25fd-4159-8344-7ac17b3dd9fc", "comment": "Malware payload (Mirai)", "value": "c0bd6b2fe955e00387fc07ca0210fd2dd0905209126072032907697e508c7d080cae90a4f5a4c093bf8eec0f079661cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013044, "uuid": "ef2bc526-cb63-44b2-acd9-4503a55ebc31", "value": "T141E30855BC518B23C6D622BBFB5E428D37261768D3EE72039D256F20378B95B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013044, "uuid": "913fa55d-fd68-49d9-b48e-3d908527b3e3", "value": "1536:BXdhulHtHltpw5neMZMlUUs0TUmF6AW5F4VJpa2Tj5NeW3ia0jXVupz/lXVwywm1:BXdhurMZuxT/F6Z4RPP5NeWKVeYyRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696013044, "uuid": "8bfd239b-903a-422b-a0ae-92f797064070", "value": 149900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696013044, "uuid": "a5b6e397-5918-4faf-8e53-dfb0f49da944", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013044, "uuid": "f7b4887d-32c7-48a6-aeee-5c79a010a9c2", "value": "596267d9e26061fe2e6c7c82beb43c4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93155b95-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986591, "uuid": "3980e48a-6538-43a4-af41-a160aa410763", "comment": "Malware payload (Mirai)", "value": "7e034be6deb0d7afb075c45741722b1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986591, "uuid": "f5f6ccba-c518-4b71-bd88-d66045a63631", "comment": "Malware payload (Mirai)", "value": "bd6702854ebbf0538fa176bcb178903439ddff8ff487fdf1b36864ead3fed662", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986591, "uuid": "7a581a2e-8f9a-472c-b666-49d0c044e13b", "comment": "Malware payload (Mirai)", "value": "b06d067303dad275b32f4f94e6ef17c869f10b90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986591, "uuid": "6a353a2d-98c3-487f-93c7-6d7bc795ee70", "comment": "Malware payload (Mirai)", "value": "79cea26c046e261ff92c863e22af955071f07e9ce783eb111ea2e3f9081925dcc472ddcc6ce3e157d0114e87a4663648", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986591, "uuid": "748f703a-3ba2-4156-9d73-1a54b70305ce", "value": "T126733A5AF8919B22D5C116BAFE0E124E331317ACE3DE73139D24AB6477CB56B0E3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986591, "uuid": "c930f917-5288-4c8a-b599-888235ee1d5c", "value": "1536:qunuih6vakv8c+VsoBWl7mhganb9QcMriyGj/S/7vQjp5UYUCwN:11kv8c+VsoBEZacK/S/7vQjpKAwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986591, "uuid": "4b22655c-7be3-440f-8700-a5c966792af8", "value": 75032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986591, "uuid": "28db6d31-e47d-44f0-8dc1-4fabcef8dad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986591, "uuid": "7c8e7429-7d85-42dd-932e-a4e0618195cd", "value": "7e034be6deb0d7afb075c45741722b1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0496062b-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695990647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990647, "uuid": "5827688b-81dc-4192-813b-180e4aaea100", "comment": "Malware payload (Smoke Loader)", "value": "f9444be586b2174b539b61c929239bda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990647, "uuid": "a305cb5d-ae81-40d1-97a2-9175bc5d9202", "comment": "Malware payload (Smoke Loader)", "value": "bdaa2358b01ed8b195f03ab82bb52c2c32ad3bdf11caf665ee3956dcfc35faf8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990647, "uuid": "d90e6485-dbfa-4906-b284-a4fa427d269a", "comment": "Malware payload (Smoke Loader)", "value": "2db01f4e1ae710b83fe84c57e583d3bf99118f8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990647, "uuid": "b052850c-c221-4ab1-86b6-06907919429c", "comment": "Malware payload (Smoke Loader)", "value": "d4543bb12f751e2c098adde863c2007602d1c04c72e021773d203a35b96d3901e7d37a04f027ab7e96e245e36fe9c209", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990647, "uuid": "1070eab4-18b8-4f45-8f36-aa607f5e9333", "value": "T1B934AE1262E1BC63E9678A31CE2EC6E4767FB5714E5D276BB3185B1F08701B2C2A7311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990647, "uuid": "75e76023-a28d-47a9-8c83-933421b750f7", "value": "da3059b9961b3b780343599f0bc04a8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990647, "uuid": "0b46525a-4894-4d85-932a-0057afde0a0e", "value": "3072:nXj3PBmPO0rWHyDZdbX352Dqq5w3YPADU4IzHU35mGoupDz1TKskt:XNmPWHWdb5LKwg4SHDGpDhTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695990647, "uuid": "c76011f4-715a-4565-99ad-a99c155292ee", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695990647, "uuid": "0a210c7c-0080-46b0-89b8-c5debc8e4528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990647, "uuid": "0d0e0d58-8c60-453d-aa28-b077b650d476", "value": "f9444be586b2174b539b61c929239bda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efeb1c34-5e9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695975151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695975151, "uuid": "08d38baa-9ab8-4adf-a897-0428418f0dca", "comment": "Malware payload (AgentTesla)", "value": "0110034c3a13e96317d374e3eceddf44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695975151, "uuid": "1bb2b227-3ed1-4d7b-8c8c-cc0b89204dc2", "comment": "Malware payload (AgentTesla)", "value": "bdd586a33bfd9b732e20e49628e827a510a322f3a9df7edee7d8e631c510611a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695975151, "uuid": "d64447a9-eb76-459b-9f76-b92fa9dcc2b6", "comment": "Malware payload (AgentTesla)", "value": "67f631c83a5edb57cc1719dded70585b7b6392bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695975151, "uuid": "124ff460-55f2-4c33-8eae-e4b5bcec83cc", "comment": "Malware payload (AgentTesla)", "value": "828f82767f8b18257be72326f0928c39094844062206785dc8210a7745e43299d0c93dadadccbe6b78c40eca15dfd9f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695975151, "uuid": "17f76a33-dfd7-41b0-b49a-509ea745dffd", "value": "T1C5A3F26ED78E0269CF520373AB1A0E9496BDB73EF35251B1345C937433AD82D42662BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695975151, "uuid": "ebd0dd15-a04d-4500-83dd-42cda5a09352", "value": "768:iC7Wq0BiIsxPpwkWfYjugztCUlkXba1C/9wZdEHPigencKCCe1OK/:iC6q0BnpP4ugzxEigeVewW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695975151, "uuid": "3226281f-678e-409f-892e-6f0d92a6fd1d", "value": 101468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695975151, "uuid": "db88a098-d95a-47dd-8468-4c5e7391257f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695975151, "uuid": "d2e36845-ef7d-486f-b349-9c3d045460d8", "value": "Item list.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a86dcb3-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695986872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986872, "uuid": "42111532-db6e-4e06-8807-6b7a32318cc4", "comment": "Malware payload (RedLineStealer)", "value": "cb88e686512d79c8768142d424d30686", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986872, "uuid": "d2651b68-caac-496d-ab69-bf81aff92ec9", "comment": "Malware payload (RedLineStealer)", "value": "bdd8bc8cc85047d7ea0a4086a3fcfc1bd9f2f98794d50be234249b1a7e8ee1a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986872, "uuid": "a53fcd38-c3c0-442a-b30b-6d638f850a28", "comment": "Malware payload (RedLineStealer)", "value": "92acba766cb1d84f5b8ab3740d1ecafbd54e4248", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986872, "uuid": "f4ec1ed4-84d1-43e1-a18a-de0be9b842de", "comment": "Malware payload (RedLineStealer)", "value": "bf3a7087eae646f57cc5a09c28615667818625cff8d9336153b1882f9e9a8857f367804937a0787a5cade545f69d778f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986872, "uuid": "d0becc13-73a9-4d86-be2c-eb03024da886", "value": "T1A844BF2171C1C1B3C4B7113048DACB754A7A346557BA92DBB7DC2BAA5E213E1A3362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986872, "uuid": "8069cf59-b5d2-471a-9baa-daded2228884", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986872, "uuid": "a971daea-9b5c-4c7e-af6d-04fa92cf9565", "value": "6144:uDKW1Lgbdl0TBBvjc/wfFUSaFl2996V7q1e:oh1Lk70Tnvjc0UnKcV7q1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986872, "uuid": "a1a7678b-5a90-4e8a-bad5-a5f41eac3611", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986872, "uuid": "a9e3eb4c-b2d3-4be3-9f7d-7d11137ad142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986872, "uuid": "c9c61fd5-f9bf-45b6-b894-8b71fbda4bfc", "value": "Fiyat teklifi Istegi_23_PER 1000 Adet \u2026scanneed 00101.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ed9939-5eb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1695982412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982412, "uuid": "f2842ba0-4bd5-4555-959b-3e2bfd780036", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "fafb97013d7e5fad3a263a8e761994d5", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982412, "uuid": "061bcc5e-94d2-47d3-828d-332d0e4d773c", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "bde55f4d4688d9e3bf30365ddd59204afd1f12ce6a82c93c9817e6ca1eb2fe9a", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982412, "uuid": "df05c154-c3a6-41e7-b8ed-ea2b57e184ac", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f65ed74ea1c6f5d2c654b301267684be3d54a9ea", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982412, "uuid": "6168921e-8c4a-449b-8f0f-10586ba0ff96", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9943e222cbbfb1110fce8e1776eb9402ca4b08307df505a7433a7c69ed01648d0876a2bdb884d236d1e8687d5d36376d", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982412, "uuid": "a2ea8e9f-b1ca-44a4-a58c-9f738f66f159", "value": "T1AC34AE0362E2BC70E92786318D2EC6E4767FB5728F69676B33185E2F18711B2D263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982412, "uuid": "84b5fb20-e6d0-44c6-920b-c5c59f630e91", "value": "2a568f33595a0107732fea57be00f8ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982412, "uuid": "2621bad7-ad38-4abd-8267-59c77daab9ba", "value": "3072:gXr37MMK2I4+LgkI5MEfpA9VPpRR8SuAqYRG9u+85W5BypDz1TKsktPo:UO2ULJIKERA9VvR8lmG9nHypDhTc1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695982412, "uuid": "530b98d4-8218-485a-acff-82e1ad9b0a25", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695982412, "uuid": "9b7a1027-8cb3-40f2-af15-663931f345bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982412, "uuid": "0aee2891-6dac-4bba-a41f-91ff8ff8d327", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a966af-5ed6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695998383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998383, "uuid": "5d2149b8-a72b-4399-ab42-31ec3f1a5fc6", "comment": "Malware payload (MysticStealer)", "value": "4b047b18ffbbd57f2ccee47cc5fc7dc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998383, "uuid": "75ebafe0-2c85-4b71-a91e-fb172e111577", "comment": "Malware payload (MysticStealer)", "value": "bef70f88a58b45ede2bcdd53b5f00445f4fa003862de40d6d6ab2a3e72241936", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998383, "uuid": "10ee1ce5-bf74-407b-8f95-82c6dfa2bdba", "comment": "Malware payload (MysticStealer)", "value": "5cff51e39c5d769b77d22b873dfcf377c91f30c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998383, "uuid": "b58f3d6f-d421-4e2b-b595-acfeb576a7dd", "comment": "Malware payload (MysticStealer)", "value": "2475615538b38e2a5edf0bdfaea66a44e837ee122dd900d32dacde758c09461625b383adab4ba5f01e13d0980b2e64b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998383, "uuid": "025aceb9-d2b0-4899-b979-0db65f863976", "value": "T1AE74BF60B68180B1CF76253746D4FBE76739B8700D258E9F23F20F2E9EDC5809556AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998383, "uuid": "eee9b065-83d0-48d3-a656-e22cba4197a0", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998383, "uuid": "63a0bab4-08a9-4329-9411-716887301e3c", "value": "6144:D1TeW/s5GqrO5aXnfEGIXWPvZAODymg89q3CJhmSVs0BC+:QmcGqrOk86xfg4Jhbs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695998383, "uuid": "51af78d5-4e18-4504-b75a-0c0ead6866f0", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695998383, "uuid": "3a86e929-25b9-4bd8-9cd6-e8189953a15c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998383, "uuid": "199c930c-4d3a-4e06-9a5b-d216e2e32fa9", "value": "4b047b18ffbbd57f2ccee47cc5fc7dc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb0b66e-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986638, "uuid": "a48d99eb-6ace-48e8-a776-5ef9428daa08", "comment": "Malware payload (Mirai)", "value": "01f08e9f2d6f1002e83766599a3e3b89", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986638, "uuid": "7945443d-3500-46ff-874d-db08ba5c4474", "comment": "Malware payload (Mirai)", "value": "bffde3f890b79a4e93784e5b359607e5ce8175e87888441cc2228df12b4b7d9a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986638, "uuid": "72bd8a61-ac6d-4e94-b8ff-0945355e4070", "comment": "Malware payload (Mirai)", "value": "ac6b431b0c2d4655204a9c47cf8de66f3f704e88", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986638, "uuid": "e69683a7-71d2-4fb5-a6e2-5b66797a16d2", "comment": "Malware payload (Mirai)", "value": "51b3916865b23115ea38a140eec4db7478daf1239ab9993949adc299ea21bb030b68a7951d74f8b15254444cadfec43d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986638, "uuid": "5c827f5d-df4d-4800-9754-ff19b02c48b8", "value": "T153536D27A9D180FCC959D2B44A6EE237D8337CBD123AB86933C4BF2B2E5AD115F56500", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986638, "uuid": "bcd9a7aa-2e29-4b92-8c97-74ac7d53d606", "value": "768:PJ0Q+ihjl3WyRtG2dXl3j0CKNA91ebjgbk9g/+FK/WV4733HQrqJn3GkFUlNIZ:pBlVG8xoCK2MgANpV+nwrq3ylN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986638, "uuid": "170e8afb-29b5-4735-b095-57950005509d", "value": 63216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986638, "uuid": "1be01c7c-2113-4f70-841a-30905b2b956a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986638, "uuid": "9c5975d7-7d97-4f60-8b03-7ce11d6c8e94", "value": "01f08e9f2d6f1002e83766599a3e3b89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547c6935-5ed2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695996794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996794, "uuid": "b36d0bda-defd-42d2-aef1-38cec6bde913", "comment": "Malware payload", "value": "8845f214777ef623b05dfcebc11e9c0c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996794, "uuid": "6c0bc635-667a-4bc5-9228-17484d0b4db8", "comment": "Malware payload", "value": "c05436d148c0828fddcc94a1f57a5a640478d5ed4a83cf4e5747dd4cc146ec4c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996794, "uuid": "cd113aac-154f-4b56-b9bf-891724b45854", "comment": "Malware payload", "value": "dae35ea5a98323bc02112892851598820ea43f83", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996794, "uuid": "5fa1bd1d-68e3-4878-86d5-2f81a45eeb4b", "comment": "Malware payload", "value": "5b659978b5454e6038087da0b3c5e1e52dd15becf47a77920804b96ae7bfa3d2f09f57ce51fc9899fcdde986f8067520", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996794, "uuid": "20a76d2f-619d-4e6e-b22a-7fa212a6d469", "value": "T1CF16187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996794, "uuid": "97e7b4e8-782b-4240-ad0f-1cb44c6c7059", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996794, "uuid": "630b09c9-d713-4a07-927e-01c2bf23d0cb", "value": "49152:ogh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWxjXNO:Wa71fhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695996794, "uuid": "a1af5f16-4e10-44ae-a455-77b6adb6536c", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695996794, "uuid": "2dcf5ef5-9eac-4219-9a31-425d6282bd33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996794, "uuid": "ce69ed72-2ea1-4ca1-9443-00684a32ca9a", "value": "8845f214777ef623b05dfcebc11e9c0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc33edf-5ef7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696012812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012812, "uuid": "bcb4d7e0-5ced-4a97-9f25-d4463e565794", "comment": "Malware payload (Amadey)", "value": "8d34dc7baa81178fc9cfee8452f7c9c0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012812, "uuid": "fe35e172-6d32-4940-90d1-7c1303056297", "comment": "Malware payload (Amadey)", "value": "c2184bcf42df553668824a2fe3e491847b330b58b62d2c8a61f3bbde59de7c61", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012812, "uuid": "16978943-a000-4cf0-8015-dfc41e245862", "comment": "Malware payload (Amadey)", "value": "3cf64588ffb2abeaae573393a7dd0aab15e2644c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012812, "uuid": "88a399cc-ed9d-499c-8bca-1cd8616c8e67", "comment": "Malware payload (Amadey)", "value": "66645f7fb7e90f0718ec18fd269977d4b3d20844bd32e2e4a48c63ade4b268303414237745f93bde8064bb64c0bd25ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012812, "uuid": "81a394ce-a07b-415b-8969-318156d2d956", "value": "T12634BF11B4E2C072DC7215360AE4DBB95A3DB93009A25EAF67E40F7E8F306C1D635A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012812, "uuid": "d3357bae-1af0-4243-972d-6666f869226d", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012812, "uuid": "ddac2301-34e2-410e-9ec3-89b9889224d0", "value": "6144:Spz4SHy5uoBMFGV5PEkIXEHvZAO4mh0+Vs0BC+:RCmuoBMUOMx/Ps0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696012812, "uuid": "149da7c4-115c-487b-a011-0a4565edb6c4", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696012812, "uuid": "2d36978f-5035-4d52-a2af-31d410ea5550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012812, "uuid": "f2f9da1a-f472-41de-a0fb-f1a11285e959", "value": "8d34dc7baa81178fc9cfee8452f7c9c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa07f40c-5e5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1695946391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695946391, "uuid": "03569f9f-5239-40d4-a6ed-66edd23727c0", "comment": "Malware payload (RecordBreaker)", "value": "530eacbba96bfd3009518dd25a2dadad", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695946391, "uuid": "e54101e4-de99-4a76-9200-bbe8873e26e7", "comment": "Malware payload (RecordBreaker)", "value": "c271f8ea7374546559a38dbffbb7835b515c4173b701397191e80ba6f1f21298", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695946391, "uuid": "353734e6-ab7f-4087-836a-630cb65acdfa", "comment": "Malware payload (RecordBreaker)", "value": "c6c13814ce651d34e5f0e4fddabe68dcba1f4b92", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695946391, "uuid": "154af7a5-9712-4265-b424-bbd287692f59", "comment": "Malware payload (RecordBreaker)", "value": "188d17d189eea4807da57629eaa1ea79cc6ecdc66d844ac05e3840d7b9bd337b9e55f2a8036fabcf708aaf7c87e63f5a", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695946391, "uuid": "d62113ac-2d69-41ed-bd77-2a7aa4453ba1", "value": "T1E7D633C2504BEDA7E90BDD37A0F655C1871460F2E2766870F7C5E78025AAAF0C0676BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695946391, "uuid": "4643eab6-2021-47a9-abaf-c38bc4e26ef6", "value": "196608:CuBhSzS/ko7Ss9AMClm+dV1hSUf3HOly8DTLWeEiLo8xV2qJqkPmhKVMt6XXA:C3fU7xg3d3OlyIHo8xV2q9Vdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695946391, "uuid": "246ec04c-8370-4627-8471-47d76658a97e", "value": 12892105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695946391, "uuid": "d5ea3b38-1b3e-4377-b54a-318b2fbd0ade", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695946391, "uuid": "02c867c3-902a-4d20-8f0f-82b858e1fa69", "value": "\u0421hr\u043em\u0435S\u0435tu\u0440.appx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508d43de-5eaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1695981755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981755, "uuid": "d7bc0c3a-1b81-498b-8b85-5fff9e67034c", "comment": "Malware payload (CoinMiner)", "value": "0fb9c9bad8a1e4c4edba170c6ee73fe8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981755, "uuid": "f95b067d-ff11-4e3e-9862-a0aca3d9496a", "comment": "Malware payload (CoinMiner)", "value": "c2935dcaaf0cf3da6b094666b4c5e4b24369a214bb4bcdcddfec8ea1f5841190", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981755, "uuid": "bb3ea9aa-1de8-422d-aa2a-646634fc55c4", "comment": "Malware payload (CoinMiner)", "value": "f005de5a8331dce97239a7341bd9aa30b28e4243", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981755, "uuid": "70949d05-242e-4766-9b7f-76c00ae1e84d", "comment": "Malware payload (CoinMiner)", "value": "93066e42e4816ab29e4f5c43f3ee1b1b9563d39bed812a47b19ce2ecc045c9e9b82af99618f6f2998f20325fae0b368e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981755, "uuid": "854052ac-909c-49cb-ae67-924cb6253ca3", "value": "T14F745990B1FD9DCADC82D5368E11EEA0DEE3973E2703D3518C4C91C5A47B196AAC3D92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981755, "uuid": "836cc087-c4d4-4bd3-a012-8224415b85d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981755, "uuid": "cc52a142-a673-4766-b3c0-371782d2faff", "value": "6144:B6qO2EpuNXrzB+gx9EypHxEMelBhKn2YfAsXwYZ/E3M1oYvH:BNkpuNXrN+gxiHMelbY4sXR/AjYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695981755, "uuid": "b269554d-9ccc-44a5-9438-4ef98dd4eab9", "value": 338808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695981755, "uuid": "74754e86-bb3b-456c-8465-eb260e237962", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981755, "uuid": "5d19af4a-af3f-4318-9b57-9aa577167c84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f04c65-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015935, "uuid": "56cb3f89-e216-4610-a8f1-c1dc1998bb65", "comment": "Malware payload (Mirai)", "value": "18a826721cd051d137b7d7318ad2e589", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015935, "uuid": "9932d7c8-7e0d-4b8b-ac75-8a4bf08f0eae", "comment": "Malware payload (Mirai)", "value": "c299db06008ba25b27cbcfc3b18f3388b5d846a0d47b6e303ef58af68f875eb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015935, "uuid": "9a10b30f-9a18-4f9c-a621-65ca30cafe37", "comment": "Malware payload (Mirai)", "value": "957fbee0db96ccd14c1bdf83900d42b03e437bea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015935, "uuid": "c3ccbc15-583a-44d7-8276-2727ddd80544", "comment": "Malware payload (Mirai)", "value": "bba7d88a95fe201bbb8f30b48489a66dea4423d3b3f5ed87a4ec2e344a77b23cc962244eb23f8f194aa7398e1d65cbc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015935, "uuid": "266ea28c-c20d-4bb1-9523-ad97ed48d309", "value": "T12DF33AC7F900DEFAF80AE33748530916B230B7A214925B377257756BEC7A198056BF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015935, "uuid": "3f32e1c1-66e6-49b5-9ca2-2dc17476c110", "value": "3072:Abfg1apHJRc1GZECh1jMfvID/f27/nyERK3olbEVfjbikLyJmaQyhHhJ:QDM8f+//qol0LyJkyhBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015935, "uuid": "29ce5c00-43ca-414b-8448-04a6f39588e7", "value": 167980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015935, "uuid": "b2568dad-e5a5-43ca-b27c-78710cbb4eb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015935, "uuid": "3539b822-0fa5-4806-982b-29e3e25785bc", "value": "18a826721cd051d137b7d7318ad2e589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d196b7-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696010272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010272, "uuid": "76331520-88e0-40c7-a55a-42652937ce6b", "comment": "Malware payload (MysticStealer)", "value": "f88ae5e97885d55ab39850d6bfdaadc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010272, "uuid": "39a0c044-9f66-45f3-b06f-4bad8eb04247", "comment": "Malware payload (MysticStealer)", "value": "c2b8b5bcfcc293ab8509513c69e4176c426f5c53d0ece5cfc9edf8cd27f85f00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010272, "uuid": "bdd05f4a-110e-4dd8-89d3-7ed99ddac8e6", "comment": "Malware payload (MysticStealer)", "value": "cd59e331977dd39e21dbae3abe9cbe75fe5da908", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010272, "uuid": "e224d799-39e8-4b5a-b5a6-b0e6bb1f9fde", "comment": "Malware payload (MysticStealer)", "value": "caea1e622aa08c429819189456932cc7b6a8a85b581fe746a2ebe374e767732c129c45999e0614e27c022991815b2f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010272, "uuid": "36857d53-98ce-469f-8af9-87e0f4175537", "value": "T13774BE6475C2C53FC9612079BED4F7BA5A3D786809812A7FA3F84FAE4F305C09251B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010272, "uuid": "d1344709-71c6-488c-92e1-08de20771558", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010272, "uuid": "8e2ac942-317e-4f26-92c0-24ee356d9d86", "value": "6144:jtTeW/s5GqrO5aXnfEGIXWPvZAOkywyu2vguuA3Yp9I4Id9N/Vs0BC+:omcGqrOk86x0y3YuuA3YrGXts0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010272, "uuid": "acccac0a-0d0c-4bca-a678-23d8a7daf4ab", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010272, "uuid": "b27cb686-6150-411e-ba3c-09dc0c90158d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010272, "uuid": "bf4a678d-ac1e-41fd-863f-392e7b0e60c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b309f172-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696010267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010267, "uuid": "c2d1f000-de23-4be9-8311-518ba5eae296", "comment": "Malware payload (Mirai)", "value": "e754ef3bf8772e54475dafd6926992eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010267, "uuid": "fbc6341e-28a4-47d1-adc7-f2a4aeb7b2ad", "comment": "Malware payload (Mirai)", "value": "c32fafb8f1b28f2f3d17beaee33e8749164213275fd44fa3678f52f20e4602cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010267, "uuid": "6c43cc7d-ece0-4e66-8b1f-015c9174de6c", "comment": "Malware payload (Mirai)", "value": "ba3f48d7f1044d4285b6a336d58d0e92d881a784", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010267, "uuid": "933370ad-398a-42ee-a66a-ac89591f0ed9", "comment": "Malware payload (Mirai)", "value": "cfe084599651d1284e98d1b2efafcc1e2dad24e5030385f7856bdbbc91c41b00b751a543b03f6b2e67ed8dc344bbee94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010267, "uuid": "68f777c9-e819-436d-a545-de3d13f6a370", "value": "T17A53B519BF610FB7EC6BCD3709A81B0538CC644A22A87B367934D468F60B25B59F3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010267, "uuid": "87577413-765e-4d46-9372-e3912f41bc06", "value": "768:iAVWeSUxEYGMmXsew5BheiTebiQ2ZFVyXiSA7mWzkCw:iAVWxs4twxjTIitZFVbmao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010267, "uuid": "2e282dad-ea4c-457d-90c3-0aaabf1fbfa6", "value": 61080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010267, "uuid": "5387523c-c118-4043-b7ac-8f0822b92b40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010267, "uuid": "f6d7c440-c7c0-4c56-b52d-be476c74995d", "value": "e754ef3bf8772e54475dafd6926992eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fdbcda1-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695977110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977110, "uuid": "da4ac946-bcf8-44a9-b833-bb39eb68eab4", "comment": "Malware payload (RedLineStealer)", "value": "b66d368590ed2013c1190be3de16e611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977110, "uuid": "eb9a858c-2d45-4cd6-9f67-fbdf0098a879", "comment": "Malware payload (RedLineStealer)", "value": "c4426a53689ff27b91450e8d549e50dca25cc0893fb369a5073187df030903c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977110, "uuid": "de31f154-096e-49c4-bebc-32d44481ea5f", "comment": "Malware payload (RedLineStealer)", "value": "951b19fa385a81987cde24eb60dda814b52598d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977110, "uuid": "cf004950-7429-4ff2-908c-cbbcf4153702", "comment": "Malware payload (RedLineStealer)", "value": "85991ba4cea400d40bf62ac4c446b2e0d78b20a3fbdd63a5f7d38b6d9ca0f67266e2e8d5e4f816b2f9ac0293a377452f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977110, "uuid": "be365d77-81db-4069-b65d-e36cdfe2fd9e", "value": "T10F44AE11B5E18432D472153209E4DBB65A3DFB704BA159EFA7E40F6E8F303C2A631E66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977110, "uuid": "44801331-3e20-4d14-97c9-454f32b78848", "value": "25da225cc3303495dec08a79bb284954", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977110, "uuid": "e660320e-9afa-4735-b497-e44fbd8a09c0", "value": "6144:weD2Lr/V90d2WxjV/hAO4BF/z+AqWoPGCV:wxLr/E7aBF/z6nGCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977110, "uuid": "705ba405-f0ab-4fee-b3c8-48fe1b0ee2f7", "value": 260472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977110, "uuid": "b3a61f41-2a45-4802-8490-fccf786d135b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977110, "uuid": "2128feef-e634-49e7-a958-426f3a65d157", "value": "b66d368590ed2013c1190be3de16e611.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4f70eb-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024297, "uuid": "7f9e7767-903f-4458-8854-4b3ce53e6e6b", "comment": "Malware payload", "value": "f54ba2d1fbcafd6e1929d7336128179f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024297, "uuid": "bb2aff69-7178-4583-8b5d-00ce747bf534", "comment": "Malware payload", "value": "c5aacfd6af55ef21d1186f0d4d4ae7ffe71c05fade961398d7291e1ce6e1b689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024297, "uuid": "21134d53-4830-4f7d-9e64-c8053768d15f", "comment": "Malware payload", "value": "4a07604edb6d14c62d0872a91d3518ffb2b40877", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024297, "uuid": "b0024d79-16a6-4510-a655-58a7cd164c3a", "comment": "Malware payload", "value": "5ccc772e5e12cf96db9eb7a253f23ed55976bbeaab417430cf7f55d2b658fceb06822b8572d48bd722749a2150059d83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024297, "uuid": "4c09b8ac-c9ce-4519-92d6-ee9fff9cf11d", "value": "T1403423CC74B6D3CC9227068B173B2B17F858393F07168C447A9EA5EF825F6915A093B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024297, "uuid": "c0fd56b6-aa6c-4d5f-a81b-081c960e497d", "value": "6144:8EA+u6wdIncQOjl0HIMDOHRWNsh/b7z1Mf+PGJHHv1:Z27dMCHRgE71CHHv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024297, "uuid": "510994b7-bd9c-4972-a218-3ec927aa1bbd", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024297, "uuid": "b6f35ef4-7ced-4dad-94c2-1ae2d996c133", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024297, "uuid": "dbcd8a26-78c4-4baa-a429-be5ebcc40b24", "value": "288320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2eba952-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1695986645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986645, "uuid": "4ea8d443-9c40-4ef7-ac65-debe295b332b", "comment": "Malware payload (STRRAT)", "value": "905b7d33f312031f55ae14be281a0729", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986645, "uuid": "db59ae09-bd1b-4089-911f-b3380249c1ba", "comment": "Malware payload (STRRAT)", "value": "c5bad43b8ae8b8118b9ff69fc0bd36d14542d499af5bc15b615b4c8ce06bed1d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986645, "uuid": "87d5564c-d2d3-4e8c-8586-9d0eefce7c77", "comment": "Malware payload (STRRAT)", "value": "18ca2b4902fd282113c19ea99d1d50b78fb3fd9e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986645, "uuid": "e0a12780-3d8a-4da5-b7a0-5bf800ae2fe8", "comment": "Malware payload (STRRAT)", "value": "a1d562df4a969adcf93429ba73eb42f9a9cb6fa18a9149dc569b39d50df453d2680d262ca099c32abd1a4a5fa679d615", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986645, "uuid": "f8989044-afd4-4710-8edc-75ccc7e7a09b", "value": "T1ADD423DD4CDD28EDEBA2A5BBD5D1240318B9C3FC2364883C4D993C878A99CE72C86575", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986645, "uuid": "cfea9459-3b04-428c-915c-014b65922a49", "value": "12288:FaW8OtNb/9FJ6dahyflSnMRQbjX3iqfb4ThlBzmKAobTq6PWlQARHGPovod:FPzLNh8YMRYTz+lFa+T9PTAFnvod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986645, "uuid": "48b5abfb-515f-48c2-b87b-39b043957829", "value": 610069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986645, "uuid": "475aff05-491b-4369-9e04-9325117c459e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986645, "uuid": "fda296cf-f464-46c9-a81d-a4bec2973962", "value": "00301830595702.xlsx.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6e7ab7-5ee5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696005188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005188, "uuid": "20f3e96e-72eb-4bf8-a5d0-00e83bda657c", "comment": "Malware payload (Mirai)", "value": "50ca9a10dd014fe528bba23d9b585dfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005188, "uuid": "8c365518-113a-4a01-86a6-d1c9546ce642", "comment": "Malware payload (Mirai)", "value": "c5e7282356138632849999a92f6fa7d19bee8630508215afa70bde6462734b1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005188, "uuid": "eecd4129-494e-444e-9505-c754c18ebe7e", "comment": "Malware payload (Mirai)", "value": "c1b73da72a97cf23246c0f7f72ddf5fe3d3aeb6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696005188, "uuid": "7a03c8b0-f8d6-4da1-94ae-afe3f7c1f7a2", "comment": "Malware payload (Mirai)", "value": "57cd27afc32aa08eb6b127ae9e0868df547f1d020e367c504f532eb5e8fee217bb2dac01fd5fd75546ff2d8283c932e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005188, "uuid": "e8dad863-9192-4099-920e-0be66903e1b1", "value": "T18582D03062AB74E4CBF10435EAEDCEC69B1A0BFCD1FD369316586B78894650251F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005188, "uuid": "7586de10-dc0b-4cdf-8ce0-887fcc0097c5", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMatbhymdGUop5h5l9:2dV0P6+kom0tVAoNvm+to1Js3Uoznl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696005188, "uuid": "bb50b996-9c44-4c8b-b8b4-d92b957bf829", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696005188, "uuid": "124c361b-ae30-4e49-a5a5-70cdef921b3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696005188, "uuid": "5173e819-73ae-4929-96db-4c32422d3786", "value": "50ca9a10dd014fe528bba23d9b585dfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b750ab-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986515, "uuid": "e5c3cfe2-ae33-4e65-be4e-c229bb4926e1", "comment": "Malware payload (AgentTesla)", "value": "76dad6833ec1a795d7fd9386b8912f54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986515, "uuid": "a689acf7-a468-48fa-ae32-517e6ac1b429", "comment": "Malware payload (AgentTesla)", "value": "c6a0026a78d283724646d2cd5db9fa459a0bd306e19e50c6c23826603b6438df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986515, "uuid": "d782532e-dc0d-4be0-b163-6bc055e92d9a", "comment": "Malware payload (AgentTesla)", "value": "5a74b4d1a5ad78579b5ea2904397377981ed08be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986515, "uuid": "3f26dd8a-2bea-49fa-bf22-5f61dd6400f2", "comment": "Malware payload (AgentTesla)", "value": "f40183958030e432d019bb3efbe085409686d85c74a133d4186b1c873c6137024994470e408177d0e2629059bf6a5dc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986515, "uuid": "0d7fb3f7-d55b-405c-aad6-ff1314135306", "value": "T1D1C4BF446BADA623C7BB3372B42102599BF4D196A8A1EBCF949C14F21D82709FD4437E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986515, "uuid": "cfd6343a-9b90-4ee8-9ca8-704195ef863c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986515, "uuid": "58a54ef4-3b2c-4ff3-af46-2dfa4aab3074", "value": "12288:N2QmrP/hOiVs0uAEd2Ilvd5A8/JyXQbEMt:GgiVZRtIhDhyXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986515, "uuid": "fb495366-fdec-4102-8938-2cb03a04ec9e", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986515, "uuid": "c964170e-6ba1-4817-b7ff-86c362b01d12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986515, "uuid": "b1c899ef-1f62-4434-92f0-8d360f2e7ef2", "value": "HSBC_Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933f6644-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987451, "uuid": "148076ff-c811-4a07-b682-d91b69ee6a28", "comment": "Malware payload (Mirai)", "value": "839c8efc988e472d614dcd582708103e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987451, "uuid": "99fd91ed-4bf9-4b78-a807-3d0910049357", "comment": "Malware payload (Mirai)", "value": "c6cb6f249f7cad6521347d17b894175638950239dc74e011125e704c9edef805", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987451, "uuid": "f00b86c7-1433-4a93-911a-15013b63c325", "comment": "Malware payload (Mirai)", "value": "278de6b4a2d42719635b38c8bb6e631f11e5a5a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987451, "uuid": "524f70d5-e26b-4f1e-a17d-a3ea35e634bc", "comment": "Malware payload (Mirai)", "value": "af047da52f4a0f4aea4c8a024f55e54a96023f69fd635b0c259c0f0ea120d6ad9e45aa81fa2158f9842c893df38b4e69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987451, "uuid": "f9b59e2b-27e9-440b-8d49-a82cbe4106f4", "value": "T1BF733B36BAA11D17C4C9907B62F38725F2F5539A24FC8A163DB20E9DFF2069039136E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987451, "uuid": "4b3b8830-2f2e-43c5-aa58-3d686115b9ff", "value": "768:7e/974Wb1eYBgwWROe/nuL+7fPBfWZUo+L0xO+lM5VTQHF8bKu451tOD/wdAsI1d:7ib1njcpua7fPBOZIalM53bQtOsdAs+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987451, "uuid": "e2d5cbf0-dfa6-415e-84d3-a97830f85e7a", "value": 75048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987451, "uuid": "eea15dcb-bb09-474f-897c-fafc51803d54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987451, "uuid": "766e50e8-f1c5-4781-9640-4df5c2180937", "value": "839c8efc988e472d614dcd582708103e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2edf9ad-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1695987182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987182, "uuid": "5aa12519-a8f7-4093-8a58-ae24dedb8d3d", "comment": "Malware payload (Loki)", "value": "e9cb3854fff75ac7fd4707625e4a3ac0", "object_relation": "md5", "Tag": [ { "name": "CIBC", "colour": "#7209F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987182, "uuid": "3a0999bf-941f-4223-97b0-b96d596d7b6f", "comment": "Malware payload (Loki)", "value": "c794d23130e63008d1b9fdc8d1b087edd236c51fd467f8518e3f2e530c824124", "object_relation": "sha256", "Tag": [ { "name": "CIBC", "colour": "#7209F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987182, "uuid": "d5580dea-d31d-4aa1-8192-c548bc63c6c4", "comment": "Malware payload (Loki)", "value": "6bf0be2146b83d8d113a3a533dab77ec1d750f82", "object_relation": "sha1", "Tag": [ { "name": "CIBC", "colour": "#7209F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987182, "uuid": "0ccc5b4c-1c93-492c-a03a-c0c9df3f5915", "comment": "Malware payload (Loki)", "value": "432db37b0548423db52baac668f39c592af7aac47ac2baa7d4afe965c39f8e3d3894ea0fa093632a0e995cfe2fb733b3", "object_relation": "sha3-384", "Tag": [ { "name": "CIBC", "colour": "#7209F2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987182, "uuid": "fecc130c-1ab1-42a9-a638-398e8e512325", "value": "T127C41294934905BFC6AC45FFBBA1240083FBD222C992C7899CD1D2F861DA7F2A6475C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987182, "uuid": "74145366-870e-446e-9043-097689607738", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987182, "uuid": "6df7a8ad-6241-4b7a-a4cf-83126ffb78d7", "value": "12288:D3VxQo03vsQW3dAckjfVY9a+0KmR85FVHkMSHS+fHWYa4O8gkw9:tk5Y9akeCV18S+uBl8gH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987182, "uuid": "d3380c13-4ea3-43ea-a3f2-eacb80cccdfa", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987182, "uuid": "1059eeaf-d329-4615-a681-5b1b6757681e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987182, "uuid": "ba4ea65e-3d94-46c8-ac91-26edc3a07f4e", "value": "CIBC Bank Advice-lNRar0000300Z9Wu99984003kQefwn-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0bbec2-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986585, "uuid": "648ced04-d8f6-4a8e-8b51-fff256dc6baf", "comment": "Malware payload (AgentTesla)", "value": "a019f6af8b4da63fe9000b04db50cde1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986585, "uuid": "4dcf9d4a-2f44-455a-8a1d-ca9fbfc4f573", "comment": "Malware payload (AgentTesla)", "value": "c849bf87496b531fd9ca887e961def730f9c9fc241c61e9977e11c76ed40ea72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986585, "uuid": "e35b7788-4366-4571-8108-66803c9e9d97", "comment": "Malware payload (AgentTesla)", "value": "2d672f3c154ce30866a6e414c1265bc4ae9cff3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986585, "uuid": "3dedf5e7-31d1-4f60-9a0c-d0f5c0afbf94", "comment": "Malware payload (AgentTesla)", "value": "d30b7e0208f50dc51a59520ea9827c75f84163573b497889aa312e9ba37913f5a12b2b13ef2ee7130192e708ea4751da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986585, "uuid": "d5ef9ec1-dd6f-4616-b996-7beed534e59f", "value": "T17AD4231BCA6D361CE7891B97B47CA2C64F26D0C40C4D29E33B164D472EB9B7A42EC325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986585, "uuid": "5cc855c9-28c7-4fc6-86e7-b0c004aced71", "value": "12288:ZqWBNjOKisiN4HLwmcwCSWKgL2nWjw0BQSqedYvEOshhlFpa9p:o8jOKisG4HdCZByY3qeOv/Enza9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986585, "uuid": "0c9c9d15-b822-4176-a13d-12352ef7213c", "value": 647416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986585, "uuid": "2d8c2b47-bae1-4c99-a859-7db1b7c3d17b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986585, "uuid": "37db49df-2640-4a22-8431-c695c08679c6", "value": "230284 ADAC.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fb61a0-5eb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1695982083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982083, "uuid": "edb0d008-63c4-44d1-84ca-85c2e2137e4a", "comment": "Malware payload (Tofsee)", "value": "3f040bc8ed7ebc86b251dc99764e80c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982083, "uuid": "11e2cfdd-aaaf-4c65-b194-ad532c04f36c", "comment": "Malware payload (Tofsee)", "value": "c892e813df997166d481a2349a4b47bda23ffc6f6483967351f0680a7ea90db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982083, "uuid": "ee2bd4c9-82d3-4e1d-a4dd-97ea846f7800", "comment": "Malware payload (Tofsee)", "value": "0e343a66a561e454bc5a34430b1a46e4dbe16991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982083, "uuid": "0916f7dd-1757-46bf-b1aa-11051678e26b", "comment": "Malware payload (Tofsee)", "value": "58c8084132c62e5dd240d0da518f7b8357dbd70c0cdb60db31ee796a282b40c7f37eb02630cb33e6a4200e8b5817666b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982083, "uuid": "8ee5036f-b05a-463d-be47-81077d226955", "value": "T1A434AF3352E2BD60D5274A718E2EC6E47A3FB9718E59676B33185F2F08702A3D263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982083, "uuid": "e1a03e44-7700-43be-a2f9-de7dbf691753", "value": "2a568f33595a0107732fea57be00f8ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982083, "uuid": "e51d0031-0058-4ad7-a46a-28619f8f6811", "value": "3072:1Xr3DMzg/Ug6rkmi+o+z8R4lOyUAc4u6bzS0UCLOeRQo5UUP85W5D0OTpxpDz1T1:xh36A/+z8t6bzqJeeouUtnpDhTc1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695982083, "uuid": "e7e88bcb-cee3-4c2a-9169-50cca2aeda93", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695982083, "uuid": "40e69896-f815-4cf6-87a5-90dc21d1fa79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982083, "uuid": "cb94c30d-8fb4-4392-b347-4bfb7765b131", "value": "loajqshl2n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14f31ec-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015928, "uuid": "9b397760-3f3c-477d-b2ca-aaa82fee8ac9", "comment": "Malware payload (Mirai)", "value": "3b56a93287a16984d1997072e4a1c24d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015928, "uuid": "3a3f5c65-f85f-4543-bdd9-c32e8b0eb4b2", "comment": "Malware payload (Mirai)", "value": "c8dc94d0c032de05c386d27e3726617e061515d5aea66c5968cbc250fb7edc56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015928, "uuid": "582903d4-4caa-42fa-8c17-9a07cffdcba5", "comment": "Malware payload (Mirai)", "value": "049f5e061a363c482deff58ff2c119b73249d3ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015928, "uuid": "02f5e36d-2cef-4766-8ac7-0c0d4302e998", "comment": "Malware payload (Mirai)", "value": "3d64f0a6a27151e06a486fa2496105fcc3013aebb8fef6c914aa151020f9c47343277c040b6e8e8109b8fa03e59c016b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015928, "uuid": "16590583-06fc-4a79-9c8f-cdcc73eb6f44", "value": "T173A37CC1BB83D0F6E95245B56137AB369733E5392029DF42C369A932ED63410DA2F36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015928, "uuid": "6aa9f78f-61d9-47a2-96fa-75d19cf02f9e", "value": "1536:tKYaaqu1tiIuaa3M7suf06bu0243XkjljR+XxawMASOBS/sD9ehOC:Ipaqu2O0M7sOT3243Ujbue9Oa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015928, "uuid": "04a1987d-0a86-45f3-94ea-425450ba52cb", "value": 104556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015928, "uuid": "a26b2851-0bb5-4c5c-86c2-dd98ceaadc48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015928, "uuid": "8c488e27-5b3d-461e-8a28-bdbb6b586b56", "value": "3b56a93287a16984d1997072e4a1c24d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf5e255-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695986580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986580, "uuid": "8f41a597-fb22-413f-8646-87d76390afd3", "comment": "Malware payload (AgentTesla)", "value": "f18d887f0c6daf0445ec602021a100ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986580, "uuid": "894d5e53-e736-404a-9e5b-85fa449de623", "comment": "Malware payload (AgentTesla)", "value": "c9841a078b8e950096b9b0e9afa46308d8bb25dd8604e5ce9fbd95fc86812726", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986580, "uuid": "ef56d34d-c603-4483-861f-301bf96f0ef7", "comment": "Malware payload (AgentTesla)", "value": "1e4983cb03146d1a711e79220f3a3c2f7c31d361", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986580, "uuid": "41d31b4b-33ec-41ac-b950-99eb6c10c947", "comment": "Malware payload (AgentTesla)", "value": "61109b76338aec8a3bf1e4c2959a639ee99f190c67918384c5f68e8ab5dbe9de4453f09a32505013a59211fb356777c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986580, "uuid": "5cff82f7-e63d-476f-b584-a9d3da637d93", "value": "T108F4236045EA05C8D69B173FD19F7DA10929F84DF810912DA072A8AD5FB4F23FBC6B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986580, "uuid": "7c3c23e2-43b8-45f3-a884-a8e10d8400c6", "value": "12288:wWnWAISn7dHciVn7PcO59gJxTukTYDiYuZyg6mj1cAYifhM3DQTXZ2H5aC/O:ZcShcy7tiTk2YuZfjum5yEXZ2ZPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986580, "uuid": "0bbcf369-d790-4206-bdfb-a2de7a3a70b2", "value": 725471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986580, "uuid": "ce0bf0a9-8bc9-41f3-9dda-0b977d15fb83", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986580, "uuid": "5f779533-62d5-4e66-a08a-d368abfea46a", "value": "Abholauftrag.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74a42ec-5eb9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695986250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986250, "uuid": "57b6c4d6-50bf-457e-bb10-b9ea1d2e5526", "comment": "Malware payload", "value": "1e57ca4d726e10652381a695ee136694", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986250, "uuid": "569caf52-0c17-4b29-b8a8-79551351a1ba", "comment": "Malware payload", "value": "ca0bee4a47a24d23335eebc6cec62220d1ac2009443c455cd77d0ff0b9f8cbae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986250, "uuid": "eecf2560-3b6c-4efa-a229-dc6a7855f83d", "comment": "Malware payload", "value": "91d761cce10dea06acb576ef2be7ed655563d20b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986250, "uuid": "f84a63ec-8a23-48ca-b306-3624b86e3f36", "comment": "Malware payload", "value": "2b68d53afa49afb6cecdaa1dd897e03b373392a9e9f00d44f7491d75593ba6effb6c4239bf1b2e69034c3ad284ea98bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986250, "uuid": "68c36f2e-7f6e-4aed-9080-d21af9b31af7", "value": "T1DB54012575FC8DE3EDA3CAF4BA94EC5285F3930E2B07D8A55C8D42C138395827A63D19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986250, "uuid": "524aa0a5-38a9-4085-b69c-56343cb7ee62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986250, "uuid": "273883e1-2406-4849-a920-d2e09970016b", "value": "6144:xEhR4AXofIUgUXdV45LKHD947M+0abu3QWXdDbJFE5sU+V:x4R4A4fI6jM0AIDEOUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986250, "uuid": "706f9ec8-f60c-44bd-aec8-831479a0d8c6", "value": 294760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986250, "uuid": "f8beffde-6bce-472d-8e3a-c31fefb4af35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986250, "uuid": "0db6eeac-f74a-443d-bd4c-fe1c7a51a7b8", "value": "1e57ca4d726e10652381a695ee136694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7da02bc-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977177, "uuid": "0d9a7b80-d94b-4158-83c2-434c0fefe215", "comment": "Malware payload (SnakeKeylogger)", "value": "3c68b70b369230bfc695f391be176da9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977177, "uuid": "cd3b7bcf-bc18-418a-9827-8450e22c3efa", "comment": "Malware payload (SnakeKeylogger)", "value": "cad1feb442eba9bbe034cadb76a076607f5ebc98c499255c2971e743c40d681e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977177, "uuid": "65a84bec-ab2d-4a31-a2b4-d26c8d1950eb", "comment": "Malware payload (SnakeKeylogger)", "value": "46c464f0d1cffeadcdd93c6c86c288860089c78a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977177, "uuid": "1125e643-2aa8-45fe-b2ba-cb5182cc1897", "comment": "Malware payload (SnakeKeylogger)", "value": "4db4ec8beb853d84add7ec1c3abfa9ef2f7286a37e384f4f3f94ae9846512a90b3505fac4cbe4919059a21266e601c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977177, "uuid": "09f3ae43-852b-4070-9d86-0e8918e14763", "value": "T1D8A239C1EB845A22DE644BB0B26B8E201739FF6787261B4F27C4735B3C47956263F846", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977177, "uuid": "b7538d72-296f-41d7-adfc-c133a13bfc60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977177, "uuid": "17e0e2f0-ae0e-4a5b-b177-e2742449b41c", "value": "384:MUTTskJkdw5HKWNPnbn+b/AeH9F9wGjEnAtNCSGFqU9:/5EwYqPbn+rLXiiEnuCLFqU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977177, "uuid": "e02b21c3-fa26-43b6-b5c6-11793459dd7a", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977177, "uuid": "311f9b19-a844-4281-b4c1-1d7a3fb86876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977177, "uuid": "51872e9f-e0b8-4a9c-aaf9-e349554a7f15", "value": "Icsmcwcw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a05a7c3-5edf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696002494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696002494, "uuid": "fd03d669-130e-440a-a946-6f6ba171dc2a", "comment": "Malware payload", "value": "8742db7e5aaa5b29b16efd1396c7a273", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696002494, "uuid": "3a967995-83bd-4d07-93f0-507198eccad0", "comment": "Malware payload", "value": "cc05b59c546d11cdfd13e78f5d46ce7df07194c48891b5c27406d7e14b27f439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696002494, "uuid": "88ab39ef-8ecc-44e8-91ed-cf71bfd17abb", "comment": "Malware payload", "value": "0b64d117b7e999c1b4ccfebdb2c859be146371ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696002494, "uuid": "7ac160ac-b104-4acd-8e23-e543be6346fd", "comment": "Malware payload", "value": "c6538953589fb491f09e64ca1d7b850bb46f3dae9d3371e0704283b005c1465b4be7545ecd0f7b70931a11bf0f8f0617", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696002494, "uuid": "989cb973-8e96-47ad-b608-6c7a673b7fed", "value": "T1EBC2195D3B908166C2DF2BB006B2DB2502F2E10B5A27EB5F4CD844FA6B773C14D819E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696002494, "uuid": "5aea62d4-9570-4d06-82f7-fd22b7544b79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696002494, "uuid": "40827c83-59f6-425b-9e77-399211d56369", "value": "384:/Ld6cufEYAA/XgWeyoHzCYe/iBY2OzRLTm3yilqr63+bltVvGD:zl8AA/6T5e/gsE0VvGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696002494, "uuid": "20fe4cb8-eec5-4d0a-af9e-86b561441d98", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696002494, "uuid": "3a987e16-b841-4181-8c9a-92dba192889a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696002494, "uuid": "f7f7633c-f89d-411e-adab-7db4e6aedd44", "value": "bQoA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed2e64e-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987443, "uuid": "c3275753-211a-4f04-ac41-53414d4a69c6", "comment": "Malware payload (Mirai)", "value": "2e934ad7438fa7b519b6a6896da919f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987443, "uuid": "80cd0094-842d-42a7-950b-139bf0adce2e", "comment": "Malware payload (Mirai)", "value": "cc1f1e1689c94366a1488f72e78f22a31ab3704dc153538badc0344de24e3554", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987443, "uuid": "86ef94f7-e8c3-4128-9e32-d5362c81fd40", "comment": "Malware payload (Mirai)", "value": "08e6a31bca5bf999421fbc68c6fec30b1d20f122", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987443, "uuid": "707381ad-ea17-4727-b4fb-fa8978a57796", "comment": "Malware payload (Mirai)", "value": "f653c89027db07326a7f5936821af0af3042518bbcf2da3d692af3e8d172d19f2eba7f7bc8efbf09704b5ebebceb128f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987443, "uuid": "d363f7b8-ad03-46ef-8e16-4e66fbb33336", "value": "T184536E42F70C0543E5631DF03A3B17D2D3AEAA5113E4E14A354FAE89B176E329586ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987443, "uuid": "158f7baa-6f7c-434a-8425-c8f9abc09f76", "value": "1536:v1DcQi99G/A2lLJYpI0daiLCMIpyw72zwYv:v1Pi994dlOVgdMIQwWwYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987443, "uuid": "6c455017-70b7-4e1b-8aae-564ff80ac1dc", "value": 62848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987443, "uuid": "5f64fce5-687f-46e1-a772-820d4c55dcd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987443, "uuid": "41071120-0cd1-4fe2-93da-2375b97e345a", "value": "2e934ad7438fa7b519b6a6896da919f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00a62ae-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696015819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015819, "uuid": "3a3fab49-d820-463e-8aea-4e136edf6e14", "comment": "Malware payload (MysticStealer)", "value": "0d358c430f94b2eda8114142219f2a94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015819, "uuid": "183acc8a-2a35-47d4-9ff4-14a428fbbe31", "comment": "Malware payload (MysticStealer)", "value": "cc92de366cb49d9c9de26dd8a480cb350e645878df652f776ba424f4053203b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015819, "uuid": "850e60c2-a8dd-4b0a-a828-ad5a1e9c99dc", "comment": "Malware payload (MysticStealer)", "value": "0b902e4fff9ecae989869750a535116a80cc364e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015819, "uuid": "3dfd6295-8320-488c-a865-b140b0c66f04", "comment": "Malware payload (MysticStealer)", "value": "cd41c87dca6ec2cc768f0c193c1ee2bd0fd79b842a969f2d8f0f1217f178deaaca6aa5af5175ac545a271c02616e1c54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015819, "uuid": "1664d42a-abfc-40cd-8bb6-30fe9b033543", "value": "T19E749E1574D1B4B3EC322DB205D8B7F9262979100E625D5B33DC0BAE8E7C581C6A6F2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015819, "uuid": "0b1e3bf5-54a3-4131-9ae0-0995e0d05fcd", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015819, "uuid": "a2dfcd16-6168-4af4-99fe-89de2a3521cd", "value": "6144:waTeW/s5GqrO5aXnfEGIXWPvZAOAyVyjzQMRq0+TG5Utr27mv6iQhiIcubKDVs0z:ymcGqrOk86xUtrmBs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015819, "uuid": "8c0a09a7-9031-4233-b8ca-2a77db774ae4", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015819, "uuid": "8d409589-02e7-40a5-9665-8345aec3f359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015819, "uuid": "6000b036-e356-47ed-992f-abaa60e8d520", "value": "0d358c430f94b2eda8114142219f2a94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de46c480-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024513, "uuid": "67b8e9ba-e514-431d-83c8-55bfbf5686d1", "comment": "Malware payload", "value": "2f9f640ba9572f3fbefe650346fba1e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024513, "uuid": "3234c721-20a8-4364-ae80-ff6d4b1a7de8", "comment": "Malware payload", "value": "ccdefc7fa3fef0208637d51e97119131ee5a5a9009ec8831dda4800c4653f19a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024513, "uuid": "73edf69b-dc87-4b3f-a278-eb802d3e9ad1", "comment": "Malware payload", "value": "5f017bda9dce58bb5fcae59ef324260ea11d1b7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024513, "uuid": "95fd1c30-b6ec-4d3d-ada9-101f9243c66d", "comment": "Malware payload", "value": "e67f9339511bd6d3b794fa76b0f13e8229ce54db19395ea71b840709eb613499eb7b1fc79332585232f4df586b4ee184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024513, "uuid": "3a34b177-4c6a-4ab8-9fb8-8332d98d4e70", "value": "T1603423816FED64A13A6E1C58D9C145C5D138C95702C2C63F83813F99BE9EC7F3A643A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024513, "uuid": "8bc327ab-03d2-45a0-8f35-a304e765c2dd", "value": "3072:cMysoI0oFHTcBygThaZ9TXKu72os1dR5LTtlYG+OIvnw/90vZZ009jZBgA3zdshH:t00AqnsZlndIvw1b09jhshlO/mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024513, "uuid": "e796c814-551b-492a-b4be-1bfec946bd92", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024513, "uuid": "1a20766f-7c18-40d6-b5cd-e5de00787d82", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024513, "uuid": "c6870c1d-5c04-40d4-93b7-3217fe414a15", "value": "288346.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db35eb3-5ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695978637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978637, "uuid": "a85bab03-79f1-4b1c-87b1-3b41b1d56e81", "comment": "Malware payload (AgentTesla)", "value": "789f2265dfa99a6207f555a5caa4b9d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978637, "uuid": "3d3db68b-dc24-4ad3-a385-d99106d04821", "comment": "Malware payload (AgentTesla)", "value": "ccee252d64856661eb0ce8ad16565d08ac0013c49e3c386e8011ce1921682d59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978637, "uuid": "7bd661de-2b1b-4a6e-8409-ed77fc697070", "comment": "Malware payload (AgentTesla)", "value": "15e8f77576fc8261c25d45a9ac0d196d4086b711", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978637, "uuid": "bc2a51ec-9934-4ea5-a069-d7fb59c15a71", "comment": "Malware payload (AgentTesla)", "value": "845c637ee8df85fe62d8b16b79eb4e7a0c20519242a8ade0cb80890a627ec569798a06d5d21b77f4d92699b4fc4b7801", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978637, "uuid": "26862fb6-bc64-4daa-a565-e420c299dc5e", "value": "T13DD4230476F54722E19D137557AC246A8331F615A808FB3B8E9FB6DF056738C0A62FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978637, "uuid": "86f636a9-0e60-446b-ab18-7b0031bf2d73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978637, "uuid": "3e0b9637-7ae7-4f35-bb4f-19f46a7cbd37", "value": "12288:O725hdSZJmFLiuYgZdyTnhJLRXqiWE1xbdp1U9V63jh:t1SZJWbYPnhJRXqMzKV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978637, "uuid": "987a7076-2f00-4077-b177-724503170a7b", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978637, "uuid": "101720ba-d50a-4488-b75d-3305a3f55637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978637, "uuid": "07462588-0395-4a41-bd35-3c72d88edbc1", "value": "INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a533805-5f10-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696023406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023406, "uuid": "26f4fc46-7af2-4e21-ab9d-e307b549d6fe", "comment": "Malware payload", "value": "d2d9c07519f7e75cb5381b8b1bba2223", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023406, "uuid": "6fad068f-0ef0-468c-b7e9-0608d4018c4e", "comment": "Malware payload", "value": "cd3c45e2b7be4caaed6e166b23a8719a39dc5bf85450f59143585f60e0944be6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023406, "uuid": "3e59185d-4047-4b74-b62b-42a0a4b53545", "comment": "Malware payload", "value": "31b3181eda891e8a9a7963f805f97e676b774042", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023406, "uuid": "edfb7b94-1091-4c20-9da5-3c35059e2d1b", "comment": "Malware payload", "value": "e03b4819f70e50fc7535860f129d871ec2aba7d5e98531e570264466bb8134a7a476f06b48f471b7604f037a3f9af2e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023406, "uuid": "eb7aa91d-ac22-4912-8cc9-a9fb366c81fe", "value": "T141F433780FC67497E39D83C2AFC269E1639A732CEFA8C5D45E029BD0054969ADD4C3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023406, "uuid": "d361ea77-852e-4e0b-a774-2bfc33a98971", "value": "12288:ToAlrpuropQBkk1IKpu3/zjQ8zGmDTDWlmfVSsqEx2fm8z9kw3:ToAlp8cg1Npu3/zjkmvImfVbyzew3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696023406, "uuid": "16abe5cc-a42f-4dec-b12d-d7d3416146a0", "value": 733248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696023406, "uuid": "6cfb51d6-9169-490d-ad19-fbc76ba082b8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023406, "uuid": "cb433a2d-36c8-4b0d-9cb8-09bf5a54211d", "value": "@05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b270a3e0-5f1c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696028735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028735, "uuid": "012e2ce6-4b54-44f2-9464-c8ca4272a1e7", "comment": "Malware payload (Amadey)", "value": "e8b8d2bdc66d28bee4b1a0d2370af2c9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028735, "uuid": "e3afea53-f928-4483-b8be-186246a34d93", "comment": "Malware payload (Amadey)", "value": "cd5fdc7c0461e665b570e56b095165ea47eac3830e7d351d40ca4a75ee6e81c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028735, "uuid": "8e4e8c33-190a-42a3-bab3-84950fc03ce9", "comment": "Malware payload (Amadey)", "value": "02607abe61b7b1415d7dffa4c3f5543187e98b68", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696028735, "uuid": "3390435a-48c4-4996-bc8d-e66563af2571", "comment": "Malware payload (Amadey)", "value": "4e28a5efb351a16123bf335d49f791f5ccf1ab18b52292e50ccfd52834002f2b14b15641c36c166fd6f5573ea166d592", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028735, "uuid": "ebbabd2c-8888-4336-abe9-4cb4ea5c84d1", "value": "T17135234367C9A423CEF02770C9F652D30A35BD629C7492A76381C94F2DF2786A670B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028735, "uuid": "bc0bced3-acf7-44d5-a67b-1056e6bb656e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028735, "uuid": "57901706-8cc5-4eb6-af1c-f89fbeed54df", "value": "24576:SyV8sIvQqCiE9o1irpuhDZy5nel/NaMPIS7Et3icACK9dcE:53IJzp1E6lCn+/NmS7Et3XOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696028735, "uuid": "51c06913-2668-4c3b-9f89-f8d8c238ebca", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696028735, "uuid": "bc7f114f-9d15-48e3-a0d6-5d6ff37f8508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696028735, "uuid": "c6bb99fa-9c46-41bc-a5d3-c2cef900ada2", "value": "e8b8d2bdc66d28bee4b1a0d2370af2c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcd1366-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987015, "uuid": "625385df-437b-41b4-909b-4913340bcf10", "comment": "Malware payload (Mirai)", "value": "50fd5fa4c815cb3ff26d4b40ef628660", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987015, "uuid": "d20f597e-b088-4f26-9f44-08c622b9c4e1", "comment": "Malware payload (Mirai)", "value": "ce3306a7e4da2186444d119310c061757a688c4f6a5a5d08e8b633d38a7eab53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987015, "uuid": "315bb149-227f-4a73-8496-48acedb1f3de", "comment": "Malware payload (Mirai)", "value": "48413c72ec0879c473e31c03173b403f942da7c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987015, "uuid": "5ef7338c-b3eb-4e63-9800-91f119b5d795", "comment": "Malware payload (Mirai)", "value": "3d49f53d643f3f909c35a56463b9c71fed66e85fc43b1278d78c39fe6ad81842575e8cb42ce586d27325509b4c0f308a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987015, "uuid": "6ec0c4c4-a500-4c2f-8c4a-fb2361ad7b42", "value": "T1B0C2D044F041DE45DEFA29F03D64DBDABBE42F1EAA668E9025A153C25F1C2B74206DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987015, "uuid": "d61817e3-10c0-417e-86b2-48a93fa9dbac", "value": "768:FVdafO76jpmNJJKehmA7trpfIX9KeA7PX4uVcqgw09q:tam+AnKehPRa9aP4u+qgw09q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987015, "uuid": "f9cd5e19-75eb-4f69-82cc-62de642b5ab9", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987015, "uuid": "36c9332d-44af-4726-94b3-ca72616e28fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987015, "uuid": "a62b41d5-2cf5-48a8-b83e-cd3dec5d56c2", "value": "50fd5fa4c815cb3ff26d4b40ef628660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c367487c-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015878, "uuid": "9caa9088-0abf-4973-ac7e-1d659a5afe2c", "comment": "Malware payload (Mirai)", "value": "21c5599d24fecae2ada0b6c20004d94d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015878, "uuid": "1144c332-393b-407c-b277-3a8dcd2328fb", "comment": "Malware payload (Mirai)", "value": "ce685a354ac8cf2de1d85c0ce3b13e767b0adfeeeb7223e839a75b5b029f15c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015878, "uuid": "c212237e-be6e-4c92-b69d-cda7ee7265ea", "comment": "Malware payload (Mirai)", "value": "551c0879f9d36dc1b604f42c3085139bbbcd9add", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015878, "uuid": "7ab03564-9bbe-408a-8164-bd7d79fe59cd", "comment": "Malware payload (Mirai)", "value": "202a7e53e3f09a054ed3571de0ba13d4af5e9f285589303cacf28d30911504b085893feff777972c0d6ee48430c34196", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015878, "uuid": "2730d99b-3e6b-4871-898f-388f9f27f43d", "value": "T19414A91E6E228F7DF6A8C73047B78A24975933D627E1D684D2ACC1105F2439E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015878, "uuid": "895b8285-7bda-4689-8b1b-b1b57e378828", "value": "3072:jhypEOF5Y8mZxYeEcox+sqZhv9wKTn7A5gsg9:jhyjPmZSdW9Zn7o3g9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015878, "uuid": "6b7e9ea4-8596-4526-8046-f83f70b7cdf2", "value": 194764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015878, "uuid": "bdb6f18e-44c0-4051-926b-80b5d7f4c538", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015878, "uuid": "6133bcd7-5260-424d-8fbd-4fa98d77a63a", "value": "21c5599d24fecae2ada0b6c20004d94d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc53077-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987465, "uuid": "2e5f19e9-98c1-4c45-a85c-d75a4dae7ead", "comment": "Malware payload (Mirai)", "value": "4285155eb9e8d01fe55498b5b6a29cd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987465, "uuid": "e48955c4-a1ce-41d2-88a0-1047a2d94af1", "comment": "Malware payload (Mirai)", "value": "ce83d551446803a99e10121edcd0f18ec867b14def597cfb4621eb59e4302d9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987465, "uuid": "d834e3f1-4a13-4626-b453-964903d01f1c", "comment": "Malware payload (Mirai)", "value": "e746fedf0d30e39b2fb6a32f91f7fb44690c4587", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987465, "uuid": "3bba2dc2-ac7e-49d0-a5a4-4a7f40f229bb", "comment": "Malware payload (Mirai)", "value": "97a0ffe5f4c0daba04c49d28ea4baec21027f583968a042277c78ee282df1253ff3f48af63ae94e193d989585d77dd0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987465, "uuid": "b1374b42-6ad2-461a-8cc9-5023a3bb818e", "value": "T11133F1B682AB9D72C27046BB153D949D64162378E3E5F00356660470EACB2F35AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987465, "uuid": "1a86fd5a-1b08-40c9-85d0-6686e152b192", "value": "1536:uCoqsGR4eB3g0Vmh1IxIpC8JaL9VE8amFZP7R3n:Xoqs2Twh6P8JaLJ9ZP7R3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987465, "uuid": "c5a75527-2ff0-402c-a91f-05f5af255e44", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987465, "uuid": "284007b5-e712-491a-a5d5-9cd2dd4224d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987465, "uuid": "fa582226-f84c-44f0-8d7b-dcf286455721", "value": "4285155eb9e8d01fe55498b5b6a29cd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e427cffd-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977279, "uuid": "00bef534-799c-409f-88cb-3d249ae5feef", "comment": "Malware payload (SnakeKeylogger)", "value": "6b4f6cc2f9b20734530acf3124a14cac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977279, "uuid": "4ad1f0ef-6218-48c1-ba1a-2482b87aaea1", "comment": "Malware payload (SnakeKeylogger)", "value": "d0018553788684559db6376fe759c7eb91b56532f24fcdee4468dae430511231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977279, "uuid": "cedfbe0a-ccc1-4550-b716-a09bd9cfc4a2", "comment": "Malware payload (SnakeKeylogger)", "value": "a07f1d4fe758c87819ff62671e015dbb38b8a7ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977279, "uuid": "4c6a91c3-9b7f-443c-9750-24023d59e549", "comment": "Malware payload (SnakeKeylogger)", "value": "3b5df4b992012112d075d09c6136d2192a8495621feedc33d7d5990d2114cbfd4b524f11aa9d2d0f2203d304a913a6c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977279, "uuid": "2b13fdfa-0e25-4fcc-96e8-04c67e2452bc", "value": "T10BC40121A7F90B9AF2BE8BF504251908577569BD201AE60C4DC3B0DF56B9F81CB40FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977279, "uuid": "ebaca4ab-8bd2-4c63-b568-6df4aa6c7d9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977279, "uuid": "6a83279a-11e2-4c81-9b40-5421e6d8540c", "value": "12288:QMiyiRJU/WceD6+kpqkIaHkuhirf6Kgtom55Nk5PMVFS:jZFe/ZkcH+kp2nHHm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977279, "uuid": "ae79655f-53a4-4454-89aa-849b797fa928", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977279, "uuid": "cb1d38a4-2457-402d-b522-b59eab858585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977279, "uuid": "54a1c31a-e3a2-45be-b552-034ab69fb57f", "value": "5yjBTV1RX69ix2q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b190ab-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977274, "uuid": "b5cd4d2f-e024-4c39-b143-e31ee01cb58e", "comment": "Malware payload (SnakeKeylogger)", "value": "b4021c454e2c87647872ba4851700174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977274, "uuid": "8e06a235-1653-4ef1-bad3-d6c0c0113681", "comment": "Malware payload (SnakeKeylogger)", "value": "d0659f8d337232622688d25aca3c38e2e8766cba24836f4c9f76774a1a5ba370", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977274, "uuid": "80265a6e-50fe-4bdb-b456-c1334f71db0b", "comment": "Malware payload (SnakeKeylogger)", "value": "8c8f281ce90af9a24dd230ad47c1e52b57f9f87e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977274, "uuid": "818c862a-9e5c-4a02-9c13-a0b870c89de9", "comment": "Malware payload (SnakeKeylogger)", "value": "eb97b03ee2fc1c7c580594b94048efb3f54cc1b71c7697dd9622e5640ff01743094a350c9a9c98ad9734065a2ff33b41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977274, "uuid": "fab6040d-107e-48e8-95dd-509dab383524", "value": "T11CB423C87ED7831AE5DE07B79B9D2253C3F0F0A5A45EE3598A87168748323A82521F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977274, "uuid": "f89dbead-1338-4d4e-b6c1-a36cabfd2638", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977274, "uuid": "5bff9f37-dc93-418a-a799-5c6bb8d8d910", "value": "12288:O725kL+UonN7GqXkxpgPgI5ZzVqpiUxDdfyQOnXJ:tA+UoNr0HgTbxixDdfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977274, "uuid": "430cd0f8-c4c8-4cc7-82f1-748c24656274", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977274, "uuid": "25c72e86-d638-4384-8d64-94d047483dfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977274, "uuid": "c3977fd7-03f8-4030-b2f0-de5b6f599769", "value": "qhCwtk3xzBi0epX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beee2b3b-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015871, "uuid": "50159b0c-e2d1-4e6d-8a99-c80f50ecef50", "comment": "Malware payload (Mirai)", "value": "5604d8309760764aeaf2c95849d94811", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015871, "uuid": "71bf2307-af13-4af6-93ac-61df74167e4d", "comment": "Malware payload (Mirai)", "value": "d09c88ae9888c9151c289c2eaff023e36892ba383d36626b3be8e841a119d60c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015871, "uuid": "d362f502-974d-4d56-ac0c-b23a205cb122", "comment": "Malware payload (Mirai)", "value": "b635ff291dc517e7d8d9dd687c05c0cdc91e4d53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015871, "uuid": "64906a3c-af26-4270-85f1-42be91d61656", "comment": "Malware payload (Mirai)", "value": "27140c7e158f1162c8a52f5a0364edfeb446ed4b91b20211304ad6f712f6c023ba9bccdbf8b5f6feb388b6565eb3c940", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015871, "uuid": "51bbc8b3-e3cf-4d97-9cb1-231e40c869b7", "value": "T120D35B73C87A6F58C26AD2B4B0308F792B63AA50814B1FBE5876C2B58043DDDF5457B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015871, "uuid": "69ebb02a-2347-42d5-b976-533f4e9b5a86", "value": "1536:faECGXoCAd99who84oL0CsKpA/A7MA4ZDYJLxUJ1WTSMEjR3IbvfMACsV7W:fgGXMfOGoL0CpT8ZDYZC1W5Ej9IzM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015871, "uuid": "a2288594-35a5-4fb9-8764-98b2a06dd665", "value": 133548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015871, "uuid": "64ffd9b9-c3a7-4cd6-9137-f088a5e892f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015871, "uuid": "56e16b36-4f85-4ac0-9566-fe72f2aa0930", "value": "5604d8309760764aeaf2c95849d94811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4684292-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987480, "uuid": "37122b41-de60-4b77-aa0d-f0d54c5b4153", "comment": "Malware payload (Mirai)", "value": "d0a4bdd1d89bd71e4d935336494b215f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987480, "uuid": "034f09e1-47ef-4210-8267-fb7a1e16d6db", "comment": "Malware payload (Mirai)", "value": "d0d33483ddbef26569a29113f83c4855c9e04fbec8b1f5031f597d4402ce9201", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987480, "uuid": "6dcf40aa-f5f1-4ebd-a7e3-ed81aea075aa", "comment": "Malware payload (Mirai)", "value": "7ef973b59615185c59060178961195e84c2d3c54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987480, "uuid": "87e6da0f-641a-41e3-bb31-2f69dc96d394", "comment": "Malware payload (Mirai)", "value": "a04dc2a857d92fe4551d03fb51ec29a20d3dc9dc11747a21745eb5430b446f5d750fb6621a4e7776b0c377367d2aa717", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987480, "uuid": "7c2df64a-431b-45a1-8bd2-884d3c047048", "value": "T175534B99B4028E3DF88FE97984160E05BA2023D112931F2767AFFDE37D331659D16E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987480, "uuid": "a142705e-f1fb-4749-a4f8-fe08c1080096", "value": "768:2eY49YE204qEkRf/36fmODeiuQlJZvTgFHq1euk8B8vpG97ErlfXySJ1oXWo7Pv:2Y7EkRfPh3iDx8Fq1Xk8B2aErlfiSJQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987480, "uuid": "da3e0061-0514-4748-ad03-07619f14f3c2", "value": 65096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987480, "uuid": "dd745202-d499-4f3a-a83e-2932898bb403", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987480, "uuid": "7ab235cd-491c-4e42-96fb-6451d19e1359", "value": "d0a4bdd1d89bd71e4d935336494b215f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9723477-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696015915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015915, "uuid": "2744d67e-ddc0-41ac-8ed9-0e98600b9d8c", "comment": "Malware payload", "value": "5f5b3cdf62396fbf2a5d0b0f4f56b842", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015915, "uuid": "23994c25-214b-4dac-a9eb-ff92b4a821dc", "comment": "Malware payload", "value": "d0f9b001d2f230cffaeb964187561ba9e97bc5eb10e17f0d2e94c5dfbbf99fcd", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015915, "uuid": "f10b9377-3c93-44a6-9934-cd30e7fdac02", "comment": "Malware payload", "value": "2efcaa64696ca47d5f08e3b9b94d51ff9e051030", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015915, "uuid": "803c08ba-8086-4718-b4ad-d79364406e18", "comment": "Malware payload", "value": "fa12505146e4b2d36414fe18bc02a8e58fd35adcc6293bb227b9312cf4efa385d13f7a72a1eab5fbe8718b5378ed2ff6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015915, "uuid": "a376cfb8-76d1-48ef-817d-3edfe9638a26", "value": "T1E6E34B07B9C188FDC8D9C1B44BAEA536D932F55D1134B26B37C4EE222E5EE205F6E610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015915, "uuid": "5e367b8c-66b8-40a2-a74c-1ccf83e3d313", "value": "3072:hse4YdB/CV4q8GM+hm2roBYviT3o51lCu/SQaO7rnXuzPIgrXtkAAx:Oe4YdBqV4qC+h8otapPIoZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015915, "uuid": "fd0dcee5-7a9f-4c85-9fbb-a0abffeed70a", "value": 155304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015915, "uuid": "fb4f1321-3013-43cd-9515-8941b3d662e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015915, "uuid": "fd014d10-9446-4850-86a1-0860ae39105c", "value": "5f5b3cdf62396fbf2a5d0b0f4f56b842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc59ff49-5e6c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ZeuS)", "timestamp": 1695953160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695953160, "uuid": "88b18983-047f-4e33-9288-ba6c2697c760", "comment": "Malware payload (ZeuS)", "value": "b3fa9e293c8a1886076f9bcb6e418373", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iceix", "colour": "#2C4EED", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695953160, "uuid": "0dc02456-7d8a-4999-ae21-765175d15c03", "comment": "Malware payload (ZeuS)", "value": "d122c989fe69f0912e7fb2aa838d6eb83995c86b6986f7b9e20fbea287e91ed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iceix", "colour": "#2C4EED", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695953160, "uuid": "a02fd3d5-5ffe-40fb-bb9b-e4c470fa29c5", "comment": "Malware payload (ZeuS)", "value": "edeca3d9be67fe3e643b8d0e8456c327d119b2c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iceix", "colour": "#2C4EED", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695953160, "uuid": "e2893144-e852-45ba-ad3b-74173fc6b66c", "comment": "Malware payload (ZeuS)", "value": "966807dcdc8d7b4d6ba13a4576ba849902fc1e55c3c0b75390a84c27525e78389fc4c126eda7145fe8fb857d0ed1f9fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iceix", "colour": "#2C4EED", "exportable": true, "hide_tag": false }, { "name": "ZeuS", "colour": "#3A348E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695953160, "uuid": "f7b8906d-6132-42b1-9e04-8ec417b582c5", "value": "T17BE30176E550D316E3B7A132E2591CDCF23647254B85D68A352C39B3782078EA3B863F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695953160, "uuid": "2aeafa7c-f56b-48c5-b226-1a014d9d2d66", "value": "6af1922a02b6a44b6a0820a60299381b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695953160, "uuid": "9d9769dc-aea5-4d0a-9bdc-0e7eb7ad1545", "value": "3072:t7fL6ADhJ1luf+5Di2/m7V2vVPuYK5gQFF0ZQ:RfL6AlEF7V2sYK5rL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695953160, "uuid": "4b148f95-2202-4d57-884f-d83e9a4b386b", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695953160, "uuid": "c351da47-e003-4d8c-b0a5-18a7868a785b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695953160, "uuid": "d0dd12b3-0aff-4ee6-bdd9-b2a1d5dffb8a", "value": "d122c989fe69f0912e7fb2aa838d6eb83995c86b6986f7b9e20fbea287e91ed4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1258e940-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024171, "uuid": "abc0a828-c467-40fa-b586-673012b27161", "comment": "Malware payload", "value": "a9acb03236382bc1483c1d7e4112d723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024171, "uuid": "5a465d3a-2898-4287-9ca9-a78aff633a2d", "comment": "Malware payload", "value": "d228b7a4aaa9e1263d24e8d94e76c94107aae61f10f4ae83f8ad5716b653e19f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024171, "uuid": "26355e6a-9e92-4caf-baa8-3919e0500337", "comment": "Malware payload", "value": "920cdda69bbbbb0092c3d428370adb3d34678ab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024171, "uuid": "4e27e71b-bfc1-4fef-8fd1-5a10eb44b7d2", "comment": "Malware payload", "value": "61295fd66a0ffd07ec523da3a0d72f5d9388fd003ff0adaf2071fdd88e4dc2fe64c025f6c3fbde8c82e3a06b821b7ed8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024171, "uuid": "17442cc8-4169-4cdb-a8e3-324058616f76", "value": "T1D734237A8DC33822DFCF6952B233A980B177050621C22D77111BBFD17EA98957D0B5AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024171, "uuid": "62b8273e-c2b1-483b-b2f2-e1a1b3ab275d", "value": "6144:ZP4IT3ISUJdDyBVlfBqGda6SG+/VP+zqAC7t7PincgIDwvKN0qF6l:7RAwfBJa6H+dNDGcgID8K6w6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024171, "uuid": "28eea2f5-7127-44b9-b69b-68919a6e98ff", "value": 251920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024171, "uuid": "7d6757c0-a0d9-4307-a5da-7ca3be8ad11e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024171, "uuid": "18904fd9-cfee-4809-95a9-95e30e94fc27", "value": "28833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b907746-5ea8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695978714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978714, "uuid": "a841a3ac-fd5b-42c7-a705-d0f942916d76", "comment": "Malware payload (SnakeKeylogger)", "value": "ebb553c923780bc6d174ca42d3b80779", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978714, "uuid": "ab559492-14f3-4b0a-84cd-cf86d8e0984c", "comment": "Malware payload (SnakeKeylogger)", "value": "d24d7b1635869443f331dbf23e67e6dc4fece364a85d7ce6aab479080cc74f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978714, "uuid": "5cf9c245-75b2-4da9-9c10-e7debe216e85", "comment": "Malware payload (SnakeKeylogger)", "value": "dcc5727af6512cda351689a0f3741e2965e6c263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978714, "uuid": "6c2746b0-3ad2-4a1a-89ca-a4160f1dc5bd", "comment": "Malware payload (SnakeKeylogger)", "value": "464f3065a8533b1589fcd93f7e307be0608c80aaa8ed678436effba3422c6886114d890630bdfa5ed668b28d7cb01bdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978714, "uuid": "280234a1-b1a2-4876-beff-69a7f1b5628c", "value": "T1FAD423AC79A28B11C58D57372AEA506743B1B321B113E77DC9CB78830E753182A71F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978714, "uuid": "ac3cbafd-c1ba-4e83-8b89-456c1ef5cbee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978714, "uuid": "293b0f25-8789-4503-8843-a3d96ac3a3f9", "value": "12288:U4725sYQMs1P3Jr7Pt3Ql8U/Hm2FUCndYF2UNDF1tDGze:G2SyPlPt3GGkUMdofZ1pG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978714, "uuid": "cd6a7e67-39a4-4d34-91d2-df7b881d983f", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978714, "uuid": "65319fbf-d4f4-49b3-b09e-5e8f101398bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978714, "uuid": "6f1c8232-2daa-44ca-82b0-e8f5d62dde60", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63ac686-5ebe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adwind)", "timestamp": 1695988368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988368, "uuid": "947b077b-ea90-4700-83a7-692bac2c6d45", "comment": "Malware payload (Adwind)", "value": "888c437b0060003b73a1228397431936", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988368, "uuid": "4fb6a89e-9cd2-4794-a903-54491aba040f", "comment": "Malware payload (Adwind)", "value": "d2b48cb6b832bda5017cbac6141d5836c41e2b5c66579cda5182250fa6c92d02", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988368, "uuid": "7f04827f-6eec-47ec-8c29-7f20a5bf59af", "comment": "Malware payload (Adwind)", "value": "a6a39fdb305f6327d7704e5e8c769112290b3654", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988368, "uuid": "dd6f4a04-72d8-45d4-9b35-2890de1b6f20", "comment": "Malware payload (Adwind)", "value": "0e95b0521e6ac8ad703e513b1594cf76671d733a87e390424ea34f799924988632bd024f3c4fcba6594e3ebb4dc8474b", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988368, "uuid": "c2f6a881-0e02-4392-8f4a-93c52299f75f", "value": "T1C504225632F53373784EF93E5C7BC18B063A22AF41FE58625859D6FF361B885820C898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988368, "uuid": "0dd5a76e-dc6b-42cc-a78c-6f43d9b701bf", "value": "3072:kCgE9r2C9A+81ipzQYC4x4h5DOvs2ZoqgVgw7X1fRseRG0jZZu76F68B:FgE5A+Zp8YC4kD8s2ZovgolmeRGte5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695988368, "uuid": "ec8c5a57-94d1-4903-9f6f-7ea9b856a03d", "value": 180430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695988368, "uuid": "11718108-d833-4a77-aab1-d10c26c12944", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988368, "uuid": "a317aad6-28b6-435d-8759-9e07c540bd43", "value": "27_09_2023_SIPARISLER.DOCX.JAR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb6f6ba-5ee0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696003091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696003091, "uuid": "bb619114-447b-46f9-ae57-e9ea12267d81", "comment": "Malware payload", "value": "247ff2a95369657fafd6461e63b5e89d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696003091, "uuid": "1d93d3e9-4522-47a7-a8ee-4ddcbed9ef7d", "comment": "Malware payload", "value": "d34c118b34282a2b0aa7f4f9af6870f68da8f9200912ded0617829862dfef0be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696003091, "uuid": "2d33162a-12f2-4985-b5f0-5f62e32daa65", "comment": "Malware payload", "value": "3c1d2514a44d8cb3cbceb845d4246f72d507cb3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696003091, "uuid": "b6fb7a31-f91f-4bdf-9d7a-8a1910f60aa5", "comment": "Malware payload", "value": "0777b5ba450c9ba6c16a50d02ba2297767d6be2be76a9fef0e240e99cec8a7e6a6a47ef286d69dfde8d9029dcf5335a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696003091, "uuid": "c54c5fff-e4da-4a3b-863b-d4c09acbbbe5", "value": "T125349E0A61E2BC60D7A746328E2ECFF47A7FB4628F756E2733146A5F18701A1D263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696003091, "uuid": "f6c9de4a-4ff9-4083-9417-cef4111d93a1", "value": "04b413a231387eb973c8024c0a5e8f4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696003091, "uuid": "1bd9e774-268a-46dd-b9f7-0ca804f85c66", "value": "3072:CXjRo3x9h9yXR3NIebUbe1G4EgmRUDkMimOG870wIxpJ5mQoPoAYTI:CdYlyjIebUbe1G47mMYpIwsEQ6BYTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696003091, "uuid": "deff61e1-9517-4355-a9af-5c24917aaf25", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696003091, "uuid": "40d65661-957f-4354-8f67-3ac166eb5286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696003091, "uuid": "fd267149-75ed-43c0-833f-bc75eb280ad6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0756fc-5ea6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695977879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977879, "uuid": "cbff2bcb-0d40-4dc6-b2ab-f2131f125594", "comment": "Malware payload (AgentTesla)", "value": "4891cfcacc4e6d1ce89a5cf2fe397eba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977879, "uuid": "2cee23dd-fb00-4ce2-ba59-7b819f367d38", "comment": "Malware payload (AgentTesla)", "value": "d37b94cc6dbda1ab0be4125b9399716800149a27665acc13b62f62d9a5d29334", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977879, "uuid": "be3b4cb5-97ee-4a05-8bca-a2de99b1abbc", "comment": "Malware payload (AgentTesla)", "value": "f528d7deb11fea16ff4dfd6d51d6da45444d6718", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977879, "uuid": "1411b012-664f-49b3-b845-3e0caf79b794", "comment": "Malware payload (AgentTesla)", "value": "6d5510a1328f39fd130b3e09543dba8bdeffb27a40462a8d0e5aa818ad39c3d392384b83e4d0e8721afb0aaf4ac8551e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977879, "uuid": "b3baddc9-fc2d-4260-94e9-b5e63d62d53e", "value": "T158D423E87A5B1726E88A2B3473DC001A4371F262E506E77D8EA72DD34E3531D0A52F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977879, "uuid": "87ed2107-ed77-47c4-b60f-fb0b28a7cbd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977879, "uuid": "835e1650-c964-4e2f-8af1-bef400369b5b", "value": "12288:TM725oTPEdBEwp9Wipjh36VX1l3T1/y4pSFiFiQVHV7V1DFzw5UY:TfycV9WipjV6B1xTByhrQxzw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977879, "uuid": "a4d4ba67-8877-4e22-bc17-b3b16aa544ef", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977879, "uuid": "174595ce-efdd-4d6f-a098-789116ebc8d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977879, "uuid": "c74b55ab-f40f-4924-81f9-7e3527e34881", "value": "Quotation for API 5L GR B ERW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60651cc0-5f10-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696023443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023443, "uuid": "fbfac523-8742-4be5-a985-d461419f254f", "comment": "Malware payload", "value": "e1172fbcd0e2aa086ebb4fe5efc96dda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023443, "uuid": "ab0fb410-6f36-4e24-932f-d458604f72ae", "comment": "Malware payload", "value": "d3aea6b101ef906281c7115fb142f233a474cee3e4ca23f0c9dbb412ba3395d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023443, "uuid": "176b74f8-9854-4a9f-81b5-ad278a9539ee", "comment": "Malware payload", "value": "7fdb71e384c404165230b0e2656a380adf0b9a69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023443, "uuid": "d57dbd75-f709-430e-9ac2-3a1e4dc889a0", "comment": "Malware payload", "value": "2c8ab91d0a1787d1d36d43d7df8ae9d36463a4f4dfedaa46704588e4d699ee9c39f7d229e098d59c9c5dfa9d9793447a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023443, "uuid": "ce2a835d-fd4d-4d3e-8b0f-c45b84bb7078", "value": "T1A2F42341F97F44662D49ED8794CD37C8AA4A3F90C3988E930696B9333FC6DD16C94A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023443, "uuid": "ff2071d7-bb93-40fb-8cd2-b369d6522fbd", "value": "12288:VvhmMhPp8y8d4H6rtzlrNdUPfk69eZ0j3Wj9djc2rRwWrI+rFzy7YHCxoJxube0M:TP2yrH6pzlxdUPNeZG3ka2FwWrI+Qqc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696023443, "uuid": "4d7ddbf8-db0e-42b0-98b2-4e2ad19a0515", "value": 733248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696023443, "uuid": "bab3cbc9-b351-4b70-92e9-77aee3aaa256", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023443, "uuid": "0e0f158e-839b-47ac-89bc-44b7b4e33502", "value": "@09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6dd43bb-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696010328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010328, "uuid": "c4c2507c-efe3-404d-ad78-a77902cedd6b", "comment": "Malware payload (MysticStealer)", "value": "70dd4ac9be315e8e4d813f4c9345ffec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010328, "uuid": "9c551b44-367d-41a0-bee7-e472cf3360fa", "comment": "Malware payload (MysticStealer)", "value": "d4e5e1b925cdd3e14fb36635b077e44f891c28642cd41d04b4370211889b450e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010328, "uuid": "984e81ba-0628-4f25-9110-06ca4fa97955", "comment": "Malware payload (MysticStealer)", "value": "0c7e8e41595aaeb65bef624e9628c16a0f99e544", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010328, "uuid": "a140425f-eb84-4c11-856b-ee591b75b211", "comment": "Malware payload (MysticStealer)", "value": "843ec7f696fa00f3e62a3f35c1a0c4e578d849b1fb7ac1bdf54668cd9327321108fa71dceaa0fc1251fed7ea550019ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010328, "uuid": "95aced2d-82bd-4738-998d-00fcf3f8aea3", "value": "T1BD749E9274F1C4B3DC7115315CB58BB54E6A3C223A628DBF33E60F6D4E21D81AB26963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010328, "uuid": "9d764628-1e03-4995-868d-aae6d7936bb2", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010328, "uuid": "af31e08e-706c-478b-a473-2444ce0948ce", "value": "6144:W9TeW/s5GqrO5aXnfEGIXWPvZAOCyHWLJ5vwIuHw4Vs0BC+:PmcGqrOk86xlWLTvIHwks0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010328, "uuid": "2bc1ab1c-bd10-4a30-a424-17ad01a81636", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010328, "uuid": "fb6be375-07ca-4403-8391-443c8534d0ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010328, "uuid": "77638397-0e2f-456b-bda9-86f2b3cdd466", "value": "70dd4ac9be315e8e4d813f4c9345ffec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb21ae3e-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987169, "uuid": "f0375630-46ad-4252-8f6b-471f13317458", "comment": "Malware payload (AgentTesla)", "value": "c168d1d3280b593afad44345005394c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987169, "uuid": "f4cb2504-63ec-4622-8648-fe7d9b9ff713", "comment": "Malware payload (AgentTesla)", "value": "d54779db2e1229fd52e0f90f52422accfa374f74645a9ca20503e2c8a6669630", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987169, "uuid": "a934aee9-56fc-4fbe-8111-615475718244", "comment": "Malware payload (AgentTesla)", "value": "ddc7e2bae92d3b9ffada893d9d15bfcca8e7e267", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987169, "uuid": "e655ecdc-3912-4fef-b466-0843fefc8b84", "comment": "Malware payload (AgentTesla)", "value": "73681c63b7e82e54ec93278ff7574b39379948b1bacd16fd4b1ed8510f19ce1506927bf7eb55df5afe9ea4352490c198", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987169, "uuid": "3628fee3-fda8-4da1-8957-a11da24a8271", "value": "T141E412026BC91281F6BA677AA9B1117113B77A119D39CF2C08CC51CC5BEBB91FA04F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987169, "uuid": "6ae635b9-3fbc-4126-b366-f6e00662a6db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987169, "uuid": "7039a9b9-4c5b-4fa9-84df-a7b805861a58", "value": "12288:KccAckjm+aMz4vYr9Jm1Zcq12jFncwQcs4T/9naWP8I6aiCwPtck8YU:ski/M8qmjNSncwFZda5aiCKCTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987169, "uuid": "7d399b8a-b403-46e8-932b-509bfd363285", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987169, "uuid": "313a221b-3b7c-4d81-b197-14ad1b1b0b37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987169, "uuid": "ac2e7975-96cd-42c4-8e47-5f556f237cbb", "value": "SEPTEMBER SOA UPDATED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a615cd1-5ec9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1695992939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992939, "uuid": "d4b648cf-3b67-4eb0-8062-a580eaab1034", "comment": "Malware payload (Amadey)", "value": "03f32c1a791dd8e77edfa3461e31abd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992939, "uuid": "d3c50868-1bb7-47ad-80ef-12bfa5a6b66e", "comment": "Malware payload (Amadey)", "value": "d56fce345a819f325a7a6ca050d1705d7b9fe4135f179dd22416228fa706acca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992939, "uuid": "560f740d-ec40-4d35-8ab9-796fa11e289c", "comment": "Malware payload (Amadey)", "value": "738fc2eb5a41ca7457a2854641bd50ef49d71b3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695992939, "uuid": "149bb0d6-8ea9-4ab7-a34f-69edf3bd57fc", "comment": "Malware payload (Amadey)", "value": "e810e3b0861b14e4658a9e6024677f4b6a9e0f1fe2f17f1db7a1b72e7f5555ffe28a105dfb5e79174f66a2f1fdd62270", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992939, "uuid": "f34fc911-1ecd-4258-9b5d-4c6269c10537", "value": "T1DC936C1030D2C071D57E55351478EAB68B3DB914CFE08EEF27551A7A8E702D1AE32E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992939, "uuid": "f2facf97-9fcb-4f65-9186-e4b7d79f703c", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992939, "uuid": "ef051cf1-a9e2-4a06-8f8b-5ef34fbacf1e", "value": "1536:uuON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJU1aI89p:uuhVZbtvbpxLHoUsYuNhV25LJU1aI89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695992939, "uuid": "d4716568-9d2b-47fb-96cc-0cdd4c6e3a94", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695992939, "uuid": "7e34b496-9ef6-439c-b0d5-6ff264e7b2f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695992939, "uuid": "1df8dec9-5719-4a28-ab9d-a4e0e98f1639", "value": "03f32c1a791dd8e77edfa3461e31abd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc11cb68-5e96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695971252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971252, "uuid": "81d0808a-8aa1-4a14-9354-1cad3fdd9635", "comment": "Malware payload (Formbook)", "value": "913744738f2b860bd44bc49b36c289ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971252, "uuid": "9d9d1d83-1dab-474e-b9ac-dae0c722d856", "comment": "Malware payload (Formbook)", "value": "d5e591ea8f68073801567e09b4323723d5cf1232ce0225365b1e74ee1cfe2c44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971252, "uuid": "d9ea7a09-f2ec-47ce-9a4f-7e07348005e3", "comment": "Malware payload (Formbook)", "value": "834131c19deb14c6f857b27810973e4685b86761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971252, "uuid": "26470fa1-9366-41a9-b412-65659e9c233d", "comment": "Malware payload (Formbook)", "value": "9d4ee53fe5bc6df6cc2b774cbecbbd7e0546a398bbb72eb4ca43d19de20eb93f067e96434c707959b6226d383ab94b31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971252, "uuid": "2f7fa2d8-13e0-4883-bdbc-637f84973337", "value": "T19005F53C21ED2A88F36596BCF3744EFF57D5796F81ABB8B7AC4CA59306A57C04502220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971252, "uuid": "ed6f2ebf-2ea3-46fd-8832-c2ebe0b03760", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971252, "uuid": "a7df8840-6cb8-44fa-aa8d-98769e4baeee", "value": "12288:+sPw/6P5EypEx2kRGviqVAKfm3lfDnRc7EWMToEoRP7uaSwo:+sY/MmypEEkgHxofDnRc7EWLEoF7jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695971252, "uuid": "c6beaf20-4006-45b7-9acf-87d86891db11", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695971252, "uuid": "4f037ac3-4cad-43f1-9d7f-5e26618332d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971252, "uuid": "ee3ec34a-d573-4806-b9cd-b964579884f7", "value": "NEW ORDERS scan_29012023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd9a971-5f17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696026417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026417, "uuid": "e8fbc2e7-e88b-4c4d-a870-8af2634797da", "comment": "Malware payload (Mirai)", "value": "96ff9dd1fa1635cf231c498712e75466", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026417, "uuid": "bd17c8f2-a375-4344-a3df-21d745a423e0", "comment": "Malware payload (Mirai)", "value": "d60ec612652b36efca7728403182918dcec6258baf195d4fae76503c6fc49c35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026417, "uuid": "47600c27-acb7-495b-a746-c5ac7df16e43", "comment": "Malware payload (Mirai)", "value": "1aa0f1867fa2ffb9ad419de6251bde2762c00f44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026417, "uuid": "045cd093-c5bf-4808-a0f8-bee33cb95606", "comment": "Malware payload (Mirai)", "value": "5047ea2886d415ad58fe46c05ffed8c0a5e2702ea2cddb38d57ab0901b1ea459d954648bd6ae7a9148d6bc42b3da4fe9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026417, "uuid": "d1bb6ea6-de26-4c51-acda-0c43e9b5fa0b", "value": "T13FB2D01AC0AE6E74FEEB7D345D41E2817B619BDF3A618DC016C15B010622D7C1F9CAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026417, "uuid": "284916d4-ad15-4454-88fe-62134f47e152", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIorKVM4uVcqgw05VA:2AApCdvwJr69VJoA8FZtxCo8i94uVcqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696026417, "uuid": "01cedce4-922d-4e28-a7e4-ea0348ebb4ae", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696026417, "uuid": "9b3b81c7-8247-4b5c-aaa9-ee49f56a76cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026417, "uuid": "8c0b4f2d-ae4d-43dc-9734-8596b1cbd090", "value": "96ff9dd1fa1635cf231c498712e75466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2712674d-5f02-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696017334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017334, "uuid": "56a47b27-9b0d-4995-a257-85744d755e0a", "comment": "Malware payload", "value": "2f3f0d34c628ab0fd557ce866bafd4d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017334, "uuid": "ff61958e-4cf6-4636-8759-fe8373a63508", "comment": "Malware payload", "value": "d618c817e6a93193a499126156a1f7e888008dacdb247a769fd69ce4c0c87b67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017334, "uuid": "88c4d283-44b6-4936-ab54-5bdd0e21c624", "comment": "Malware payload", "value": "50663dcfc920cc955ec0b43c82a3fc008fe7b08d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696017334, "uuid": "16d41103-d104-4c25-baf0-5758e5dd353d", "comment": "Malware payload", "value": "67e10fa747c4fc5f21ae9f174581fe933e2800f0509d6995326b4fd0c90e4b92facf2cdbd2a488dd6099d55750b91d15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017334, "uuid": "8d8f502b-f01b-406b-a460-c1f4eb9c005e", "value": "T13473F703E94545EDC05EC1350B6F723FE63AB5BC423DB6AB5B80EA325D16D20CE1EA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017334, "uuid": "e021a33f-9cb1-47e7-98d4-dfde05f66956", "value": "1536:wOfmKQ5ZZFlqykbWg7YKFXBSKwhSmdqZwpKSP1wda:wqtQ5dlrW/BSKwhSmUEP2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696017334, "uuid": "0e196e83-bf45-4a2a-a1ee-b79542899507", "value": 75000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696017334, "uuid": "ec10ac3d-b1c9-401d-abfc-076acd7f8325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696017334, "uuid": "aa908d8c-20ee-4a8b-80e3-4eaf8f91777c", "value": "lolx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bde26e1-5f0c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696021825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021825, "uuid": "eb70d5d7-289d-4da7-a726-dba7d4c69dfd", "comment": "Malware payload (Amadey)", "value": "b052f5ef3dfebe20d00b345c6424292b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021825, "uuid": "7bfd631f-a27e-4e4c-b6ed-65dd2fbdddb2", "comment": "Malware payload (Amadey)", "value": "d69958c38bd04cd3b71d6e43032fb8466ffc5f7cf90d524120bfd23f9337cc8e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021825, "uuid": "ffeb32d7-d8c3-4cf9-8335-92b29351c5fb", "comment": "Malware payload (Amadey)", "value": "2be5429aa5b38d7c7cb080b8bc07d9e99d50733d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021825, "uuid": "0736895d-8cff-497e-9203-eada55555d10", "comment": "Malware payload (Amadey)", "value": "b97721762c9c70d3388636a45ab0f8c398dac799aaa15cd42c8d604c497b51d205e264a3fa8bcfcd4618d66e6c61ee8a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021825, "uuid": "1ae9f0ab-30b7-4744-85b2-8341697e6a6b", "value": "T188352312A6D89071EDB527B40CF713D366387961893C834E6A81A9AB1D33798E0377B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021825, "uuid": "8aa68309-7d10-4ff3-826d-51d4bf7434d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021825, "uuid": "1e6594cd-e96c-43b3-8254-3ea10965d6ca", "value": "24576:Dyn30OXWeLe8swWolpYWrvy01mihz8ELKrBsmoXUe+j:W3P68HWol6WTyZ9rBfe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696021825, "uuid": "bdb44630-38fa-4648-9ace-88dbe33638bc", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696021825, "uuid": "f248e5ef-8dc5-427c-8711-5f2bf61f2763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021825, "uuid": "26144fef-0fd4-4aba-95e0-f4910e76fd08", "value": "b052f5ef3dfebe20d00b345c6424292b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8324050-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1695986707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986707, "uuid": "26e8f98f-7f53-4c7b-a903-4ee981ec3580", "comment": "Malware payload (XWorm)", "value": "f1e2837c633fd4e56a337b821204f5f3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986707, "uuid": "62776a9e-748a-4b8b-8d70-8c43c19c3d46", "comment": "Malware payload (XWorm)", "value": "d6d2fd916703877c65003236a82977a38fc1985dd53a10ccdc2e9e87d944880c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986707, "uuid": "8c5e1be6-7979-489c-976b-337b29219cae", "comment": "Malware payload (XWorm)", "value": "e69de9d01dde4f6b4a59c92ba8b1cd0e76e06d4e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986707, "uuid": "0e72d837-cb5a-418c-bd91-b21aa8ef05e2", "comment": "Malware payload (XWorm)", "value": "6fc4cc8ee86838b83533050eca1236b8dc66abfde309ac997528f93b7d18e94816bdfd661dca426d05b0c09340481085", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986707, "uuid": "cc3dfdc1-25bb-45ab-9fa7-2d7103241181", "value": "T1DE84BD103AEB544CB2737F531BDCBAE54E5FF7B26616A46D2404030B9A67E80CDA5B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986707, "uuid": "f34bc876-3e26-4e9d-9d0f-723789c153ae", "value": "3072:wpPFVyheQQTzHT8DSZSlAjl4nJXZgvmJNecfzTPr+9Zr+Hwi5nMfxNf8fgfPwwE6:23CAZ4J+WUEzT5nQ3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986707, "uuid": "d486b286-61fd-45bc-99ee-ff3214740cbd", "value": 397456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986707, "uuid": "715e958b-0150-42a8-845e-4411623eb23d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986707, "uuid": "79a549bf-8436-41dd-a92c-9152d8640e79", "value": "Wire_transfer_D1220_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86622ca4-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987429, "uuid": "ac03b92b-30c8-4ab0-a1e6-b1554d0a01c3", "comment": "Malware payload (Mirai)", "value": "6656da85f4eefcee7c2307d3787eb2c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987429, "uuid": "1f5c99bd-b85f-48e7-b4cd-836b00fb3608", "comment": "Malware payload (Mirai)", "value": "d72152265ae83f0b43cf947898bb52482eed12fb727792f9a37eb609a8dd1420", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987429, "uuid": "f1660deb-0a58-4995-b75d-08dd64ed594f", "comment": "Malware payload (Mirai)", "value": "c8f9578c84b6c4bc5c0d658565c74dfb10df9981", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987429, "uuid": "7d48a202-73bc-4666-9bb2-9523a45d0930", "comment": "Malware payload (Mirai)", "value": "2c2cb8640b0f160536c5aa6e2835bff393ab310da68e7e755be9b5e2b1430422b5b6db0339f7dc2500608c4a30ddbcdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987429, "uuid": "b3406767-7adc-4421-9cc8-194e545f4986", "value": "T171336AABDC352E84D52889B4B1308F7D6793E52586472FAE506AC2759043FCEF9023F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987429, "uuid": "964c1a38-0d90-4055-899b-74c5d7cddb6c", "value": "768:klI2DFBPsuuy0jf5S4fo6UKSArlakoVFzva9WCwhk19fIcT/fCwCI:kl/D8PfEGAKSAroTVFSMCw/cjfCwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987429, "uuid": "2a9a3b48-cace-4bfa-a82a-9e7725b8888a", "value": 54560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987429, "uuid": "5d94cb02-6719-4ec1-973e-7f171f0ec7c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987429, "uuid": "4a0c4057-faae-4919-8657-3b47829929fc", "value": "6656da85f4eefcee7c2307d3787eb2c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc6f865-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PrivateLoader)", "timestamp": 1695991008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991008, "uuid": "e8fd19db-8532-4b4c-b397-363eb2dea38e", "comment": "Malware payload (PrivateLoader)", "value": "a7ee1f4bf11bdfab2327d098c6583af1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991008, "uuid": "d085575b-6501-4217-a3ce-dd2ce055facb", "comment": "Malware payload (PrivateLoader)", "value": "d74686c87f0777d1e8c4fcc18b40fe3ce97d6e531e23b6665037e5599b72aa32", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991008, "uuid": "36c6c9e6-b800-48a4-b4f6-b5daca3866d5", "comment": "Malware payload (PrivateLoader)", "value": "b59a2989c0f48597f691d3ead8f549f2327c6d0a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991008, "uuid": "61b3e070-368b-42fd-ad19-fffc6d17892c", "comment": "Malware payload (PrivateLoader)", "value": "e90e1c87fefb9c55667a064cfa5e3a74ff07d5f3587c4ca188516924aea2408bc2e75c0114d99d2f6cead3002b4fb827", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991008, "uuid": "b3ed3b03-28b5-418f-987e-ff7b92d30885", "value": "T12A6612BD7748330DC05DC4355833BD87F1B3552F5AE8A46AB2D7BA8067AA721DA02F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991008, "uuid": "2d2b9b88-dbd5-4684-8c24-14b6baf40332", "value": "504d78790e3f8461b1aa5a2fc85391cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991008, "uuid": "45ac1e78-1bf8-4a15-a8ec-f5ac6d03ed53", "value": "196608:XdatXBkprOtdefgVeIXcIv/W5yYtjR1kJA3iaAim:NaVB2rOtTVew5/W5n1LkJA3i3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991008, "uuid": "92aaa838-eb8e-413d-a84d-02168b7f6442", "value": 6781952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991008, "uuid": "c587ca51-b54f-4d7c-a6cf-701633e4a77e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991008, "uuid": "a1b1a260-3efb-4e0d-8a4c-125bb1787893", "value": "a7ee1f4bf11bdfab2327d098c6583af1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecc1c79-5ea6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695977860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977860, "uuid": "fc3a7d7b-4265-4155-8f5f-85a0d6a2b405", "comment": "Malware payload (Formbook)", "value": "12b652ec70aefcda478ba3db7dade2ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977860, "uuid": "e9dd5dc1-7c81-4e2d-9dcf-3fc4d886a11f", "comment": "Malware payload (Formbook)", "value": "d791946e423b64c9ec976a5b9491b6ee9294e8dda0e5707ffbb4c96448b908e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977860, "uuid": "0fc6eb7a-b830-46f9-bc77-0409e042ee2d", "comment": "Malware payload (Formbook)", "value": "bb76a7b8eca4575a6a5400c03a46abc3d6b3be2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977860, "uuid": "28eeec38-b9f9-4aa9-a992-b60fdc2926ed", "comment": "Malware payload (Formbook)", "value": "243cd656884867e9120596f53a8f9ffda635cf54a77e7b090c517a67245315cdec7e98f276b99d35cb86168ed307447a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977860, "uuid": "018f1e21-3c11-486c-9a5f-3565995089b3", "value": "T1DBC4129979EA0766CA49537A1E9C873B03B0BA91C610E37DC1CB70CB46357981A36F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977860, "uuid": "2ff33521-4bb0-4907-b00a-9644588c1b2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977860, "uuid": "846a1cde-9333-43a0-b3d6-77b6e90ca6dd", "value": "12288:9g725DuLH+qhoWaJByQZtPiY4RkONr/4GR66G0YvQFE5La:JQz+qh5QXaXR3/4GR66cvuE5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977860, "uuid": "5ff3a6df-ff30-47ec-a988-52e6221e621f", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977860, "uuid": "c27b5d60-87ae-4c3f-b02e-48e1591620b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977860, "uuid": "2f5eece1-2dba-472e-8c5e-75cb961b6055", "value": "\u10e8\u10d4\u10e1\u10e7\u10d8\u10d3\u10d5\u10d8\u10e1 \u10e8\u10d4\u10d9\u10d5\u10d4\u10d7\u10d0 xxzc3 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e2dad7-5ef8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696013017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013017, "uuid": "cdee4926-e049-4a05-bdab-e0732e7e3a3a", "comment": "Malware payload (Mirai)", "value": "ecdfba3005a0171e64600eeb73aac1c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013017, "uuid": "95aa8fbc-2166-4eba-a902-203345f341fc", "comment": "Malware payload (Mirai)", "value": "d7aa2295d5f963ac2214944c67f4f221d64acf30507c4682e828d594381c4735", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013017, "uuid": "6b0b0114-54e8-4bc6-be01-66bfb516324b", "comment": "Malware payload (Mirai)", "value": "b4aa8d1002c9e9308a7a9e8149db5dfb3c3b961c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696013017, "uuid": "73afb048-3722-44db-b732-efd2b8d988f8", "comment": "Malware payload (Mirai)", "value": "d22dea1acc1bb0c7d9902f9a69f3297b67479fc8f7bbe3ed99eec7c0d66d2c14dc365a7b714236a412081e9bb1934223", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013017, "uuid": "6c709ec7-f118-4a8d-8f89-a8f3f82b1bc1", "value": "T179C2D1E07726FE31C520AC3EE52A4D8A7A51067CD1FF343664258D398EC1A5B63F84E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013017, "uuid": "fcd0cbbc-36c1-4fb8-baa9-2e5ede516c92", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrZe9q3UELuc:NKy4qfqoeJdXWgtLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696013017, "uuid": "1d63656c-908d-4132-bceb-6a3bcfc43269", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696013017, "uuid": "f55da280-3985-4b3f-81ef-8cbf5a87e9ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696013017, "uuid": "92734c09-23e1-4d0d-9b29-767ffd03bc5c", "value": "ecdfba3005a0171e64600eeb73aac1c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc53b3c2-5eaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695981990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981990, "uuid": "5f0a9df9-2f0b-4a86-afe9-d21ff79968cd", "comment": "Malware payload (AgentTesla)", "value": "1fe7aa06351db0592fdbae883ad89612", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981990, "uuid": "3cdfb24f-743a-44d6-aaf2-e3c536d18b8c", "comment": "Malware payload (AgentTesla)", "value": "d85278c4099b913c69779c4b69a0c85cbb0d7cbe72ae9a324b798a0fd2e02fb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981990, "uuid": "b8e96ffc-8f57-41b5-8316-0337af4492c9", "comment": "Malware payload (AgentTesla)", "value": "ee4722045ab7fb697a3badfe5ebf8e2ea74ff431", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981990, "uuid": "187c6976-55bb-4f52-a3ce-7993a10e3eee", "comment": "Malware payload (AgentTesla)", "value": "75dd0ae45eed961bad3d29ae6ff2d9f186c630ee615396e529104782fe285dc63e808de8e4edf64c0ddf9414bd3590f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981990, "uuid": "a264cdd0-4a06-4989-a142-0d007d8fe44c", "value": "T12A343B58AB5D8123D7BF13B2B65212475BF5C586E186EBCF249C28F20C8275AFD4432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981990, "uuid": "840ffbfe-9afb-49d1-948c-af10483e7a8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981990, "uuid": "d552d1a2-fef2-46d9-93a4-0d5456715397", "value": "3072:6YSIIqUV1ak4igyVOSEuXKf0ykp2XPi+kVk+WG+UoFZxInEUo0:6rxTykVVXWG+UoXxIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695981990, "uuid": "14448e60-febd-4705-8d6e-3892d0a93a05", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695981990, "uuid": "f29fc533-752d-4af9-a143-c81cefb051fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981990, "uuid": "61aa2675-047b-4db8-bafa-eaa8011409bd", "value": "PO--080523-FM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bae1bc-5ebd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987888, "uuid": "5c2dc7b0-d53b-4e5b-856e-1cd38a56cbb2", "comment": "Malware payload (Mirai)", "value": "e8617837aec3e262406aea8c2e877b2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987888, "uuid": "9a30b886-37fa-48a3-88e0-6b5873fea850", "comment": "Malware payload (Mirai)", "value": "d85a68ffd80e249e906176b79ad8c8ca016ac287166b636b57b654cb92c30d13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987888, "uuid": "47ea61bd-22e6-41b4-9ac8-5b11398e574f", "comment": "Malware payload (Mirai)", "value": "71c39d120ea5728fe2c97496f6e4a527e377030d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987888, "uuid": "edd95e41-a51f-47a9-919c-194afffe0247", "comment": "Malware payload (Mirai)", "value": "676e42aab5c5664efa321b12bed8a106f17935279f0ddf2a6b0ffa5f2de3a567e45c9c344d6c0452e213ab323f68c31b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987888, "uuid": "f0ebd5ae-001a-480b-905a-a61af43028ab", "value": "T175B2D0B17024B8B6C7A100B75AE9DA43FB801EF8D0E8732A1465199DEAD5942BAF1147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987888, "uuid": "b7ac76fa-c621-4ef9-b4ef-a0ff49e66b01", "value": "384:cZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3pShymdGUop5hA:5X9nxn8o9wnBoWzEQf2EjKb3pSs3Uoz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987888, "uuid": "c7bea9a1-a411-41b8-9db4-512cf112e07f", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987888, "uuid": "b3cdd35b-7821-4e48-8014-35ee9964cdf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987888, "uuid": "749451c1-0fd7-4c3a-ba71-d1423669cb1b", "value": "e8617837aec3e262406aea8c2e877b2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e5a7a8-5eaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695981863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981863, "uuid": "c306febc-5c15-41c3-91fe-d63312c050aa", "comment": "Malware payload", "value": "985ed1bc3397c24669a1dae37ce09438", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981863, "uuid": "8c31ab5e-b6d9-4623-8521-b8431067f34d", "comment": "Malware payload", "value": "d8748d675e719b93f27cb865ffd5ca0fb7924c11d23ebf51ff45b36339fd1b89", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981863, "uuid": "8ffd0eec-9a79-47e9-be3c-1793925a630a", "comment": "Malware payload", "value": "5e1e04e3e3dfaf11ce72a7f3827ba47008788126", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981863, "uuid": "acf2993e-4506-41aa-b977-cbad77780194", "comment": "Malware payload", "value": "c39e77fa90e8cc3c6a47d71ad618950b9976158b06418bdc3b43a8d70696107fe3eb9f106b7116284c4169eee78394f4", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981863, "uuid": "534b6b70-7b08-4d3b-b9c3-d35e28ce6a92", "value": "T17555D00FA904CB86D10D83F47E1369D80A0D7F19EBD569DB24923B8F3E316A259CA5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981863, "uuid": "544ae944-c710-4494-a12b-4e55966001c4", "value": "24576:uWQmmav30xSZyEw6VdU0YZyhw6VGU/n5baEITYRJSf/wmx:jQmmQ306k6Vip6VnaLTWSnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695981863, "uuid": "49130896-8b69-4e58-a336-b467d608c5dd", "value": 1292288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695981863, "uuid": "f210f2b9-b515-433e-a6b5-f48879d93645", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981863, "uuid": "9626003e-ecba-46d9-9810-98ac46d906fa", "value": "RFQ_10-2023-0120_7134-MDS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa8f8ef-5e66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695950696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695950696, "uuid": "da727ab0-ef34-46d4-bde1-eb87608de712", "comment": "Malware payload (RedLineStealer)", "value": "90c17d00958a5c8ed54caf7502c15218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695950696, "uuid": "95684e91-be80-48dc-bbf7-8c8ec7d6e2b6", "comment": "Malware payload (RedLineStealer)", "value": "d8783fda9d10bb55a1376a2e08240f51b7cb9e108842ee188f728edd8cddec4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695950696, "uuid": "2ca88c9a-9dd0-4326-8365-cce84b8f591e", "comment": "Malware payload (RedLineStealer)", "value": "bf65590a7991b6ff29c3f38a9c43285869568435", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695950696, "uuid": "cad1ffc2-1dec-4053-a523-99fd1f84e470", "comment": "Malware payload (RedLineStealer)", "value": "92bdada42553ae33bb8c7bb9c56fa84ee22c2f1e3c67577ee2e6050c5337d6ae792cda03bce7b16e755ca9918b0f28f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695950696, "uuid": "b49fd225-34c9-4239-bd26-a191c3cc6ff1", "value": "T1D0A4E11373B1E871E0669A315D3AC1B4263FBCA19E6963DB33487F2B68701E1D666703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695950696, "uuid": "4a6b8091-d56d-4f22-a781-a4df843c5764", "value": "d749dd3982d2564e67503d7c8e1b49ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695950696, "uuid": "5e494ba4-f75b-49d8-a6e7-8aba202acc06", "value": "6144:QTKDFOJzag5YJQChO+7+0inSmXJN8dmGaLQZd2pfkqwYGFxJmG5SDDD:IsWzZ5YJu+76F4UVfNwYkmfDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695950696, "uuid": "399335dd-4a4f-4101-9db0-a27f1aeac49f", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695950696, "uuid": "569871ae-6377-4575-9e9d-92dcbbe928fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695950696, "uuid": "87be9e70-0dee-4f92-8dbf-4d320bab8a4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ae8305-5ea6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695977870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977870, "uuid": "ae6e995a-f5c8-477c-bbb0-3dfd08eb2a00", "comment": "Malware payload (AgentTesla)", "value": "49faba5e92d50d48bdd569c84bf58754", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977870, "uuid": "17e69112-2abd-4f59-b8ad-b918d7c5a94c", "comment": "Malware payload (AgentTesla)", "value": "d8c49ba8b26cbf93164e1051bd1322d0e855b4b15357fcad7a05edbb40564078", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977870, "uuid": "77095349-f1f0-4efe-924a-f5bb1b27582f", "comment": "Malware payload (AgentTesla)", "value": "213e18e6a71912df410a82d63cadbb5b59f819fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977870, "uuid": "9eff868d-2a6f-476a-9242-48f5e31a20fe", "comment": "Malware payload (AgentTesla)", "value": "39cd521e7de04d15f125d5dd2b0c049c0f85a2b1aec516d9cbce02a3ddaed9fb753c78d631fc2cffc8acfc13332fa904", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977870, "uuid": "d16bf528-8795-497f-85c8-f243613a7868", "value": "T1AAD423A879A14F31D68A033A965E29F58375FA0E7513EB64DEEE114B1F70B6C0230B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977870, "uuid": "34bc5046-9d4a-444f-bc5c-48d512815fbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977870, "uuid": "ccba0e17-233c-4b37-8378-60480040db62", "value": "12288:c2725avMiLYi0MM+USEqMw446zCkkbXxJiNO7s2c3ao9OquxUijzFA8dZp:8oHYicSjMw4FZODK6sjao9NY5AsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977870, "uuid": "b0498e31-5865-4f20-88f2-e4da51ad49d0", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977870, "uuid": "cd350f62-fb61-49c4-8339-40c9a656f970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977870, "uuid": "c379e68e-964c-470f-9644-f0e427ddbaab", "value": "M0JyvtynxVViWYp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c9ee88-5eeb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696007611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007611, "uuid": "7766f283-e29f-4041-8b1b-ee5fc29171b9", "comment": "Malware payload (Amadey)", "value": "aebaf57299cd368f842cfa98f3b1658c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007611, "uuid": "1f32f175-d2cf-4c00-94e7-40ca018cd341", "comment": "Malware payload (Amadey)", "value": "d9131553ec5337523055e425db82038f4250fa60ea581bcc6921716477c652ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007611, "uuid": "33a46021-e95b-4190-8263-ab5edc328bec", "comment": "Malware payload (Amadey)", "value": "cb4642f3425e8827e54a95c99a4b7aa1ae91d9b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696007611, "uuid": "d0d7e567-1e61-42f4-adb8-e58cee1101b1", "comment": "Malware payload (Amadey)", "value": "1b04c6beeb9585cda41b8fe1288ef3eabf12c9b035d0aa1069560020b44f1b635a9288a6baadcb1253dd3d3bf812437d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007611, "uuid": "2f0a2f5e-f66b-4811-965d-3769a8f3d289", "value": "T1923419657916C032D560A1B61DB5BFF2C19DA818ABB049EF2B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007611, "uuid": "c38c194d-ca08-42e5-a6ed-4084871e9882", "value": "b4e0be0bbc0b6cf93837773846d3b934", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007611, "uuid": "ca2b87db-46b9-4234-950f-be9ee2275bf7", "value": "6144:k5tErvkeLE0X7J7bhi1g6FKVu+dnX9ys8l+:CYkeg0Nbh6FKu+dnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696007611, "uuid": "3d94182d-83d8-4d19-8169-616855275c6f", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696007611, "uuid": "d62b415a-9a67-43b3-bdbf-2c0ad7fe9f85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696007611, "uuid": "c0f008ca-23bc-4312-9144-373f8132a973", "value": "aebaf57299cd368f842cfa98f3b1658c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9f7a21-5e9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695973746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695973746, "uuid": "3e7cfac1-41a0-4fbf-a0e7-a3dfdebdfd14", "comment": "Malware payload (RedLineStealer)", "value": "7fb206715e38dd139d4247f2f5fd80d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695973746, "uuid": "53d506a2-d6b8-4772-b252-8eb8943479ca", "comment": "Malware payload (RedLineStealer)", "value": "d9a729c3b6a1d94495761b3c6fc329ef7ffabe8c8fdea534070c7d44e59ea349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695973746, "uuid": "46378541-0104-4612-ba8b-6fc04d4ae763", "comment": "Malware payload (RedLineStealer)", "value": "fbd6a09c4a0fc67c89d53b316abd4d153e025547", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695973746, "uuid": "08f8dcd6-fd77-4b34-9003-5c9bb0e32017", "comment": "Malware payload (RedLineStealer)", "value": "c576c849bf53ecfd24e59328b540b76404bfc39b71a66952f4fa1db8d9d32bf13cc4de8ec3eb17b0eaaf0e220bce6666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695973746, "uuid": "d4d439d9-78dc-4412-9965-cb0150356945", "value": "T19E357D2079C59061EEF330B373ACF766665DD4B40B241ACBA7844BEFC6602D16E36D86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695973746, "uuid": "61bf4a67-fc31-41c7-a62f-b8419de97f3e", "value": "d215e7ae5c8053185b6f0c1eed2c8e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695973746, "uuid": "04bf850c-1bc0-42e8-88ab-1df2f117b7d8", "value": "12288:A+EAoTjelkz2ncnNmU+Q2N7Ls/WMDd/Z9FFsDuVy9sJoRmuJV/9:A1Ikz2ncnNmU+Qx/LJPsYiRB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695973746, "uuid": "bb265f7f-a2fa-45f9-a926-80c43c0e7a0e", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695973746, "uuid": "ffc07428-d912-461d-9ed7-dfd6e4161556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695973746, "uuid": "aef1bf73-2c1f-4a83-88e7-8952d50d048f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866503c8-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977121, "uuid": "6337f33e-2131-44ac-b60f-389797883fcc", "comment": "Malware payload (SnakeKeylogger)", "value": "a838d82a97f958416bc08c5985fea8ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977121, "uuid": "51fd8f65-51b1-4dcd-9c41-3428f545cac3", "comment": "Malware payload (SnakeKeylogger)", "value": "dab25832e2aa9b1844f34e23b9f7bac27dfe2af2ee2c9a5bbec45638caf87b05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977121, "uuid": "dbe60d38-6618-476d-8297-9d696005aa58", "comment": "Malware payload (SnakeKeylogger)", "value": "b767c972b9d0f7779dc33af62ecdf0abe593c51b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977121, "uuid": "5735f8bc-6ffe-479b-a5eb-d214421bd3dc", "comment": "Malware payload (SnakeKeylogger)", "value": "5a93618a66db91ffdf9b5c3af7e7474e83eabb69b9c122bbf5fba623603beb48f7ef4873cfe7a8cc3c5a2858d3826722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977121, "uuid": "802464f0-0608-4502-b051-77d75ba19e99", "value": "T1276402A2A6A54732E4720BF4C2260E6347B8373BD165E6409F98F0CA18B7FD25543F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977121, "uuid": "cdc6a61d-5767-4b66-b4be-27833162ddf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977121, "uuid": "208abc01-abf1-4200-a32c-be70483e9b44", "value": "6144:6rguHQQbURQH4SAisJeiF91l5xx8pSIHZKO7c:6rguH/URQYSAisJ9jx8pSaKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977121, "uuid": "225100d7-cd8a-4a12-ac08-23e3ae717c51", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977121, "uuid": "7cd15d7a-39cf-4e1c-a0b9-0fe08cb0f13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977121, "uuid": "b2cee6c4-5c31-4a7e-a00c-d434e3f9a1d4", "value": "a838d82a97f958416bc08c5985fea8ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67744916-5f16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696026032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026032, "uuid": "a0d934b1-21b4-4ca3-91c0-03307e6cd50c", "comment": "Malware payload (RedLineStealer)", "value": "ac8f7a45a57c16b994a015d3cc3c4071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026032, "uuid": "4768d688-f0cb-45b7-8d32-088afe4d28f4", "comment": "Malware payload (RedLineStealer)", "value": "dc5cf343121b5e6ac962622babf726b1ca590760793396176546bbd7420400a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026032, "uuid": "cbc3e50b-f231-4cf9-8cca-3691e5dbc6ed", "comment": "Malware payload (RedLineStealer)", "value": "0cdd6bfa4db900674addd15d294798417dae5c1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026032, "uuid": "2d8873ae-8248-469b-b089-bcb3d3a5910d", "comment": "Malware payload (RedLineStealer)", "value": "84f0542f6a809691c268fb298d13d46e89228ecc445b3b3d73b6626c079b659e21422db763de986d10653f88bc5c2d4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026032, "uuid": "0dbafc4e-5d9a-410c-a589-de82beb61481", "value": "T1B7946D11E408ECE2F0D306B59864FA40AA5FF398016C19077A73BA6E59B7EC33566D4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026032, "uuid": "cf096a54-c381-4f05-b6a7-d0ccce22eb60", "value": "408ba2c23dce610d3cd9003c6890be58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026032, "uuid": "9b3ab2ff-e191-4ce6-9310-600914871aff", "value": "3072:QUaWHhdKJMcrUnx+he4VSp4qbrJ1OZIaxzZiqqowg7xrD5XpYwNLx:QUXh4HUnYQSKazUUpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696026032, "uuid": "83b523f6-c89e-4cab-bac4-aa3ce944ccc6", "value": 432713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696026032, "uuid": "ae782366-a119-4498-a46d-b491e7ae2fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026032, "uuid": "dc17ce97-dfde-4527-ad61-70716294b86e", "value": "ac8f7a45a57c16b994a015d3cc3c4071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00801598-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695990641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990641, "uuid": "b4ea4e18-f172-4d40-b419-fdcc0867d45e", "comment": "Malware payload (Smoke Loader)", "value": "4d4471f479bcada90abe339201de8ae5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990641, "uuid": "a66ba2eb-ec47-4131-8720-429ab020f35c", "comment": "Malware payload (Smoke Loader)", "value": "dc951f02c05c7f121e711adb4521869c66fed07ff3d0afe0062075dbd09805a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990641, "uuid": "ec570f95-55b6-4b53-931d-d679b63aba6a", "comment": "Malware payload (Smoke Loader)", "value": "6534ca219459816dbbbb43c1637522a93c4c312e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990641, "uuid": "54cf4e4e-c851-43d1-985f-a2182a2b6447", "comment": "Malware payload (Smoke Loader)", "value": "fda0e63f6b8163aa184fc804599ab2fa5cf4ced7e0633ad6acff0b0782c19eaaf9bc2d1d12625c1cefcaa27b6e4353f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990641, "uuid": "1dc2664c-deb9-436f-8179-e82da8d36b48", "value": "T14F34BF1252A2BC61EB674A71DD2EC6E83A3FB5714F69672733145B2F08703B2C2A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990641, "uuid": "eedc4662-d95a-4ad1-bba2-f7f8d63f4f56", "value": "cceb1c098bb76547116fd8d11380b21c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990641, "uuid": "08b208ed-ed59-43c5-9f04-801f16d2ed4c", "value": "3072:lXjXluALJpCYucvxw/nFFmu9vGwRb8W9Sefh5mZKpDz1Tvskt:hJuAKY/vG/nFuwRwwSHQpDhTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695990641, "uuid": "4de5a18d-9b79-406d-9d0a-b4e0dac9c4d8", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695990641, "uuid": "fc6af8bf-d2ac-4acc-8774-40556c1c4c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990641, "uuid": "4bdabef8-8eec-4b11-938f-01339828ae3b", "value": "4d4471f479bcada90abe339201de8ae5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad692bcf-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (jRAT)", "timestamp": 1695986636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986636, "uuid": "a9cd4a3a-e185-498d-bcc4-39740775f234", "comment": "Malware payload (jRAT)", "value": "03cafc9795167024248f1720a68c9d85", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986636, "uuid": "39f65dc1-4777-4a06-b954-6a80c433adb1", "comment": "Malware payload (jRAT)", "value": "dd0fa431e8726916834ea46e4bfe8c7ecc76d5d2b9fbed452b682f0899721686", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986636, "uuid": "1f2bcb0d-f6d0-4466-8405-32206021da39", "comment": "Malware payload (jRAT)", "value": "ee873109ee619f592603f188cd2fe04652afd0f1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986636, "uuid": "c1fa36c7-4ad5-4921-bb94-4fe4a0257136", "comment": "Malware payload (jRAT)", "value": "184c343a199de95dc2c02506ffbb0c2d9bc084cd6a3a0369c64aa17d1d725108064cf1f6c820e0eb5be86a1de14ee901", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "JRat", "colour": "#ACCA2D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986636, "uuid": "6daacbde-509a-4cf6-820e-230cc6bd2c0e", "value": "T1C0D423CE3858848CEB63127BBC033D5B99F157388368489D84E25DEA8B724D61F42B79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986636, "uuid": "2842b422-7386-435c-8bc3-cac67b27ace8", "value": "12288:FaW8OtNb/9FQF7aeZGtFFTHrfsB9odErHZCJzIROdiWREMY9wIj:FPzLv9HRTsgaZCJzodWVYaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986636, "uuid": "71352bcb-d9dc-4c85-86c7-397793e17c98", "value": 610026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986636, "uuid": "baa642b3-828b-4d3e-8498-4475dced3c06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986636, "uuid": "c818620a-12af-4ad1-8d5b-728e91f048dc", "value": "\u6536\u64da000951496.xlsx.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af6728d-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024212, "uuid": "24f24884-650b-41a5-81ce-6256457ed757", "comment": "Malware payload", "value": "948c4b191dace2daea7d9f026332a789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024212, "uuid": "e7222cd9-56b4-4eb0-8ebf-2c157c124208", "comment": "Malware payload", "value": "dd87b2d055144e2790365704e3e2bf1e96b22a5f3080c629db946e71153bb9d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024212, "uuid": "679bc78f-15fd-4e81-8cf3-605c6cadb345", "comment": "Malware payload", "value": "f39c26f1c9f8a02ab9ca3d84a1e811bf82497474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024212, "uuid": "95e33f8e-a786-46fb-a6d7-0bdbc75b52e9", "comment": "Malware payload", "value": "e412d672a8b1fb254a6cb0ff747586dfbb5ed47dcba9e808b4b24de41ad19b663b23e8a69fe750811832c0402b7c33aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024212, "uuid": "deb73b24-d5f5-4704-b5f8-a68eec4c5247", "value": "T14F3423E8947970E7230677033BF085588A43AD659CAA9450DB23FB4CB4B75B76E4E332", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024212, "uuid": "197f3196-93bc-4441-abda-e312fbbd80ae", "value": "6144:UoCZnlxLXecCCWq/0GQ77ymM191DezqOaAk+6S0V/1+jChU:DCZlknHqsx+mML10haAWh1R2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024212, "uuid": "e8a518c5-559a-4ca3-92ac-67a5f5fe8f20", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024212, "uuid": "80b7cbce-95c0-4ff4-bf0d-f8f590a248ff", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024212, "uuid": "fbeb01e9-b015-46d7-9140-30f335962b9a", "value": "28839.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c575edbd-5f22-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696031344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696031344, "uuid": "24e2d1de-6c13-4bd1-af1b-9bedc93b9945", "comment": "Malware payload", "value": "eb94e805be336a7e908cf97984ce6880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696031344, "uuid": "13557773-7f67-4409-9775-834ca6bfca88", "comment": "Malware payload", "value": "de2949c25878b7849a5fe7e6f7820005ab07c370c4754a6284d11162573145bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696031344, "uuid": "45889004-b433-4baa-8393-7bc299424dcf", "comment": "Malware payload", "value": "dc95f43d27c7c584c435d71cce971e47c2acdddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696031344, "uuid": "f29162de-cb8a-4bb4-bbd8-23ac30564384", "comment": "Malware payload", "value": "45b949cf451db62735ae563a0de9eca42edbd64823ac5af4669abfd7e480c3dfd79ee7c5100bef388a1d0432fd1f6398", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696031344, "uuid": "dff646f2-d2ed-42e8-bd71-3979e68e9b72", "value": "T1C134B019B4DDC072DC7215360AF4DBB95A3EB9300EA55AAF63E40F7E8F30281D621667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696031344, "uuid": "b201c68d-7b79-43b9-80e0-02e92ac8e998", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696031344, "uuid": "1b05c447-0200-41ca-a6ac-f87bcc900732", "value": "6144:8DKz4SHy5uoBMFGV5PEkIXEHvZAOttQl9Vs0BC+:wCmuoBMUOMx/Whs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696031344, "uuid": "b0167f94-0aab-43ae-a4f5-11c7b6d116ec", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696031344, "uuid": "b1b8dae2-4ce3-4407-b48f-620a90eba310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696031344, "uuid": "d2e85bc2-6d69-4f99-9830-75c6482f39ae", "value": "SecuriteInfo.com.Trojan.Inject4.61510.3782.9347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04da0a64-5eb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695982058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982058, "uuid": "44cdca5b-e6fd-48ac-95a3-33183357f456", "comment": "Malware payload", "value": "ddd3c163898577c0f93cc24ca96f3182", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982058, "uuid": "8c29290c-d5a3-4644-a965-93485e067b55", "comment": "Malware payload", "value": "de5fa33b72960f87f02fd32ff9c0069060e4d022d95158004ca2ebc33033d472", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982058, "uuid": "eb423508-0cbe-400e-85d0-b1ebccc73244", "comment": "Malware payload", "value": "40065ec804f88c320ad0ef66a41efc605962d6a3", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982058, "uuid": "3f46da5c-1c51-4644-a05a-48cf2ea3be4e", "comment": "Malware payload", "value": "69161edbe33c76d1ef83579cabbac3e8322644f602afd22e4ba7054f3957eb4146d44ee92a6acc14417a3e48755ba7b1", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982058, "uuid": "bcc9f2d8-0d00-48c8-b8d7-39cc50fd9ad4", "value": "T11D55D00FA804CB86D50D83F47E1369E80A0D7F19EBD569DB24923B8F3E3166259CA1DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982058, "uuid": "b015f812-951c-4196-baa5-fc507200b0f2", "value": "24576:EWQmmav30xSZyEw6VOUJlZyhw6ViU6fRmJbucI3E54iIwsKP/wmx:ZQmmQ306k6VDp6VSOuT30IrKXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695982058, "uuid": "cd07a963-58b3-495d-85b3-f427d106080f", "value": 1292288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695982058, "uuid": "14b909c1-f31b-42b5-a57e-240bd4cdafa4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982058, "uuid": "e0f88b4c-4523-477f-9701-406ef2cb5b34", "value": "RKP_002023_09_28.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ff156d-5eb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695982060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982060, "uuid": "6716922d-218c-4d3e-af1f-43bea4f5ea59", "comment": "Malware payload (Formbook)", "value": "0fe5cda15c35728fb7b7c3a4dea1ad2f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982060, "uuid": "d540c75a-c215-477f-876a-eec66dda109a", "comment": "Malware payload (Formbook)", "value": "deb1d37d200f1bf17b938480d1ef18202ecad85a166ef68aba9f984ea2494c5e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982060, "uuid": "186a3049-3878-407e-a54d-3e3f2e2666f7", "comment": "Malware payload (Formbook)", "value": "ecf3c0282c0b395ab56a5659a7bb47df19b6e4f1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982060, "uuid": "d93bf104-2f08-43cf-8640-79d7c95db5d5", "comment": "Malware payload (Formbook)", "value": "8422246a46cfa5396a14c8a13407dc91e2f6bac578b7205bffdfff8c8bac463dca4fe316f9de27f4b0d0ddecc1b674ca", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982060, "uuid": "377a5fba-1608-4ebe-b841-cc05cf910c84", "value": "T11C55D00FA404CB86D50D83F47E1369E80A0D7F19EBD569DB24923B8F3E316A219CA5DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982060, "uuid": "428bf8b4-6033-44c6-afd3-57a477e310f3", "value": "24576:oWQmmav30xSZyEw6VdUFqZyGw6VmUVy+Lhv5bpEITYRBaXzm+v/wax:9QmmQ306k6VHy6VbLh5pLTEaXzm+XZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695982060, "uuid": "44e21bf5-c2da-44e4-bb8b-1a4bd6e2602b", "value": 1292288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695982060, "uuid": "adf3293c-2635-465f-b21c-d8c805789b77", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982060, "uuid": "a7113a92-d377-48fb-a8f5-fe1e2453e621", "value": "SWIFT_4939459845845.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ba245a-5f0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696021229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021229, "uuid": "4d09a393-9107-4ecf-a132-48762fd3751e", "comment": "Malware payload (RedLineStealer)", "value": "526bdaf9e10ddc7fac35bc07968d9fef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021229, "uuid": "0dc17e07-47a8-412b-9f2a-8c23cfc81f77", "comment": "Malware payload (RedLineStealer)", "value": "df005f88813d478d60f63d568c2dca197caa651e737408f1bc0a929ef9fccf86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021229, "uuid": "52ad13b8-75b4-419e-a820-a129a21cdbff", "comment": "Malware payload (RedLineStealer)", "value": "a9f748e2192a29fe8cb7b30171fda0070995117a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021229, "uuid": "63734b4e-5d69-4422-b7ae-ddf6743ec093", "comment": "Malware payload (RedLineStealer)", "value": "3858b16bcac1dd06d41e8c094362b096cb032eabd7d4ac4c10ee0f7b497cc50ca44597fc5cf4cd8b6a70d6d055adba09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021229, "uuid": "9d2c2af7-26db-4255-b2c1-955a32c295ab", "value": "T1EF352319E2E94433DAB763B01CF313930A3B7DA19939C66F57959D4D0CB3690AA3036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021229, "uuid": "6753035f-aa89-4988-a383-5efcda529002", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021229, "uuid": "461cac5b-f9ec-4c18-83d4-9abe976e8680", "value": "24576:oyPwll+3OYl3F+d+b/Z9U88MA8YSkg4zESj56eBWph3H:vog+swwd0MA8YSv8zBW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696021229, "uuid": "a5603317-1217-4cd7-80ba-141fca11458b", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696021229, "uuid": "c7802c9b-d98d-4357-8843-456abfaa657e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021229, "uuid": "c4141bff-0d68-41b6-8dc7-ecb360e86095", "value": "526bdaf9e10ddc7fac35bc07968d9fef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cb79b9-5f19-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696027230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027230, "uuid": "dcd1cd7c-8d6b-45d8-9990-a6ed029de50b", "comment": "Malware payload (Amadey)", "value": "539d2e3acfc33d3bcf5a59ef14b430f3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027230, "uuid": "555be67d-a36c-4e66-b8e0-64d3c881baf8", "comment": "Malware payload (Amadey)", "value": "df1753fd9debb2a17bf35c83108a7a4c49afa5f60fcca57b189357d7d652c239", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027230, "uuid": "ab2c690c-afaa-48b8-8df0-12c6fe495d59", "comment": "Malware payload (Amadey)", "value": "c8f83ca6acc39e9accdd88913767e5ea74ba3daa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696027230, "uuid": "e3a3c412-036f-4f4b-9508-40151d817b5f", "comment": "Malware payload (Amadey)", "value": "4736e58a85f2284a0ff0fdd99c0576b0873b1e025ae9f3e7e66bb1e1bd8473f708b36866e1697201455ca80e77b026e4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027230, "uuid": "4d10bcfe-2a2b-4590-a677-8b3dd5582b0f", "value": "T1A2352306E6D49423D1751BB45CF702C35A327CE7AD74837E2742A9999CB26A0E072B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027230, "uuid": "00adc576-a060-4575-bb87-d38b738b9260", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027230, "uuid": "4d89dbce-d1b2-4cac-8aff-e3697803d826", "value": "24576:Pybs2Lak7zNpU9NYw3q77WmdZG7VkTunkMhIfuFW1TJB:abs2+Szw9urPWmdk7VkTuHyu41TJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696027230, "uuid": "56c144e5-66c8-4134-83c8-cc5e72f443ef", "value": 1112064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696027230, "uuid": "dcbbb2a9-a1aa-4a16-af00-efc68d2f3e2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696027230, "uuid": "32e719e3-4079-4687-a634-d967baf141cf", "value": "539d2e3acfc33d3bcf5a59ef14b430f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111577e8-5f07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696019445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019445, "uuid": "ead43662-082d-46c0-ac96-7fb47aa12c12", "comment": "Malware payload (RedLineStealer)", "value": "dd0573c8115f8ef8117f3ed340578c85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019445, "uuid": "383d0e99-5951-412e-96d3-53d99ef00f87", "comment": "Malware payload (RedLineStealer)", "value": "df439ba4a3dcc9250f0066ea38252c5862bc9a4443038432af84fee6e0180c24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019445, "uuid": "6c6bf3f1-065d-45bb-9e2e-1de7c149f021", "comment": "Malware payload (RedLineStealer)", "value": "b236fb5a472abfd7ac29f190542ed77bd0147f46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696019445, "uuid": "3b31ed15-2b99-4bad-8fb1-66a01cb89ed1", "comment": "Malware payload (RedLineStealer)", "value": "eb94967e511f98bea3941c5ff3c8f613717b843ec44669d42d092f2d3e31a71201d80b868c0f470e8f370f08e6a27e98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019445, "uuid": "daabb881-b433-4d00-871b-078e9c5751e7", "value": "T19D34BE1175D1C072DC7227360AE4DBB99A3EB83009915AAF67F40F7E8F342C1D626A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019445, "uuid": "c71979cf-5ca0-4e0b-8e75-3033cf7325f3", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019445, "uuid": "4f92277b-c14a-499b-b438-0e895b4d3107", "value": "6144:+0z4SHy5uoBMFGV5PEkIXEHvZAOtqK0dVs0BC+:cCmuoBMUOMx7Q/s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696019445, "uuid": "716c9b21-0bf2-418d-ab1a-bf2b4a20cefd", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696019445, "uuid": "43366faa-399a-4674-a342-6e6b490c5a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696019445, "uuid": "e6ff1e96-7f59-4fad-a399-73824c021a4b", "value": "SecuriteInfo.com.Trojan.Inject4.61510.25574.17593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b4a625-5ef2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696010404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010404, "uuid": "9d495a1d-3907-4f3d-aea6-b7fc27ac6920", "comment": "Malware payload", "value": "ba1704e320686d7fc31e7e5b4f8e56f5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010404, "uuid": "b833920a-7c8f-467c-b7a6-0264d80a5bec", "comment": "Malware payload", "value": "df43ef48a90bdacd43e95e6cf71fa962ce620f718a102a230dea5b7e1bfc220f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010404, "uuid": "5e9e83b5-c0bd-4160-9076-90fbffa6a107", "comment": "Malware payload", "value": "ee42385419f0cc8bc1ce63645812076367bfc173", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010404, "uuid": "17d49ab5-1049-40b0-b2d9-b5f98b3ab352", "comment": "Malware payload", "value": "f9f6daad308266c3e3aadd349e38fd8ac56b2990e576dbb42dea63b39b11eeeaba1d3440bc23ad8dc9ea6490206a5a5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010404, "uuid": "3c57782f-7d7d-4b9d-9509-0648262e47c9", "value": "T1F5D2D068B74088E9E02BD8771FE543A42F7687B0C546EC5D9560F6829C038B92893FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010404, "uuid": "fbb6a6fb-fd15-468d-8b78-3a9a39a9bd45", "value": "768:soi7wJVmF7l9S1RgPLWVlRtkLx9TJgGlzDpbuR1JqX:PiwuuWLckvJVJuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010404, "uuid": "cc5760e8-3fb5-4d30-8cf0-4c40689c734f", "value": 28556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010404, "uuid": "e1d925c3-45c3-4877-9ffd-b19514f83a18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010404, "uuid": "fdcedcd0-5bc3-41cd-b62c-afc4ee9cfa37", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d6b47b-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987316, "uuid": "54fd5b2e-42db-482c-9913-2fe39dd1e389", "comment": "Malware payload (AgentTesla)", "value": "aa138cafc87d0174eb09a041f30c286e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987316, "uuid": "eb0cbb26-a9dc-4026-8cce-374f5dc1f934", "comment": "Malware payload (AgentTesla)", "value": "dfba4399135411a957312b2dd3f743d93adb849a72126f15637f5dc960d39edf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987316, "uuid": "b7adb8b9-dca1-489e-8fc3-a309c87d8086", "comment": "Malware payload (AgentTesla)", "value": "0e2c3e97654209b46e331a74fb0827c1140337ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987316, "uuid": "0041f5ef-88b7-4a0d-a5a7-de06bd28259a", "comment": "Malware payload (AgentTesla)", "value": "971afee908b47d0239e9e569ba8d9ee526beba274e762d3fbb40d54cf2d0ae8569a0cd1a8aaf11febd79c680e1c37080", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987316, "uuid": "4fc7514d-3e94-4c5d-96be-ca93c116e532", "value": "T13BF402065B961582F6BF237088B1913143B76A65D839DF2C1CCC509D1FFBBA0AA54FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987316, "uuid": "55822f67-d984-4778-a461-05fd7905c35c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987316, "uuid": "4eb59323-1e87-4132-ba6f-268038fad75a", "value": "12288:GcVAckj5wFzSVpBM5UYAlmN+nWmd55YfaSF7vr9PHSHjBsEOqbY5ab:tk6FzSVpuSYAlmPmd7YfaSF79yDOEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987316, "uuid": "dc5bcbc5-a71e-41ae-8e35-ff936b7a3f3b", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987316, "uuid": "58a6bde2-ef0c-49fd-bdf5-ac58aa985905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987316, "uuid": "3827ae54-ccb1-4b39-a8c0-5f7919cc8f29", "value": "aa138cafc87d0174eb09a041f30c286e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6518c07d-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986944, "uuid": "ebdd1b5c-c7e1-4ec6-acfd-ed9a4920003c", "comment": "Malware payload (Mirai)", "value": "d9aa21a52033d351db528309f34fcdac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986944, "uuid": "99dffbff-2533-4a37-a8c5-91382aeb4f6b", "comment": "Malware payload (Mirai)", "value": "e010a35776081a1d9f7d1a443e2bdd96f62cf2375050efdc1868627d77e76535", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986944, "uuid": "06999a9f-b2aa-47d1-8d1d-5b9aef389efc", "comment": "Malware payload (Mirai)", "value": "e6a105a0a56ff69d044181fa4fc5d23c6c8aecff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986944, "uuid": "09847838-6d3d-4499-8e36-bab18748df96", "comment": "Malware payload (Mirai)", "value": "5812fe35b1776e3cffd8b6310fec5ac5c23708b050ad2d1c3530ee02557edad5c74e9ddec436544f80d4cc61b3e70455", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986944, "uuid": "e12b1ad0-3129-40f0-b9b9-eff176bc100f", "value": "T14AB30746F9819F02D4C331BAFB9E414933536FA8D3F971119D24AF61138A9DB0FB6612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986944, "uuid": "f1582790-0eaf-4d57-a6c3-4502ee3175ed", "value": "1536:pFnXQBDtl86dHeZ3kksat+vDCuq+ke2lVy4PiyvGhapwUOZGYHGIck71/:bqCd3kksa0vDCuql3vGkpwUOUZIckB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986944, "uuid": "279aa2a9-05fa-489f-94eb-c1c4886eb3cd", "value": 111924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986944, "uuid": "13aef6ae-0b24-4f04-b4fd-d9ace2ef1a64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986944, "uuid": "40aa2649-74fa-491d-b5cb-def63528f644", "value": "d9aa21a52033d351db528309f34fcdac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e010896d-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991016, "uuid": "411d6b74-3eeb-4ba2-b188-df1c8db9b72e", "comment": "Malware payload (Mirai)", "value": "ca477eef6e3ae2fedd86f86329d82848", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991016, "uuid": "3e9f4019-a1be-4ce5-8e9f-d209d3e8e949", "comment": "Malware payload (Mirai)", "value": "e0f1566a985cdebfb24afbc45db63c1e9eb45bd2e00d5892b2768c348553905f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991016, "uuid": "e665fcee-f7bb-4c6f-9713-afb9d0d2a03b", "comment": "Malware payload (Mirai)", "value": "8ef0c642eb15ad4bb321a6c727d1aa6ae3097a8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991016, "uuid": "d2c12b63-2dd6-4eac-b1cd-b9f9c7e1cdf8", "comment": "Malware payload (Mirai)", "value": "aa751faf620e5b16fc34a05313e2659e3c0813241239d21dd342416fba36d192bd67c3a277d2a947f4db75435e190166", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991016, "uuid": "f5e472d7-9ed6-4708-b208-a8ac54da450b", "value": "T160735D24A97D2E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991016, "uuid": "7c6e542f-366b-46a2-8b0e-e3ab548020e4", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8V:YwfdNu4cmZvFqI3w7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991016, "uuid": "91fafe09-2d87-4f77-a761-3018d9c1c7f5", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991016, "uuid": "043d2255-581e-4e3c-a462-2de9bf8695f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991016, "uuid": "86fab854-509c-44e1-b274-c4fc49b400ce", "value": "ca477eef6e3ae2fedd86f86329d82848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a47658-5ec5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991085, "uuid": "9fb5a405-05ff-4f33-b06a-325e4a6125f0", "comment": "Malware payload (Mirai)", "value": "87f7f3a3faa95e5e21711a2cacdfcf73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991085, "uuid": "76a0a6d1-7d7e-4fdb-b71c-00dd4809766d", "comment": "Malware payload (Mirai)", "value": "e0f3b16537f0a77df53adc682dff611afa262380c59a45a6c8fb332116af6058", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991085, "uuid": "758c9ea0-f423-4046-99dd-1b9317423325", "comment": "Malware payload (Mirai)", "value": "eac7568cfe36a2b13d4d41b859288332964b01a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991085, "uuid": "049dbfd0-b9e4-4b76-9b61-e852d527e094", "comment": "Malware payload (Mirai)", "value": "5cb34076883fed053e42f3f66d8bffaf07e3a8aa0b68fb87012fada5cf60247bbf9b9b4d70b3be3a12b6cf3aed946ee7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991085, "uuid": "40864a2e-ce8d-4b27-b6c0-06c2fc8cbf44", "value": "T1B023F25324D7DB52D93008BA4A2181DA222217F8F47F3E9F76460AA160B4F667CF056E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991085, "uuid": "da7a27ae-872f-404a-9e99-89dcb17298f8", "value": "768:SK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFd9q3UELg5pja+y2do1MuPNZawtkrOG:M12O1LCNguovDPH7TcryLg+2do1JNZRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991085, "uuid": "ccb9e6c2-4444-4623-a75d-b466673346b5", "value": 48660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991085, "uuid": "19431cc6-b91a-45be-9c8a-7abc39ed881b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991085, "uuid": "8cf24c8f-6dce-484f-bcc1-d67db27595e1", "value": "87f7f3a3faa95e5e21711a2cacdfcf73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c70674-5eb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695982172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982172, "uuid": "75e14e39-69a4-4b6d-bb47-3c05c73558f3", "comment": "Malware payload", "value": "91ab2c89608fc49633b2474493eea552", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982172, "uuid": "9539fbbe-2eab-4129-987c-d14fcc408b8e", "comment": "Malware payload", "value": "e10907688283346891b3a0232545ec3b7cf926c402f5456a6fa1cd849e7e9092", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982172, "uuid": "fad2c321-28e8-4c47-8923-72e17de0cef5", "comment": "Malware payload", "value": "57149066ebee5648344587be63eb467d3d765e14", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982172, "uuid": "240085a8-0b38-43a4-9a12-8f8f1d3cd7df", "comment": "Malware payload", "value": "b6bf42b25110d1b4d75016f692cf748c3a0041a77a2a9b077f9efaca408c5e189ed7b6553a2bd7b8a14490c99a41d52d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982172, "uuid": "43ebc98e-e238-493b-b46a-686a1c29c0f6", "value": "T16C45AF227386C537C96E01303A1AD6AB5579FCB74B3141D7A3C82D2E9EB44C16639FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982172, "uuid": "0ae3799e-f2a9-40c4-830b-f243b1303836", "value": "24576:dg+xLNIYVNMvZCFlp8zBQSc0ZoCEqKlqS0Ygll5RRYM/ZXAAZ:dg6IY4W8zBQSc0ZnRKr8RRYGZXAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695982172, "uuid": "1ee73451-2cf5-4bce-bac9-ce85cd614674", "value": 1234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695982172, "uuid": "79f4a948-c6f4-4765-bc0f-b6f76f2d5536", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982172, "uuid": "341d146b-c897-48df-a027-006787a721bc", "value": "VIRCFO-{ABC4DB18-37AD-4243-A6FD-D54436354C9E}\u00aexrtkjl.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8119cdaf-5ea4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977112, "uuid": "501525cc-d91c-4f57-87e4-ef3f40ecd3be", "comment": "Malware payload (SnakeKeylogger)", "value": "f121da287c002c3151536083abf62938", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977112, "uuid": "828b3d92-b769-4217-8e2f-b8e0b84562a8", "comment": "Malware payload (SnakeKeylogger)", "value": "e140957366f6040c31704645bf11779a7d29ce1f5e83439d27eef95d7d0b021a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977112, "uuid": "21e7ec0c-46de-4ded-8d63-e421e3b4a8c3", "comment": "Malware payload (SnakeKeylogger)", "value": "10121c54303bf0f0aaa02afba7ecabec45339096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977112, "uuid": "a51cd6b8-ba27-4c23-ada0-53253826f138", "comment": "Malware payload (SnakeKeylogger)", "value": "d004d5d54e8ae7d8c25fdf54cf1313bf784054bec58de24f94276889e85aa2c3d96cb2b60abbc74e314b9c3219745c4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977112, "uuid": "1d35340b-ff7e-46fe-a597-22ba8fb4844a", "value": "T1C2C402B136B91867CF7C10FAE85255025BFD90E13567E3C2CCCE60EA5AD27CA86825D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977112, "uuid": "9357f807-31c7-4894-b910-1ec95a48b0bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977112, "uuid": "60abb1eb-2e43-47d9-8160-2c37691b8ad2", "value": "12288:C212iN4yiRJU/WcuoNt6E6FRCkQK0w7Q094jnez0VnB0:L19FeXor6E4CjLPC4ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977112, "uuid": "3465027a-3655-4799-8faf-41d3662baa1c", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977112, "uuid": "a6cc4df1-f868-4cd5-b36c-f3c441fd8a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977112, "uuid": "22450aac-c133-4299-8222-c0da416d1819", "value": "SWIFT USD 16.760,38 20230928104546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47921bf5-5ef6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696012235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012235, "uuid": "6b26423a-7bad-4d55-91ca-c6efb50fe491", "comment": "Malware payload", "value": "1335d578cd2c7607cf34c8e641de03ab", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HANEYMANEY", "colour": "#CBEB71", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "ZPHP", "colour": "#D5C8E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012235, "uuid": "16612420-f4c2-40c9-a61d-9851499d5bab", "comment": "Malware payload", "value": "e2a3326308c61791a302cfb9d876afe728990f758ba67590211320416991cccd", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HANEYMANEY", "colour": "#CBEB71", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "ZPHP", "colour": "#D5C8E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012235, "uuid": "985f4ba3-dcb9-4145-85cc-a3436a822873", "comment": "Malware payload", "value": "9e5da2f654207a9bd50d3c26d53a73995007af95", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HANEYMANEY", "colour": "#CBEB71", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "ZPHP", "colour": "#D5C8E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696012235, "uuid": "e7a5f648-4736-4b4f-92db-ca919b127422", "comment": "Malware payload", "value": "1e4ac5a9cd7097b58a93fcc0299f16a3c1cdcdf1de14808f6f6bfa56f3864467df4e1905f5899b7a477c4b6fded6fcb9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "HANEYMANEY", "colour": "#CBEB71", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "ZPHP", "colour": "#D5C8E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012235, "uuid": "fe78597b-3702-4af0-b747-88e76a2c5777", "value": "T16FB13864CBF35E4AB009C06DA25B8C1E5DFFE83E76A9709B78483E7D4AD5208E04605F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012235, "uuid": "814b3c0b-7da7-42e6-bb64-14608ac31a1c", "value": "48:7A+xqRwE4HwInEFaRQZrEzV7ZcQnEIa/fotgoFJnXTAhEiOLZ5ZHgYcjjxFTxt5q:/xqRccjedcQMA60nXspIgPjjxVx/Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696012235, "uuid": "098754d0-80b4-496d-8690-d5270452a6e6", "value": 5129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696012235, "uuid": "9c294ef1-817c-4030-9ee9-e44078b71398", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696012235, "uuid": "ddb43584-c18f-4bda-a335-774519874e5e", "value": "2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fe4097-5ed8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (frp)", "timestamp": 1695999560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695999560, "uuid": "7ccba201-3fee-421e-ba61-3401e3fce73d", "comment": "Malware payload (frp)", "value": "9a42dee075336307e6d2631e1dc76876", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695999560, "uuid": "9f24f351-6bec-4414-9762-00f53deedd5f", "comment": "Malware payload (frp)", "value": "e2af3c82ca775bce2058af6fb17ba767d1a1c0d6b378359de2c03fa7e2dd6503", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695999560, "uuid": "77066a4c-c5f6-4cff-af98-976473a7b223", "comment": "Malware payload (frp)", "value": "3a7c545164c2fad9920b97d1bc4c43fce1bd5107", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695999560, "uuid": "64ffeb12-5b12-46aa-9daa-7e29ed23bb5c", "comment": "Malware payload (frp)", "value": "b7acf43b6480c59bdb2041ad4fa9bd23a91b14fd28d6a49b308a1c3c4e0afed432ab3cc99952f77bc914cfc03f595a6a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frp", "colour": "#C45E72", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695999560, "uuid": "2d6f1507-0c3e-4b09-85cc-185b805050d2", "value": "T19716187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695999560, "uuid": "4803659a-e53e-4ba4-9459-9fcca29157d8", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695999560, "uuid": "8e729c54-c2cd-430d-9c08-f0b6d97a396a", "value": "49152:Xgh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWDjXNO:ba71fjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695999560, "uuid": "a4a9475b-4265-43ba-8268-a62786a0118e", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695999560, "uuid": "18db7b2b-ce7a-40a7-96f8-ac8b09c18770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695999560, "uuid": "ddbbf43e-4679-4793-b3b9-64980cff7a43", "value": "9a42dee075336307e6d2631e1dc76876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae5b962-5ebd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987839, "uuid": "c30783d3-0af3-495d-93ef-dcd23c1696c4", "comment": "Malware payload (Mirai)", "value": "5237c7759987bdd460fbf667a38a599c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987839, "uuid": "cb52b623-fd38-4c07-88e4-ca26f3bee41b", "comment": "Malware payload (Mirai)", "value": "e2f2f5e267dde84d94d1972ec4469b5f62bf87c64f05a5806cee4b0afbb225ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987839, "uuid": "dd5610c7-0781-41ef-8c5f-05600afd377f", "comment": "Malware payload (Mirai)", "value": "8355eb8e9196607bfb0e23838e9458168e9c1852", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987839, "uuid": "ef4f8f42-2e3e-45f9-b7f4-93a8390e443f", "comment": "Malware payload (Mirai)", "value": "5b6182a6eb8e562a3d154168cf245d5c800548bad2f479bec3ae807a87868c492b23dce5b1ecb0bf731fe85dc1c05f79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987839, "uuid": "dc04c576-ed2c-43e3-81ac-790eb7f825ab", "value": "T1F5C2C07DE8B4BD46C9ED08384CDD13B80C9D76C6718E4FA993261DC47B2118B3C99474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987839, "uuid": "46e14e94-2a88-4865-b63e-10dc5aafef3a", "value": "384:PmWTv+78AdGa2nS3xbjJUFbviosPlozhfbIAawprR9gICSk3kImQ0KnEzrEcftwQ:a7ddenS3j6Koolozxfk5JmsEzrttHWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987839, "uuid": "d12b11cd-0af1-43e0-9b11-784556d1fb18", "value": 27252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987839, "uuid": "14179d40-ae0d-4d68-9929-ab145f50bc2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987839, "uuid": "143ae14e-b53d-41cb-8864-5125d7dd8de0", "value": "5237c7759987bdd460fbf667a38a599c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b821cf0-5f18-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696026737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026737, "uuid": "a9bdba39-bf06-4e28-af40-7a20b25635b6", "comment": "Malware payload (Mirai)", "value": "f501f3e0852f384760ad755dcd1ed0f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026737, "uuid": "54eb69e4-1e94-45d0-bc37-8668764ab577", "comment": "Malware payload (Mirai)", "value": "e33f655b18b3098c7dde8f6371a08a5fe19118a05cab459b3af8ffcec769e7b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026737, "uuid": "773c84fa-14d6-4ed7-b701-b5e788667428", "comment": "Malware payload (Mirai)", "value": "b7c1edd122911a832f3ad555fe46adab4ea097ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026737, "uuid": "005e2a9d-be08-4545-a187-cffb7050a8de", "comment": "Malware payload (Mirai)", "value": "0235b61af45b26a80105f1737fc5a1a23de57e9ce77c454814841a2152fbefcdd4ea80a836d2ed1b3a39381371a3bb29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026737, "uuid": "4247921a-e4ec-4fb1-abab-52a648d07f09", "value": "T16FB2C071B011F8B387E501B7AEEDCA83FB811EF8D0E873295465099DE6D9C42AAF1147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026737, "uuid": "8257b49f-4fba-4dd3-bf9e-12aa1a706aa7", "value": "384:cZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3pUBhymdGUop5h/:5X9nxn8o9wnBoWzEQf2EjKb3pCs3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696026737, "uuid": "563791d2-83c8-4f40-9788-aa8501a86f8a", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696026737, "uuid": "319deab7-a3bc-4403-9ce8-1ea5358ca840", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026737, "uuid": "b483bbbe-8c95-4a82-89a8-0acbf785f128", "value": "f501f3e0852f384760ad755dcd1ed0f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537eb925-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977465, "uuid": "4e3404d9-0dc2-4719-88cd-061df28a66b1", "comment": "Malware payload (SnakeKeylogger)", "value": "ca67abf1fa1beb803fc9ec496c68fe2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977465, "uuid": "312c7126-2370-4cad-a1b1-a5cf868e8239", "comment": "Malware payload (SnakeKeylogger)", "value": "e3a15c6736497a59a062eb612e69a68938b55266cdaa9dd03b20f3d3f4b784ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977465, "uuid": "aa8e3af1-d29d-4c4e-819e-a869cc0cd25d", "comment": "Malware payload (SnakeKeylogger)", "value": "8f12daafc220b31bc9fa734fc8d9bf2075e1a765", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977465, "uuid": "e2f8c4cd-250e-47a7-953e-e47e6ae5ad44", "comment": "Malware payload (SnakeKeylogger)", "value": "1c40a988f947424cc2aa6b5fd8168777414e786cef3253650d33c251c9fd498b8ed767755d70fd92e3df7c37514df7ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977465, "uuid": "0f2cc2a3-0378-4f6c-b79b-e4adcad5aa65", "value": "T1E9841903BB5687F1D39A1B37D65A282C8BB0D647F24BD75A348E23E30A87366C905717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977465, "uuid": "147809fb-f361-40d2-bfb6-796a07769b20", "value": "6144:1SItb2zQLw8XgTQedTHbLYKWYse50nE3QwYS5uIFXMgZTbc3OBZFNA9668NbZ+fa:1VLJDiwKzmwYS5sgZTbc3OBZFfbZ+fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977465, "uuid": "1ff3f9fc-9e48-4755-898f-f47021150201", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977465, "uuid": "7a4d1898-a632-4960-b239-36e6aa8fd918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977465, "uuid": "6bfa2bd5-66bb-4b95-9cc1-c191f1496513", "value": "Trmczi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236c815b-5eb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695982109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982109, "uuid": "7c1b7ada-ecf4-473a-932e-695a0c2fa829", "comment": "Malware payload (AgentTesla)", "value": "f67734050ed71011175a54c9ccd32a10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982109, "uuid": "e6ff60c0-ccbe-4366-8e32-2f3a4cc360e0", "comment": "Malware payload (AgentTesla)", "value": "e3d0e3fe08072a30d3f6e62452bf06cf7b213e76973c822a34a54641766a5259", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982109, "uuid": "bfa07bac-830f-4d39-b8c5-d18612a34bf8", "comment": "Malware payload (AgentTesla)", "value": "2a7e130443607f2b035ff251a50e2aa27fc84725", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982109, "uuid": "b2af804d-a5f8-49e0-8ba5-7e3381ffd072", "comment": "Malware payload (AgentTesla)", "value": "8f50c400e0b5c1f40bfcf30396c0c24179aa63692ad8b279fff0f7d54d569cc424afff158cbb41c4b5d0669d86c70da1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982109, "uuid": "1a1a04db-103a-477e-be6e-96dac3e01158", "value": "T10955D00FA804CB86D50D83F47E1369D80A0D7F19EBD569DB24923B8F3E316A259CA1DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982109, "uuid": "cba8380a-49e0-4680-888b-b849fc8e6716", "value": "24576:MWQmmav30xSZyEw6VOUnTZyGw6VAU4gNBbhM4T4Blfufvwix:hQmmQ306k6Vvy6V7zhbT2fuXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695982109, "uuid": "3bdd03a6-1deb-41b8-8d30-bbbfed6dbcb4", "value": 1292800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695982109, "uuid": "8e01ad5e-6568-400f-8d66-bd32f2d6598c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982109, "uuid": "34aff63b-cae6-4ec4-be4c-3a3ff1cfa07e", "value": "INV00725782.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f56f40-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695986999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986999, "uuid": "e0b0e5cf-0c64-4c7c-8b0c-9d2d39867489", "comment": "Malware payload (Mirai)", "value": "c48c8f850b2e9303a76a21680194dd99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986999, "uuid": "d2e2f39d-f398-44ba-ae32-f533081e9129", "comment": "Malware payload (Mirai)", "value": "e5465ef3c369228881b3e40578d55cc95baaad110ed9d589bc40bba88d2a8164", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986999, "uuid": "8dcfbf65-85c6-4d90-85cb-a204a86799ea", "comment": "Malware payload (Mirai)", "value": "3edf10a5a79d542bf2cfb02e3dddac1da1daef9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986999, "uuid": "54509b5c-3546-448e-8ffc-c5cc7edfab75", "comment": "Malware payload (Mirai)", "value": "7f560114730b0ada4b41a00a8db3551927d82f47541181524f3523f54dea5856e528d23c19f0f82fe63a366b2ac81de8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986999, "uuid": "7a727397-d901-484d-bee4-2c2fda9545e6", "value": "T1B3539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986999, "uuid": "c9f52a74-0c04-47ab-80ee-eef9b9d09206", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986999, "uuid": "8964a79f-5c16-44b1-bf7f-b61363289fd6", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986999, "uuid": "85456056-2cb5-41fe-8d1e-78ba6dfa114c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986999, "uuid": "bf1ed4cc-f3f7-4f9e-b80b-5f86a2a8107e", "value": "c48c8f850b2e9303a76a21680194dd99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c6cc9f-5eba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phorpiex)", "timestamp": 1695986643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986643, "uuid": "3a4b749d-69c4-471b-9276-2c3b275261f0", "comment": "Malware payload (Phorpiex)", "value": "5f821d7ed15489b3d40a21b105b9c3df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986643, "uuid": "29a53a7e-7199-4aa4-a873-00fed5b2fca4", "comment": "Malware payload (Phorpiex)", "value": "e5fa2be7869d47b706b0a9ac386e06886501cecffeff61cfb45624dbda71a31a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986643, "uuid": "1aa3aa62-09b3-4dfc-ac3f-009a5af08864", "comment": "Malware payload (Phorpiex)", "value": "0bc7584bd6812ea070ae4f590c7ba2c8cecb4b24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695986643, "uuid": "5d23d072-24eb-4f50-ae0c-3aaf7b146497", "comment": "Malware payload (Phorpiex)", "value": "0aac4daf1ff50b1a84efc888417edaa07a1f5ba59a22a490793b70182a37339f5905b50836cf99db7d8301f3f48a21a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986643, "uuid": "3e2b38dc-3088-4371-9d42-cf531bc88e18", "value": "T13E92190699569357E87628B063B31E21A07DBE72631D95CFFB8006391670EE4FE3335A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986643, "uuid": "703bf991-bd1d-4912-ba04-aafa7e8d0cbc", "value": "fb0ee5bafbb99ce467989526f0be15c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986643, "uuid": "433eb18d-e3c8-4430-975b-d2ae48101f79", "value": "384:30piP0DWvqASUAzYAtlYxJ4JVB00xgMSKRj:3P0ivCUIDYOvxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695986643, "uuid": "8a3b7404-d2e1-46e5-a73d-e0a845eebe22", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695986643, "uuid": "5f7affe2-5a5b-4dfc-82d1-bf7217d322e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695986643, "uuid": "df38fd6d-8e59-44c2-9ae2-1b4c74bdd5ab", "value": "5f821d7ed15489b3d40a21b105b9c3df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c936e6-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987151, "uuid": "c4fab318-224e-4ad6-b8a5-28c26b30eac2", "comment": "Malware payload (AgentTesla)", "value": "6df6398d05095b3525c9c48622106f0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987151, "uuid": "daa40d0b-dd39-4406-b3c2-70c4b6f6f8de", "comment": "Malware payload (AgentTesla)", "value": "e679f8ae19b12c46495a7e36cd54681519f422f5bec5b21eca0b50be702dbe90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987151, "uuid": "2d2726c4-c843-4d99-9d52-0c43fbd6debc", "comment": "Malware payload (AgentTesla)", "value": "5e3cf6e886779241ce5c9359b23245a0ab60c33a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987151, "uuid": "7d258ee4-ab8a-4458-9aae-a5a743989322", "comment": "Malware payload (AgentTesla)", "value": "8c9bbbba75849497b27cee7e97a889f53d1aaab464822dc605a81b37904df9449557f3aba1d4099cdddd84d9c080a698", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987151, "uuid": "d3f23c9f-c837-4ad9-9abe-228bca3061b0", "value": "T1CBF4020767C21281FABE62B5AAB1113187B73A658978CF2D09CC10CD0FE7391B955FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987151, "uuid": "a7d90cd2-bc83-49f1-b371-2c13dd76c2c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987151, "uuid": "d0580d65-b8fc-4552-bdf8-988dd44fdacf", "value": "12288:9ciAckjJSL9LW21lUNVxI0ld29karfV0InARtxnXCXGOWouYfWulAuvrTV:fkFOY2L0d2HWCARPsTcWXlAuvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987151, "uuid": "cffc1810-1bae-44bd-9822-451a3f79c6ee", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987151, "uuid": "fd9f0ef4-35d7-4248-807c-97342bdea626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987151, "uuid": "1b3f30fe-76f0-4af5-9a05-d51ccdf32316", "value": "JhlYSFlGxtbcpq3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5737d26e-5e69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695951702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951702, "uuid": "f9641543-34f3-4ba2-80f7-510a3ff24da6", "comment": "Malware payload (Smoke Loader)", "value": "8c1ede5f0e3a217647fa022f542c06c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951702, "uuid": "f4d03555-ba38-4f5b-96b2-12d4d3b76416", "comment": "Malware payload (Smoke Loader)", "value": "e6a2459cf9c9761354d70563bd3c7c2b3740f68c03a35b5e7852a70919a45744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951702, "uuid": "42c7550c-a6e0-42ce-bdc3-9e33212a9ccf", "comment": "Malware payload (Smoke Loader)", "value": "9c4ad53e6c2c0af3cd3508a3599c465ca85b483f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695951702, "uuid": "bff950ae-10d8-457e-b120-06e7c5fcf56f", "comment": "Malware payload (Smoke Loader)", "value": "684cd205053f7fe77711a4fe174d151bdbd4d9a66ffc30bd1969fb2620aa1929c2b54d57aa2f0e175adadedac2d2b08e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951702, "uuid": "31f1298a-abdc-484f-8105-2404fd65a49e", "value": "T163548E1377A0EC61D4769E318D29C6E46B6FFDA19D68639B33983F2B09701E1D622703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951702, "uuid": "2f14cbc6-9589-44eb-9b44-5cd3a57aaea2", "value": "d749dd3982d2564e67503d7c8e1b49ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951702, "uuid": "e9e2393c-a714-4bd6-a4c5-1dbb163fdd9e", "value": "3072:SF/eFYoF5/IaT6c2kvr/VDdtxZ0rsxK68W+7tZjq6KE0NmDsow:c/eBF1IaT5vVp/ZXobRvj70N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695951702, "uuid": "78454b22-8fba-4e0f-93d6-4c59a63da31d", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695951702, "uuid": "eb860ef6-3148-447d-a74f-15e8a2771334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695951702, "uuid": "143c223c-3097-4abb-ac7b-772ca1a27b56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08409c26-5f0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696021148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021148, "uuid": "f46c4ca8-6955-44f7-8818-b3c1d3b7a8ce", "comment": "Malware payload (AgentTesla)", "value": "06791ac237e355e9b6b4e09e750440ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021148, "uuid": "5a3a1496-f920-4001-9866-619368815d8e", "comment": "Malware payload (AgentTesla)", "value": "e6a7a4dd43dde94c45356145c8f596fbed3f15d06955d00e139a13171a22860b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021148, "uuid": "7779e975-025f-44e5-a865-44e447b68c08", "comment": "Malware payload (AgentTesla)", "value": "f050a18851a19686888dfc98fcd412942f6012a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021148, "uuid": "68a94f60-0132-410d-87b1-21f898262b35", "comment": "Malware payload (AgentTesla)", "value": "1d7a239bd44137a3df779718499bea8cf41d7beaf3aff4be36115908ea84e769e8f838f7d9dc44c7cd9b2ef001e41ff6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021148, "uuid": "6a11ff99-198f-4dfa-9420-85db247bda06", "value": "T1C1E42370C8F4B2F843AD605A9249DA7BBCD3D3B6065CB67D203F96B974147066D82E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021148, "uuid": "d19f0597-2443-417e-9125-3ebd5ec33746", "value": "12288:oG2VCwquKIYeeFXsv8p28oywVgEIDpWFqlRmBde2GoOvbW+a0Y0EXOyHZvt:oxCxNee8vQ28ofgEuW5g2MWT0YleeZvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696021148, "uuid": "942c3589-c55c-4f2e-9694-761beffca177", "value": 661725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696021148, "uuid": "80d07835-f29e-4d41-aab5-c5bf97025203", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021148, "uuid": "9d1345a5-f979-4aba-b90a-4bbfe20c82d7", "value": "CamScanner 28.09.2023.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a5e1e9-5ef1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696010317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010317, "uuid": "5a9dbefe-2dd4-4b7b-aa53-49cfb3c0ae19", "comment": "Malware payload (Mirai)", "value": "d50387360a4465dd24dc948231265f8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010317, "uuid": "3837b6aa-a9b9-462f-802a-60f48e7c0cf9", "comment": "Malware payload (Mirai)", "value": "e6f2f90fe51e6b0558b43c4ef77253afe3357d987806577bc906f9bd703284ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010317, "uuid": "3d9d1418-605c-49b2-b258-a98990c8e860", "comment": "Malware payload (Mirai)", "value": "b0ef432bd91637460c34e42a381c6dfd38e38a81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010317, "uuid": "2cdd291b-1f07-4507-a07c-b2d4b415cef3", "comment": "Malware payload (Mirai)", "value": "2f462e4878a6ffdb7b8843b1ecea0839fa7e6307e6b77b2434b303bde6361c2824cedf9c4c8adf3049ffdc15f38f7c25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010317, "uuid": "36420c94-3ddd-4947-9bef-00b79e2be0ad", "value": "T177137C7BE4AE5E54D0460230B4699E341F13F6C493436EFB1DAA82A15487AECF905FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010317, "uuid": "7eee3585-6245-47e3-a2dd-856d259c4fbb", "value": "768:eaRH4ge4hYyFDinQT3yMILrvC+de8/C3o9ufR8C/ww:eaRYghh/FmnQyMie+dB/f968C/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010317, "uuid": "9e32359c-49f0-4a4a-8a7f-88e004c3b159", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010317, "uuid": "217744af-a215-4110-9fd9-fe085e7df8e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010317, "uuid": "bb292646-7f6a-495f-92b0-0c2d676f73bc", "value": "d50387360a4465dd24dc948231265f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d069eb6-5f05-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696018820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018820, "uuid": "6d2fd6a4-ffbf-452f-9644-fc8143542db7", "comment": "Malware payload (RedLineStealer)", "value": "e1d04ea9b2999651b365830ab57ff89d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018820, "uuid": "bd6951a7-b721-4773-b399-e1a973fd7725", "comment": "Malware payload (RedLineStealer)", "value": "e70377f317976aa7fa721c3c2e0b6f9e14169cd16ac11c85f18aefba6f13548a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018820, "uuid": "48233b98-cc9c-470a-b17f-93e9589486d1", "comment": "Malware payload (RedLineStealer)", "value": "7fc1f5a92e66620e66e8d4d0f17704040d879a95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018820, "uuid": "e9570c4a-ecb6-428d-bffc-b7a6a5b4b3da", "comment": "Malware payload (RedLineStealer)", "value": "9cb2919098a871986ee483b717d403b659ed673904a0be5ecaac084c4920cd369ae7a885fc14ae15a83eaa4ffe918764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018820, "uuid": "568b71ba-90e4-4a2b-9eda-f0fc26164a76", "value": "T1BF34BF11B4D18072DC7225360AE4EBB95AFEB93009915EAF67E40F7E8F302C1D625A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018820, "uuid": "a74b3248-eb46-4512-a3b1-78a04ce29d49", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018820, "uuid": "f047deba-30ad-4f62-b6ea-551fea732036", "value": "6144:WXz4SHy5uoBMFGV5PEkIXEHvZAOvRpnXVs0BC+:vCmuoBMUOMxh1s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696018820, "uuid": "55b258e3-4b50-4f06-984d-4c094ca6c55d", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696018820, "uuid": "31f972ac-7c8b-4f49-bcb3-60344fee5191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018820, "uuid": "f3b9e807-e84d-4284-91af-0a49d1aef40d", "value": "e1d04ea9b2999651b365830ab57ff89d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e64d897-5eca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695993294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993294, "uuid": "68e3fbb1-5004-4b9a-8de3-7a4cee7fc97d", "comment": "Malware payload (AgentTesla)", "value": "98b5d1281fc45604bb645cd9eea268b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993294, "uuid": "72c49289-739f-4017-b10d-8b153bc58c52", "comment": "Malware payload (AgentTesla)", "value": "e78c9a713a46688f5708c8de3fa881670b0bf6009d67343d30905630b03a1fc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993294, "uuid": "23499d4c-7bdc-4fbb-a787-5fade947741c", "comment": "Malware payload (AgentTesla)", "value": "f1b2a17149734bb2eef62de13396743455aefbec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695993294, "uuid": "70ad538e-d8cc-4c14-a31e-ff5660d5cc53", "comment": "Malware payload (AgentTesla)", "value": "f9fab2cbb40b23a0d828ec4482e0009a049fa1c2baad382b66048901fd4a47b917a495a9e22ea8d192583be56125a791", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993294, "uuid": "a19a8aca-a3e6-432f-91bd-d1a76c6c5025", "value": "T18BD4012077F90B5AE5BACBF604691A0857B9B16E3016F60C4DC370EE06B5F808B95F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993294, "uuid": "8a584756-80b5-4fb5-a891-48fb2e9be5c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993294, "uuid": "43e2fba1-1429-40f8-9d9f-d8943185261d", "value": "12288:L2AyiRJU/WcO3IWKkljH7XNhvphKMuc84jg4Y85lY1MXtU5:S/FeL3IWKKbbbphKc84jDY8T7O5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695993294, "uuid": "4edb5e43-351b-4ca5-849d-2ca62e52a420", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695993294, "uuid": "e5e4ef13-6f23-40e8-82ef-37b3e404cd2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695993294, "uuid": "fd8cab74-fbd3-4350-8965-1a23e2d33d59", "value": "98b5d1281fc45604bb645cd9eea268b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cc3c7c-5f10-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696023393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023393, "uuid": "8cb55ec3-fb5c-4943-a634-0e22497acfc6", "comment": "Malware payload", "value": "45ca6e1623d587c25a240bd8926d66b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023393, "uuid": "0fbc75ef-cf49-4686-a2d7-94f5627314fb", "comment": "Malware payload", "value": "e8342b84db609ded5807bd94ae1e682e93ac9600d630df900601f18c02b93b1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023393, "uuid": "2f1fe801-d9fa-4e22-8b7d-2de10fc05c36", "comment": "Malware payload", "value": "aa0974948b2ff91ee20ea46410193201f75b8b98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023393, "uuid": "948faecd-a369-4841-aa43-a8e77ce45a50", "comment": "Malware payload", "value": "495489202dc577e6cf4e5a842894cfaaacff56308612924fddf3d8594adb8e7e51549e668313dd4940df71b3da6aa2b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023393, "uuid": "61e78187-b6a1-4575-86fd-25f3359645a0", "value": "T1CCF42370D5512B4B7526F472F8023850B3A032D3BD0497BCF57A3914BA9E4B7845ABBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023393, "uuid": "12ac1969-860c-4b28-aaed-7e5d8a881456", "value": "12288:022oVD22ENtacWZpJnoTwvOdDKslijHOFl+ainkJ5/gFJgCU68xYvkJ:dxZ22Ut5MpJXQDRlirSx0gy8xeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696023393, "uuid": "d5f73caf-e846-44ab-81bd-7a6578e02095", "value": 733248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696023393, "uuid": "64cd7189-a6f3-468a-be08-d7211ec6f824", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023393, "uuid": "2942e732-c784-4e72-8f6c-1fef85be2207", "value": "@04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cef4cb2-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024162, "uuid": "35d4d573-bc1e-4c1a-aa2d-bfca499d34c7", "comment": "Malware payload", "value": "97bbe3d7db9e17215cf609458b600cc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024162, "uuid": "b50739fa-5d20-4f7e-9618-ffc45eee1da0", "comment": "Malware payload", "value": "e8c24b22deaa5070009a1a26f0763187d5be6ff8a220667eefa00cdf19138f2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024162, "uuid": "c45ecd9e-91e4-416a-9a4d-4aafa97d5b8a", "comment": "Malware payload", "value": "c72d2a8b8dcce373c41aa277c735b83bb5eb7701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024162, "uuid": "09a64fd2-3a62-4951-8bed-4ba11b12d1d8", "comment": "Malware payload", "value": "c9a3c2f0c662ee345dfe43e5a2a4522bfa15a49673c29a65e4422ad40dd5cb85ecbe9372ccfd0ddda10912f632bf710c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024162, "uuid": "ff0b76cd-972f-4bdb-95d1-2a62cd0c6fc0", "value": "T12734236B54FE23139A78C7404A7E4E3FB01EB91539711877A18ECAF49CA03B3A65D8C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024162, "uuid": "7d24c578-c1bb-4dee-9dda-cb7d311807ce", "value": "6144:5B/+zBeZr9wy4YTdi31colkDkqmwBat7bAqO1+lnPSYFQ:5B/csh9wyp5U1cAQkqX8FbuSnfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024162, "uuid": "f84743b7-9de7-4c1e-ae0f-1e54a9919467", "value": 251920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024162, "uuid": "8a863564-1cf8-4933-b31b-b853ccab846f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024162, "uuid": "a90df1a6-5279-4b02-9cc3-17e6a1c595c6", "value": "28832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2427a5-5e70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695954821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695954821, "uuid": "09e04318-48d9-4264-b4a6-500b7172c80b", "comment": "Malware payload (MysticStealer)", "value": "bc65d604465049597b656b73b1afd328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695954821, "uuid": "cfbdd8b8-5acf-49f1-8a65-61d36c8859bb", "comment": "Malware payload (MysticStealer)", "value": "e8d64a783e8e02f927a12be9ecb7f413fb03916cfebcb0a198bce1e37b9e5554", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695954821, "uuid": "1f1645ce-8b0e-441c-9f3d-5974372f71be", "comment": "Malware payload (MysticStealer)", "value": "6a9160a225faf54cea360ebcaaf95515d4934c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695954821, "uuid": "6aacbacb-a8b3-43ad-b909-43b2db1be053", "comment": "Malware payload (MysticStealer)", "value": "ba1d3d862a8699dbd9bdfc4a32a661f77248e169509e1a2726903acca65fc4638142a1c093f6c4a7f4a70ddfaaf8b160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695954821, "uuid": "5da0a37a-2a5c-440a-9634-b0332f1e83df", "value": "T16E259D2038C49476EDE322BB42ADBA36467DE4B4072655CF16C71BEED7607C13E32686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695954821, "uuid": "dc733679-af40-4edb-8d06-7a22e2f5b135", "value": "d215e7ae5c8053185b6f0c1eed2c8e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695954821, "uuid": "bbd12128-a190-43e6-8b36-4d161520d7ce", "value": "12288:T+mAovYIBYDKzcx9jkmP8bey7/0RDMmZZxnyUuyyu6pbqFghgL/9:TH/YDKzcx9jkmPe/knxyf0FghC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695954821, "uuid": "8a1396b2-21e1-489b-85cb-b18e19a2edc5", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695954821, "uuid": "ec5c8370-7d4e-41e9-b788-05ab9f06ec2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695954821, "uuid": "0b0276c7-4ef5-47ca-9037-b60c19bca0e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e1ebd0-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1695977501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977501, "uuid": "e9e20ecd-97e6-4e54-9faf-87a898d73e94", "comment": "Malware payload (IcedID)", "value": "90251ca3d9861e0952d003244d2ca6c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977501, "uuid": "1166c48f-6295-48d8-8709-1586c2354593", "comment": "Malware payload (IcedID)", "value": "ea52295b81ac4877523c84178555974c4afaa905d6b8009859eaf82b3d3c5921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977501, "uuid": "f8d3ceeb-30ec-420a-afde-aee1354d3e42", "comment": "Malware payload (IcedID)", "value": "a0ca31506a4e8be1ed02c326108e4004d6498048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977501, "uuid": "18c01b11-1762-43bc-a811-72303c468936", "comment": "Malware payload (IcedID)", "value": "64c930014c2039dec873a7ce1271c6ce2a1ae5ae29f7ed4510fe4a95562d5196e82173909704cd9b5d2775c060f0f625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977501, "uuid": "7b8ecd1c-ac7f-4ccd-be1a-9e614583766e", "value": "T128B4D5E43005865FF758CCBE5ADCE198F16CDD724BA701A2A73C2C76C678C1EAD89624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977501, "uuid": "2cc4720e-463f-4294-95fd-0b5ab02922d2", "value": "ac10be1410cedfb63246b3c00364b751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977501, "uuid": "d89d0f24-cf6f-478c-b768-543b6d159511", "value": "3072:ZdkL0HXUnmwaut09pYNWfxjP7+w4Ooxd4BlDUwRq5snio2fWKIulMdtb6n36Wk3x:ZaS+mY09pYEljloX0n9K43WOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977501, "uuid": "603460a5-1d94-46e8-af33-66f969d9ba80", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977501, "uuid": "9b1602cb-1658-46b9-ac40-f98ab18ac89d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977501, "uuid": "fee3d54e-55ba-4bab-9936-b765e4b0943b", "value": "90251ca3d9861e0952d003244d2ca6c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9361e992-5ebd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987880, "uuid": "f73670b4-b36e-4410-ba4a-c3b565dff834", "comment": "Malware payload (Mirai)", "value": "8997deb8f88f096d6f350d57f3e31eeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987880, "uuid": "42bee4c0-7f55-4ecb-ad18-964977fc8f3a", "comment": "Malware payload (Mirai)", "value": "eaa6500d94292127e096ec5897db7afc6ea0178c76d756861eaf3f9acc70bce3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987880, "uuid": "0d111144-08fc-47bd-b20d-ad32af6140a9", "comment": "Malware payload (Mirai)", "value": "31e57a7c68288b53d1aa61b4fb49919de174d127", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987880, "uuid": "238abcda-3668-4b52-8c92-8a455c7cc231", "comment": "Malware payload (Mirai)", "value": "e85d8775394f5725a7a8633af19e85007ad67fb89d4e1bde88ae07888b0659780f451a2f13a413504e40d2101db027ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987880, "uuid": "f8798b4b-9b84-4ce1-b210-3c96887f49e8", "value": "T122338CB5C579EDE8D1144A78BE248E749723E000C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987880, "uuid": "591ebf54-fb28-438f-83fa-fd7ed806d343", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvH:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987880, "uuid": "5687384e-a2cf-47bf-8986-7ddca7ce7906", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987880, "uuid": "7dbb3368-5c53-4941-a978-30736b9c5428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987880, "uuid": "1501258c-1f30-4483-9da9-69485f1afad5", "value": "8997deb8f88f096d6f350d57f3e31eeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4641e9-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695977453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977453, "uuid": "7c30d50b-2a7b-4457-ba73-2c43c8c901df", "comment": "Malware payload", "value": "8fa531b2271ca87b19c17e406f77a6af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977453, "uuid": "bb25274a-9712-4534-8b6f-ffa743d5dc04", "comment": "Malware payload", "value": "eb990c728b0b2c904791c12d6cad613ca4657b19e688278b920be6d320484460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977453, "uuid": "80cd6e53-ec8e-42c9-a0ac-ad4b2489c121", "comment": "Malware payload", "value": "e75e22acfa4bd6527207beb89cfe45b249bcc3dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977453, "uuid": "91893bd8-3d98-4ee7-b8a5-3181b0a63b2b", "comment": "Malware payload", "value": "8448baa75a796314201176a946788f2a7b97a970ece5177b58d0b4382c32ef16d2ca409bd4c671f2b7dce716f89970e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977453, "uuid": "c7f60b1f-2e98-474e-8b4b-f92693a59ae0", "value": "T1D815C503BA67A8B3C148173AC59B0C2413E0D5A17613F71B798E236958437BB6F6DD2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977453, "uuid": "f67f99c5-fba8-4304-885b-ce98e805dac7", "value": "24576:rIM9HHIMuuxSX4o7hMuJPZplzFAvVbcZhiT8Yu/eo7:r1nFuKSXFDpiT8Yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977453, "uuid": "2a0a9695-e8e0-42c6-8c8a-50a9cfed573c", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977453, "uuid": "c0dc7796-fa38-42ee-acd8-89152efc275a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977453, "uuid": "490a68ff-a8b5-443d-abe1-2409030cb776", "value": "8fa531b2271ca87b19c17e406f77a6af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521ac476-5eff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696016118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696016118, "uuid": "bbc001ec-0118-4043-99b1-3896718ccb1c", "comment": "Malware payload (Amadey)", "value": "041c8422ea69bece6e5eecc660f6e36b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696016118, "uuid": "772f3595-025d-4692-8bdf-8d6bf9607f67", "comment": "Malware payload (Amadey)", "value": "ebb1f2b70c5a940af8c3d6065d3b1022d40f5cd48f3b5f88a9e41bdf35e20745", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696016118, "uuid": "62488a85-aadd-4ac2-8ac6-11c2dcb25671", "comment": "Malware payload (Amadey)", "value": "1c5a003f273df9c76b2ba822220a499d2553af8b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696016118, "uuid": "c2dea27f-6b52-487a-9121-663d594642b7", "comment": "Malware payload (Amadey)", "value": "33ec56c3b1772d3308c9137a95d9e40e6aff3045184da1d990aec2c515dff9003f4a511138fe93233da0ee486c8d4098", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696016118, "uuid": "da242a65-c78c-478b-bebc-53a7d205e254", "value": "T1003523C3FBE590B2CDB51B300CFA01A30B757CA149799A9A2349AA5E4CB35D8B43175F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696016118, "uuid": "3e54bbee-c720-4582-9436-fec6b2da5d16", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696016118, "uuid": "3b6994e9-d25a-4754-bc8f-50e6761c7bed", "value": "24576:VyX5/cZ0NBsabsna7x4rgAUzVyp2Bv5tcr4TuAsRFtdL:wJJ6t+Vyp2vecyAsFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696016118, "uuid": "f65e93d1-fceb-425b-b89b-84929bdf30be", "value": 1111040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696016118, "uuid": "203e8674-05d1-4fd1-b99f-2608138e39f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696016118, "uuid": "1c7323b0-f706-4e14-9bd9-1670c909745f", "value": "041c8422ea69bece6e5eecc660f6e36b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9beef5ea-5ebd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987895, "uuid": "6a2144fd-e772-4730-94ba-2b00c89999b6", "comment": "Malware payload (Mirai)", "value": "f987a029adb8ca77c0798ffb437372e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987895, "uuid": "7697e6e5-b10d-4653-a4a4-681bee6e5226", "comment": "Malware payload (Mirai)", "value": "ec0fc2b8df6edde5e9f7420aa7890ab07493a317852086ff274968f5d6b173c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987895, "uuid": "7ae21a17-f668-49c3-9422-8e9d80073c21", "comment": "Malware payload (Mirai)", "value": "6ee6475e6c52c12c00cf2bace7434d7fab3be2e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987895, "uuid": "5e1602a1-1b78-402d-b185-96bdc9642886", "comment": "Malware payload (Mirai)", "value": "6aade284b84f3aa2ddddea1c25e7037fef9e6584ed37dfd593cef699f603cf90675a1c7a45035612266f0688a230603f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987895, "uuid": "9e42edd3-7100-44e6-a1f5-0edce3d2cd84", "value": "T13DD2E0026641FEE1C5B00232ED678A9AB2253DB9D0D134FB863D0DF8A6F9A1D47F4943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987895, "uuid": "25d6edd0-3643-4a3c-9109-c8ecb005f7a9", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXgK9q3UEL7v:WRwynNIOQQ1KMw/Lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987895, "uuid": "e051c275-f1f0-4fba-bc1b-0d10f137006b", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987895, "uuid": "cc8725bf-e61c-4f9f-b9a3-1f5408706bf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987895, "uuid": "589af8bf-9114-4399-9f54-0949fcea2c7f", "value": "f987a029adb8ca77c0798ffb437372e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7184e16f-5ed7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695998991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998991, "uuid": "f2165b7f-8daf-44d3-8274-ace128362445", "comment": "Malware payload (AgentTesla)", "value": "c58659f0aa2577165d9851c741ce3d41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998991, "uuid": "7905eb4f-70af-4fcd-986c-ba60e0370be3", "comment": "Malware payload (AgentTesla)", "value": "edf13a85a262b36d314a70bc8abd8f123e77c47640a02e6975eca3a9292a66a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998991, "uuid": "5b8825f6-ff2c-4f0f-971c-d03d6c30ead3", "comment": "Malware payload (AgentTesla)", "value": "e27f1decb0abf28c29bf17f02a86a083627fd5eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695998991, "uuid": "f41040a7-0ec4-4cf9-8ddf-a9847e452cb4", "comment": "Malware payload (AgentTesla)", "value": "0c4aedc57fb9a35f46602d2a9d22ada7b47fbde2238039578502f4614e7055c2052719ef31253d15ad24fbc3678be83c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998991, "uuid": "fa02c0f7-d50f-423b-8708-0b4dfe769b5c", "value": "T1D9E4230523855F1DD4BC9BF07A62621213BFC633286BE74E5DCA34F529A334247786A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998991, "uuid": "97e0cd96-e238-4730-aeb8-9df29352eedb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998991, "uuid": "71d8fc5d-cffe-4a6a-85a9-b4ff2e221126", "value": "12288:dzbXn2iNzEisUH/qvkuQ9i1W1zgI7rSPNj8aU4SJmB+Zhdi0cfkg2GcSDYfkmaZG:9b31hEWkBQGW1F/gSaUrmBairfV21Ood", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695998991, "uuid": "1fef6004-ac81-4bb9-b835-122e7ed2b1b9", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695998991, "uuid": "d5f0427c-34a2-46d2-ab3f-036d4497d749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695998991, "uuid": "fe3d7aa8-9949-49c6-aecb-b851e9574169", "value": "c58659f0aa2577165d9851c741ce3d41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3a3c6f-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977428, "uuid": "c3df5943-ea0c-45e1-b01a-e4944892ad92", "comment": "Malware payload (SnakeKeylogger)", "value": "18ac519c9daaa1f525e9d8869f047e39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977428, "uuid": "619483d2-7fb8-41de-b789-9e8ea16cc44c", "comment": "Malware payload (SnakeKeylogger)", "value": "ee40e7f0beeae7021f622dc30baec78d41b7759b0c2bd2c2ca331162973c9d07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977428, "uuid": "cee9c74d-6995-4078-92e1-9cb70289b782", "comment": "Malware payload (SnakeKeylogger)", "value": "16cafc7e4b9c91af3988ad28516524683847974b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977428, "uuid": "4a8a83d9-7ae5-4896-87d7-9150203e9528", "comment": "Malware payload (SnakeKeylogger)", "value": "608f0073464337e9d4f3db6c7c7b0c8df8c75a80d1d93e156fa0a98919e31cf6000b862b80c0e3228cbca6dee8c64c0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977428, "uuid": "2ca7ea28-9382-438a-b0c1-3f5a05bf481f", "value": "T1CDE4014072AC2FA6E57DA7FA1268210117F29933A032F3089CD774DB1A35F586F62B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977428, "uuid": "00061ad1-93fd-427a-b32b-55102210e277", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977428, "uuid": "8fc06b1f-1499-4b11-8fc5-48b718a08cc6", "value": "12288:VVj3hLQvfdxOo7gpXtrBF725liut/cT/6AbZ283DR4cR8s5p3XREK7Doc+pc11H7:jMrz/cTyk4O5pxEKIHeFQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977428, "uuid": "01ebdadc-1f68-4464-bd6b-f616997f7209", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977428, "uuid": "fa2d4f43-6408-40dc-ade4-1490e6c16af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977428, "uuid": "05be4219-771c-47ac-8579-5c5a37702c58", "value": "PO23-00016.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07295330-5ef2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696010409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010409, "uuid": "b0c61b2c-a9e2-436c-8229-523873487a82", "comment": "Malware payload", "value": "ddabb239b50abcfafb7c729d93c5200c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010409, "uuid": "90e2e24d-b66e-4b78-bf44-88bb034e13ce", "comment": "Malware payload", "value": "ef02fed17991ed974ee80dc184c1a2508959bb7b0419738d78bfdaad4c9818b4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010409, "uuid": "70fab675-99d5-4c73-8fc7-571fbfb8bcc6", "comment": "Malware payload", "value": "74969f2bbf8af20742681337c0f702eb27c826a1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696010409, "uuid": "1ab76230-ade4-4a42-9ee5-11809f9b74c1", "comment": "Malware payload", "value": "0a5734ebbfbb8ec8ae8b18b907eb893aacd368ab3591d9cc844f3a289ce1e9c055c9f40738c8f8d08e48847ac8e2e85c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010409, "uuid": "43b76c11-4dc0-495f-a588-750cc329b200", "value": "T115C2E032D149D620D1710939D698DBB3776D08F4E32E332685402378F29BCA1B2B46D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010409, "uuid": "f22e3fb4-60eb-4d8c-ae6d-d6ef45f1af4a", "value": "768:Vs/8SyBZFSPDtLjKkgkfjNFSHcPLS6s3UozN:VM8SssLtLjdgkfjv9PL8zN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696010409, "uuid": "68958841-defb-49bb-bfaa-6126671ecccb", "value": 26088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696010409, "uuid": "23a5c86d-6f7d-4f1f-99bf-1e99a466362d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696010409, "uuid": "44620718-d36a-42ed-9b05-34e511e4aedf", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbb3931-5f0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696021160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021160, "uuid": "808c3c4f-e467-4f81-ba96-9828c0eb2afd", "comment": "Malware payload (AgentTesla)", "value": "740e01ca913de68ffc24998c1f003067", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021160, "uuid": "0e7b2d44-fc05-44ae-ac3d-c55d2b419fb0", "comment": "Malware payload (AgentTesla)", "value": "ef6d2c44de401edb2099c5a718cd59d79df97294a8f2f32e2c0929d6aae2e3f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021160, "uuid": "c0ec9913-eb36-4d88-b02f-11f9bbe3596a", "comment": "Malware payload (AgentTesla)", "value": "e94c5e240c19a521601893aec8960aa66bfbe0c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696021160, "uuid": "063a0ab9-1e52-439d-9210-2d610a4309bc", "comment": "Malware payload (AgentTesla)", "value": "a4db786d95ec9ac7d2bcda7366e7b92da75c11e2b9b340b84f6220e29f5bf4ccb83fd8299264f7c77b41b3081e490fb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021160, "uuid": "bdbf9283-8f8c-4be8-bc41-6c90873cda42", "value": "T1D8F4011136EC4B86D9386BF558729D6093726FB27D22F78D4DC275DB22B2BC08240E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021160, "uuid": "7770b443-5439-4c63-90e8-539aedb87876", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021160, "uuid": "c91833aa-fb03-42e8-b619-df28fc679e94", "value": "12288:i2iN4yiRJU/Wcg39C3GghIxojeowYOZE/aMfAgykwpubeVpI0lRXSq:i19FeXNC3Gg+xo6ZZEyMogyJube1Ri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696021160, "uuid": "32d3101b-b853-4b2f-92bb-770170c87ff0", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696021160, "uuid": "36734b92-af8d-464b-8bae-ca02263a29f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696021160, "uuid": "365f72a2-9676-4e15-87eb-4b68fd004a73", "value": "y69K6Yd25XPiIxw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4da896-5eaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695981909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981909, "uuid": "095f7366-1061-4b0b-9dd1-4d5a697fe3e0", "comment": "Malware payload (AgentTesla)", "value": "9a4794eff8d8802ed0ab6d454325946c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981909, "uuid": "30371577-3574-412f-b5a9-d2ed06f4fba0", "comment": "Malware payload (AgentTesla)", "value": "ef6db59e883cf13c5ced9fb480ef143425476504226d411a6653b9d1508fa0df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981909, "uuid": "243d3b3b-bc4c-494b-962c-94693bd07c17", "comment": "Malware payload (AgentTesla)", "value": "326a8fe4adc9360cb143a0e0876eead496044fa2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981909, "uuid": "946bcd4b-5559-48a6-90bc-b9d6da2c63aa", "comment": "Malware payload (AgentTesla)", "value": "cfb2caf91258e714447abfd3abdb5f4ec1cb48c594ccba0dc1a608138dc891abb2dcc8a11845a47b0dceb93f394793ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981909, "uuid": "62d0999c-26c8-447b-8564-e8a9dabefaad", "value": "T1BF93036ED38F02A8CF9203765B1B0E8556BCB62EF34291B1346C537433E9C3956626BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981909, "uuid": "319cc5e8-da57-4c89-b2d6-687f7195cff1", "value": "768:1C7Wq0BiIsxPpwkWfYjugztCUlkXba1C/QJ8bxC7eSC1Dyeh6Lycoybru6a5Wfrh:1C6q0BnpP4ugzxFJmC7FC/huvu6wWjVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695981909, "uuid": "5648a88a-2d46-4880-b6ea-c0277db93c02", "value": 95677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695981909, "uuid": "c4615102-67c7-4935-b20c-79174581da3f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981909, "uuid": "b12708a5-b65d-4755-b5e4-3c449fd5c014", "value": "SUPPLIES-362537.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf8a40b-5f17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696026660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026660, "uuid": "40fb0230-9c48-4964-8783-45b2f74050e5", "comment": "Malware payload (MysticStealer)", "value": "841ce3c373d4cb9cbb3735dca68b19e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026660, "uuid": "b558650c-bfc0-44fe-accd-8bddd76511ad", "comment": "Malware payload (MysticStealer)", "value": "efb28b1aecd409c9e911da6a1e07298d0b63bbd95ededc981d2ee6ebda04586c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026660, "uuid": "2c954562-058b-47e1-bf86-3ed7493f42c1", "comment": "Malware payload (MysticStealer)", "value": "5d68fb29b233b4fd841d62d74c1b598d768c3e70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696026660, "uuid": "4489ba98-cfc6-4f51-9214-975e25df5b56", "comment": "Malware payload (MysticStealer)", "value": "e8d0c98e82b20b3437b9cb28cfc291679294e26db8a471cd28f5454fa9f15519f9fa77a2d0432278f27df1404a3a8584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026660, "uuid": "25ca3844-2edd-44e7-a31f-8f492be29943", "value": "T12974BED2B4F18073C630163546C09B74B93E2AB40921BE6FA7D44E6D5F22361E663B7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026660, "uuid": "3493b9a7-40b7-4d27-9ca1-6c6162b241c4", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026660, "uuid": "5ce357c3-cf31-4541-8783-2830d9ea073a", "value": "6144:1RsTeW/s5GqrO5aXnfEGIXWPvZAO1ySpH1uxXVvtfeKc9yJZXkRAnnnFHvVs0BC+:FmcGqrOk86xJ51uxreKcEZ0S9s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696026660, "uuid": "a8bf3fdd-0457-4982-904d-9f925a356396", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696026660, "uuid": "e1f062a2-150c-47e0-8b62-dcbdb1896fe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696026660, "uuid": "e941af70-116e-4d0e-a373-e43ec08257c7", "value": "SecuriteInfo.com.Trojan.Inject4.61510.2841.6450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc110c41-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024456, "uuid": "294057e8-a313-46a8-bdb9-7f053391b83e", "comment": "Malware payload", "value": "3dc26de89250504ba7e8779f691945b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024456, "uuid": "5a4f64c4-2dc8-470b-bbf5-2ba9b3dae6bf", "comment": "Malware payload", "value": "f05eefddaeef1a311d72c418ec0d87f0c5915043e0f7072f7642b0289e64fcd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024456, "uuid": "0c0f1138-706d-458f-ab8b-86d1e12402d2", "comment": "Malware payload", "value": "0575b556de252ca39c0c684a47ad42b8be502de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024456, "uuid": "7def7287-0591-489d-a162-a4ef1ee2a220", "comment": "Malware payload", "value": "d341162c0aae93b9926fc8107eab3ff221eb2c37d71a90313e2a0cf8595aa78004aea087536991b4312b4fdef3f82af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024456, "uuid": "9d8cca36-17d0-4055-b72e-b59b32c60c0b", "value": "T12034236C196D515DEDC19BE2DC2C1F9E66ECA83F5C26098C446C26EA90323FC484FD3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024456, "uuid": "21930b5a-203c-440a-8abc-8e5630329cad", "value": "6144:NK7lomJumqIAWdrJMpE9gNG2ZJ/ysP9BN++o8svT3sQxC3gJf:NK7lNzB3drWe9gNBJ/LP9IvT8QRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024456, "uuid": "f7173de7-3f4e-4e8c-bbfe-b047ac060394", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024456, "uuid": "37ddc2e4-c984-4b19-93f4-8ef3eb5b08be", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024456, "uuid": "2bd92fff-c78e-4903-b606-ddadb31f827a", "value": "288339.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1325ed3a-5ec5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991101, "uuid": "35462db5-9d95-4dff-b0a6-eded0eb34e50", "comment": "Malware payload (Mirai)", "value": "594a5d6b2f46cced572d367323c6b78c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991101, "uuid": "1ce4561f-4dd5-45d7-8397-b8459b2efeb8", "comment": "Malware payload (Mirai)", "value": "f13e70a9b99245335c357b2222933e5d710611238127c57e6fff5a644cf975d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991101, "uuid": "235a1ab2-5e6f-43d4-9305-3fddcf40b1ad", "comment": "Malware payload (Mirai)", "value": "a881be20cbb983455561601edc670d16e14473c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991101, "uuid": "21447c42-1069-44fd-9625-b77e35078c2a", "comment": "Malware payload (Mirai)", "value": "cede412dea9065639327561aae509d068183c7eedcd3ae34ffd9e52ff46c9b6163aa2f5e4d7c956cd217a388abefcf92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991101, "uuid": "2b13b6dc-c4c1-4ad0-b9aa-cbcdbf171581", "value": "T162B2D0717015F8B2C7A600B7ADEDDA83FB810EF8D0E873295465099DEAD8D42BAF1147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991101, "uuid": "233a235b-1740-49eb-a3e6-0f49904dede7", "value": "768:5X9nxn8o9wnBoWzEQf2EjKb3pU0LSWs3UozL:5tn+o9wjfBAZU0e7zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991101, "uuid": "41585b27-5f76-4dc2-b11f-d77aea1bdd55", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991101, "uuid": "24c84ad5-dc24-4698-9c10-317c4fbaf5f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991101, "uuid": "07c1a831-4a45-40fe-abb1-572798b977ac", "value": "594a5d6b2f46cced572d367323c6b78c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fa0538-5f20-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696030241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030241, "uuid": "a21fe46d-ca9b-42c2-941f-36a609286408", "comment": "Malware payload (Amadey)", "value": "b0c078d7b4f369d38617dc486f511a42", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030241, "uuid": "869f4b31-0ddb-4d30-bd82-5819d9e20151", "comment": "Malware payload (Amadey)", "value": "f1a883900036295d2cdd2d9bac0d78d7f389524b963e93c58933754a7364395c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030241, "uuid": "cbaf9a28-32f6-4801-ba3f-cb650c0860e5", "comment": "Malware payload (Amadey)", "value": "eabf985a6b963f43e9a0746fcd0d38b6db50a2f5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696030241, "uuid": "de8c8da7-b830-4285-9882-8aed520f5de3", "comment": "Malware payload (Amadey)", "value": "78b1d1f8be714a23b06da519dd2343a982a21c26ce71f21fffc878af728c0bb7f3b5183c37533ede83187ab7ee5b2b83", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030241, "uuid": "389e2d7b-16d7-4b9f-9b64-2222b2aed9fd", "value": "T15D34AE01B5D1C432D472193205F4EBB65A3EB9600BA55AEFA7D40F7ECF206C1E631A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030241, "uuid": "16ec10c3-57d9-4483-986b-d1f9258ea034", "value": "73011e4ba8dc0b0dfec2e41202c785bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030241, "uuid": "d453168a-e8e1-4c4c-827c-bcb08cb2aff2", "value": "6144:qaCuN7Gvda4NsjH5wzz0mAOyCZ4sB43viKC:qa7Gvda4+mICZjByiKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696030241, "uuid": "3b2bffba-b170-44ae-b33d-9c1e5df7d16b", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696030241, "uuid": "18de6cea-7c83-4697-ac37-6720afae8fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696030241, "uuid": "5858ef51-e36e-44ad-a9fa-b3064e576b51", "value": "b0c078d7b4f369d38617dc486f511a42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d555e4a-5ebf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1695988649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988649, "uuid": "627a3c92-6a94-4861-9a9d-169b4af6322f", "comment": "Malware payload (QuasarRAT)", "value": "dc9966cb88bcfa31c01b5eab762958e9", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988649, "uuid": "fea2fb37-07c3-46e7-bb70-88af59fd6611", "comment": "Malware payload (QuasarRAT)", "value": "f1a964320bdaa1d307256b40ba85fa844fcfe07cc583c664e279151b30623e0e", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988649, "uuid": "cd5443c9-8103-438b-a338-5efe04e38951", "comment": "Malware payload (QuasarRAT)", "value": "a9ed018f2c328bf8d0cae48c664de1629d951211", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988649, "uuid": "96397ff2-6d1e-4555-915d-6d13e0a1cfb0", "comment": "Malware payload (QuasarRAT)", "value": "4b4d654340b76cd316c1352e676345992957920a6b50dcc08592185cc5dcc528788c39e5e3d29aafb132173a74328e73", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988649, "uuid": "5fb46e03-7c04-42f6-998a-bcad8ed255ba", "value": "T1C6C148C21659953273615A029EE6A035870377A0BA3B6B7DC084CD0C5FEAB85CD677CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988649, "uuid": "59b2f77c-de6c-4087-bd7d-7877d3b65109", "value": "96:1L2Pb8AgH15uX66XHqWEQmYEhq5P5Xvbtxn0byeg4sXhZvel14vHYZK9rBoMbqX2:UPb7gDcpHqZRY35h/X0BsXiKYZK5Pc9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695988649, "uuid": "327e638f-4022-4879-af0d-6c343def1bef", "value": 6028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695988649, "uuid": "9e377644-4186-4277-9ddf-b8c926402b24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988649, "uuid": "f9f712bf-6a8c-493c-ab32-3e6312775372", "value": "Required Aircraft PN# List.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30073985-5ec1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1695989432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989432, "uuid": "84e1c5f3-7b84-4401-b525-d73c95bb9972", "comment": "Malware payload (Smoke Loader)", "value": "a8d5b446a517aec8e40d811c6f249dfd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989432, "uuid": "9a8ff8c3-4f4b-432f-9e25-2c391c7580d6", "comment": "Malware payload (Smoke Loader)", "value": "f291a9665dde96e83bad0c14f2b9342530fe88a20cd722087316719d0ef88022", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989432, "uuid": "295bf2d6-a5e0-450f-bd93-c4c33d9f9f60", "comment": "Malware payload (Smoke Loader)", "value": "15019dbe6b0746bde942f6a0b9d7da969f945a1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695989432, "uuid": "86180461-9f22-41af-a970-a06420a3188a", "comment": "Malware payload (Smoke Loader)", "value": "cd7c9b007aaa39acecff9e593932014f8018f072dfd32e7e41a632a3d8673a2508e6b4cfaecd17962ff27fd36b5c7ce7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989432, "uuid": "6a449155-0939-4597-b529-f02faff5703b", "value": "T1E834AF11B4D18072DC7215360AE4DBB95A3EB93029925EBF67E60F7DCF30281E631A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989432, "uuid": "965cfc47-fd7e-4f21-b78b-b864f3322fac", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989432, "uuid": "041cff6f-6b2f-4758-9091-be8de0ef9e4a", "value": "6144:8Dz4SHy5uoBMFGV5PEkIXEHvZAOFTrEVVs0BC+:tCmuoBMUOMxHas0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695989432, "uuid": "e976dd7a-ed90-483b-a74e-a41bb137ee4c", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695989432, "uuid": "37340e49-43c8-4121-83d8-4142dd22743b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695989432, "uuid": "b2803f09-2e5a-4f32-b8e4-9d940fd2e316", "value": "a8d5b446a517aec8e40d811c6f249dfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded7cf14-5ec5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991443, "uuid": "e9ad41b1-c458-4052-845c-125730809234", "comment": "Malware payload (Mirai)", "value": "5eb2cd7c4ec9497afba5ce812af488d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991443, "uuid": "97f623a2-1c40-4779-a04a-44c9f7728b59", "comment": "Malware payload (Mirai)", "value": "f341581e5545ac0e9e2108326bea4e2d5144d528f359c32931b399b33c506cca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991443, "uuid": "3e65e43f-6d23-42b6-83f5-2b3b93c460e6", "comment": "Malware payload (Mirai)", "value": "d2a011dc97f630790d31e106329c5e0e0aff1043", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991443, "uuid": "0ea944c0-6119-49fa-9680-9de39037cd34", "comment": "Malware payload (Mirai)", "value": "4cffd8371921ee829efc56ba555a29ec829caab4d2d57b814bb2587d6f6e18fef5805818fe667591edc2d84432c91a92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991443, "uuid": "66c60094-17d5-4007-92e0-ecb17484a6f7", "value": "T16C732A26B97A2E26C0D4B57E60FB8B11F5E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991443, "uuid": "de9ec70b-6c8e-44b4-ac98-f89a63fd7b8a", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WK:927jqCt8v3GI/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991443, "uuid": "23a40974-d9f0-4c29-914c-cabca4312c1e", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991443, "uuid": "b947813a-18a9-4c04-afbd-5bc1a80b0428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991443, "uuid": "d778d947-8fde-4fe3-a3fe-8d6f4e46ee72", "value": "5eb2cd7c4ec9497afba5ce812af488d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816344a9-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987421, "uuid": "3848a386-eb03-42a9-aed7-8f0898f56c33", "comment": "Malware payload (Mirai)", "value": "53234b26d9df557570dd36b2a5a24d32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987421, "uuid": "7879ae4d-a6d3-42db-b0ed-6beb6f717395", "comment": "Malware payload (Mirai)", "value": "f3ac75ffd323984b5342a40a4bc7f8a1dc67eb9fe71d6c6a22c5e63c865cf61b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987421, "uuid": "a64b2c91-5daf-4307-801e-61be59964ca5", "comment": "Malware payload (Mirai)", "value": "6836a52c4493de84063b27dcacd9f188d518c6ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987421, "uuid": "01998fc5-5620-4e5f-b7e1-3f5f1486fdfb", "comment": "Malware payload (Mirai)", "value": "c0a004aef597ef75f98e18be5579044111361ca3e61c4b4be2a490f5a5e18f8b5ded7d02d5147fb8badbbd14d9c5860f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987421, "uuid": "95678a68-1c7b-4d2f-944d-1e42c780fc24", "value": "T1F1338CB5C579EDE8D1144A78BE248E749723E000C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987421, "uuid": "ec0b9281-eeed-4bf3-a878-3d69affee2ac", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvD:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987421, "uuid": "3335d145-6ed9-4915-8b21-af9939b23a8c", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987421, "uuid": "e9436934-fab7-4c61-9d7e-4e37ec820f9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987421, "uuid": "5b6fd7f8-a4d1-4cb8-a35d-a10413996995", "value": "53234b26d9df557570dd36b2a5a24d32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7aa014-5e96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695970981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970981, "uuid": "b723a1d9-c311-4f25-86e7-675caf851768", "comment": "Malware payload (AgentTesla)", "value": "2a39d63055d2202a45a9284cb527f785", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970981, "uuid": "721daa4a-97b9-466a-bb63-bb34b46f36eb", "comment": "Malware payload (AgentTesla)", "value": "f46cc6419b9d6460e72e301b9bb5f1e2c8ce102a7e38b18ffd3a016da82da9d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970981, "uuid": "219fc14d-13b8-4105-8b4b-b845d286ee4f", "comment": "Malware payload (AgentTesla)", "value": "971332335fe7e42155f1dc230a76cea8feace286", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970981, "uuid": "d88dd0ab-1042-4b60-981e-b08a6f5310cc", "comment": "Malware payload (AgentTesla)", "value": "f1e3bbd7488cf1de89d7330978d80e705a0028d38760ed6b72c66f9b0a67ec580e7abc8ecaf1c5ac3efea1f0c91d0243", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970981, "uuid": "98081905-9cb5-44e2-a2af-445fa0049b13", "value": "T186F4231190B316032D31E0EFF10563C9FFEB6EBC629B4B0E173DAA6A51924D2F5C6458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970981, "uuid": "6a463775-872b-4d71-899a-e5672f043f4d", "value": "12288:HUYv04Iv/9gXZacaZZp6zrYDJjRROQIoglt0TGrop2qglm3Lq5phuUq:HUnHCJdaZuzrsyQIoiyGY7glm3ufhhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695970981, "uuid": "3292f6b8-9fb7-42c6-844e-582ba140ee3d", "value": 738192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695970981, "uuid": "66036e5c-32d9-4322-a5a4-cb7a210c46bd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970981, "uuid": "13a0c2ac-0512-4fe8-b4ec-c2c0e2b56836", "value": "Yeni sipari\u015f _TR-WJO-28-09.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75826edf-5ebf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1695988689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988689, "uuid": "5c552d3e-d1ea-4098-ae2d-eba1aea1f5a5", "comment": "Malware payload (MysticStealer)", "value": "199ee02e9857faa1d52c85c0022b5e98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988689, "uuid": "2999b987-6c3c-47f8-b6af-e8c67da29be0", "comment": "Malware payload (MysticStealer)", "value": "f49a920c91fc16e71f8424f7b60f9890d79356266b7e8c943de7e105ffc9a117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988689, "uuid": "c1ff75b6-9030-4ee9-87c5-c9cac5440270", "comment": "Malware payload (MysticStealer)", "value": "d74d1a756f32372bd140ae2fc4e1439ad50c1757", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695988689, "uuid": "5c006673-a39b-43e4-b950-9846ba6dfbbc", "comment": "Malware payload (MysticStealer)", "value": "f53c3d30a228b1ffb8b7399299b14d73c260004cd009d3aaf8dba5176453bced02833de2bd24b101f6ad732e5c6e3b79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988689, "uuid": "c62a979e-2c92-41bd-80ba-0c56a738a4eb", "value": "T14074CF30B193C873D82A103949E0ABB2556DFAF58DAD097F77ECCBBD5F20680DA11625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988689, "uuid": "849a3ca9-c514-4c02-8cf5-14663c7763d4", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988689, "uuid": "7a4055a2-b602-437c-9f14-fb85095c2936", "value": "6144:swTeW/s5GqrO5aXnfEGIXWPvZAOnyBkpPwe0HhO57/vJ3Vs0BC+:AmcGqrOk86xJpPOhO57/v/s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695988689, "uuid": "f0819116-190c-4a40-ba44-4ae01dbd202a", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695988689, "uuid": "bdc6f790-f1fe-46a4-a81a-ec5d209441e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695988689, "uuid": "674d117f-cc16-43d2-9c40-9dc433293543", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ea0c71-5ed1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695996226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996226, "uuid": "71a2975a-a084-4da2-af5e-5d703419e09a", "comment": "Malware payload (AgentTesla)", "value": "93927d564bb0622b7892d0dc7c797805", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996226, "uuid": "5d2cd655-7a17-482c-907b-ccee8a58960a", "comment": "Malware payload (AgentTesla)", "value": "f51438ad7bb032bf6360354b92a39297fb381bb3844f378051fb106adff9a3c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996226, "uuid": "b64a0c0d-7d2e-47dc-95bc-47eef44c7a2a", "comment": "Malware payload (AgentTesla)", "value": "162d600b468f754f143ce369762f10537d8ea113", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695996226, "uuid": "dea57d29-1c23-4738-8f4d-20c4ddc6a945", "comment": "Malware payload (AgentTesla)", "value": "99dfecc669f2cf2efbf0ef12458e6568b5f0984d99d58469fdb18390a22074f3c0052b7dfae901afd473ca9dbe1b17ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996226, "uuid": "87caccbd-5b6a-4436-acd1-c029d7fe5f33", "value": "T1B6F4126437D7EF5AD42F03F85870E0404776B8AA6A21D3A94CDB31EB18A27A10F51F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996226, "uuid": "f739fd57-519c-49d1-91de-071a9034feae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996226, "uuid": "4178d07a-8ac9-4dcb-bb3a-dd8fd5597659", "value": "12288:oyXuKsOS9s9Wtw5cgNaKM7tXsmCOy1kBgD3/Hwg3L58f7PBtSH/7mi+TNhasD:oyeKY9s9f5cgNaKMBXsmnPEPHHc7PBt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695996226, "uuid": "5207dead-4044-448a-a515-4513da67a13f", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695996226, "uuid": "0c16c5ee-d957-463f-93a8-8ce71217f30b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695996226, "uuid": "d9d5a738-58b0-472f-816d-b5b8853af6c2", "value": "93927d564bb0622b7892d0dc7c797805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c2f4d6-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987393, "uuid": "12960a44-91de-4bda-b03d-6b71e6962326", "comment": "Malware payload (Mirai)", "value": "9c0a1220335838520b64506099b354a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987393, "uuid": "1346893d-b934-450b-99ae-a55a68984bbf", "comment": "Malware payload (Mirai)", "value": "f53ad6e745062bb88e3b39100d331644e24c4a4dd4578b8c442a24b38e283c1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987393, "uuid": "d44322f8-3317-4d2f-ba5d-c1e6dc3ece58", "comment": "Malware payload (Mirai)", "value": "449ed4e693367c528abf75ac80d7356b9afb119c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987393, "uuid": "b118bb83-e430-458f-a4dd-1ee3341ea4e6", "comment": "Malware payload (Mirai)", "value": "4a1295df1702c7e4df238af21e2c0f0835701e0cc950587d7232d85c354fca1ea99c881be81245ae86497058cd423d52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987393, "uuid": "04d8c0c9-dc7f-46c4-b7e8-3aacf7fb9f8f", "value": "T13D431925AD792E26C0D8B57E11F78724F2F2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987393, "uuid": "7806611e-fb2f-47d0-8adf-7ea77f9b6c8e", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDb:eL0AxvSHfymp0xgunvCkV6vTMDau8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987393, "uuid": "55e65340-83b8-400b-b005-ddbfa5b8424b", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987393, "uuid": "931549bb-576d-4e0a-b5f1-e3a4e93db4b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987393, "uuid": "10339ddc-e50b-4017-94cd-ba06231e3e04", "value": "9c0a1220335838520b64506099b354a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d4ad80-5f05-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696018748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018748, "uuid": "d22031e0-e1b6-4fbe-b450-98b096734c50", "comment": "Malware payload (IRATA)", "value": "70f26c3f671e184e93be41d1667be678", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018748, "uuid": "a34172e5-3999-4640-96be-0159604998c4", "comment": "Malware payload (IRATA)", "value": "f56393fa50072784f053fee70898b54b4c28d4ce9cc1614cc3e6bee477e69e4d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018748, "uuid": "30b2abf5-f69b-459b-84d5-34d8c3c63aa0", "comment": "Malware payload (IRATA)", "value": "4679a06a26ea214c69397f15fcbba36cc9ed5623", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696018748, "uuid": "9a6df261-3012-48c0-a337-b220a2c73f0c", "comment": "Malware payload (IRATA)", "value": "a223708d7e74ea21624853255eb74d8237eb7c48b846407454da2c1f651bec45f1568a663a52b6a6cb62b0e13a559e4a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018748, "uuid": "9b68ec42-e15c-41ff-8a3f-af0884e08fa9", "value": "T1F816D0CBF7A8592FC87750B289AE637152574C128E879F476C44371C287B6D82F89BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018748, "uuid": "64a7f48e-596e-4934-bfd2-4c83f93c65a0", "value": "98304:Wx6woLwow43wmJMQu/1p/WTTeu1gLCrgr:Wx6wW/wWwOu+p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696018748, "uuid": "a94a296b-aab5-4dbb-955d-7c7d014897c9", "value": 4135594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696018748, "uuid": "b9eebd67-29d2-4a7e-8fea-bf1407876154", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696018748, "uuid": "18ae58c0-df4a-4e97-9d18-acb29166be32", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d704b42-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015815, "uuid": "fd96c3f9-1357-4b73-834a-ca789f6dc12a", "comment": "Malware payload (Mirai)", "value": "9adec9ce0f9cf9d17c235ab5b3d6a206", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015815, "uuid": "c33033f7-9414-4709-a3e9-0b545d3bc0a4", "comment": "Malware payload (Mirai)", "value": "f5e006eaf027403c1164fde67e4544cb2eb4f908db14737592292275137abe32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015815, "uuid": "092a6503-3cdc-4a04-bad1-2c1ae13c6127", "comment": "Malware payload (Mirai)", "value": "c3e9b0d9f8015a3f4629495f0937eaa3649811fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015815, "uuid": "0efec0be-6a20-4c51-a0a6-dbff2d67307b", "comment": "Malware payload (Mirai)", "value": "ed7f22a58485c479a72ee4be479a95b5743a45be4d689324d7b80e1ea67da1aee5fc073f407e3f519fd37dfcf2a99601", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015815, "uuid": "80d4861d-ee30-4b67-9111-bb20b4bc29e2", "value": "T19AB2D01AC0AE2EB4FEE77D385945E2817F619ADF7A61CDC016C15A110722E6C1F8CAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015815, "uuid": "be8d18f5-99bb-408d-9e1c-ad4036d0712b", "value": "384:EA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoIMM4uVcqgw05VxJW:KApCdvwJr69VJoA8FZtxCo8z4uVcqgw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015815, "uuid": "8f4f4d24-5483-404f-91c4-c36114ae8bfe", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015815, "uuid": "e5dcfff2-7e8d-489d-a2d0-5bdcb9c13676", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015815, "uuid": "720a781a-a2c3-468d-b752-41401f96fa08", "value": "9adec9ce0f9cf9d17c235ab5b3d6a206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa72bbf9-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695987060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987060, "uuid": "076b9941-7af4-4b21-be92-ec197519d71f", "comment": "Malware payload (AgentTesla)", "value": "d8f6b1d6c8b4210fec0826280dccf0fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987060, "uuid": "a148352b-f409-4d0b-8f70-52ddf5d6ef59", "comment": "Malware payload (AgentTesla)", "value": "f6179cbf2bc8c51ab1acf7f5b4fce4857a27d6edc8ddc8d37a99476596d1e0cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987060, "uuid": "948fc114-fa05-43d7-90a5-c72b82aa6a6c", "comment": "Malware payload (AgentTesla)", "value": "f59984da353f47bf005bc7c701e2987d268a0e0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987060, "uuid": "5a115295-7411-4966-bdcc-23edb204daab", "comment": "Malware payload (AgentTesla)", "value": "344184754182e132fa15d673018fca72d9e40a23649ae911abaaf8d4c3cdb8f0edaa6eaf4cfcb891e0f86812ac6d352b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987060, "uuid": "9af90d74-577a-4c78-9086-c31c4f828a66", "value": "T128F4020767A11591F6BB1275A672247043BBAA25E839CF1C0CCC908D9BFB3A0B955FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987060, "uuid": "c877e256-57a9-402d-a250-106869944fc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987060, "uuid": "3995a0ff-3339-4ece-a81e-131b52e7179b", "value": "12288:PcRAckj5zjkKUkQBzR0LS4tVM5nSFc3648GLxr0fsIDhyYj:CkGFYVDu36VGLxr0fsuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987060, "uuid": "813097e7-f128-4a60-add2-7cf4db257e55", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987060, "uuid": "f9e7b917-a021-46d4-9d17-7b3ccee6a8f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987060, "uuid": "65382baa-0d7d-484e-8138-7a23d8dddfc2", "value": "d8f6b1d6c8b4210fec0826280dccf0fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedcbbec-5ea6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695978102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978102, "uuid": "14d4e0b0-e071-4aab-88bc-9032a2894330", "comment": "Malware payload (Formbook)", "value": "69d7546a22b83d22f71ca06c9f3062a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978102, "uuid": "af7ba520-ed52-4e94-af13-8a5b4c797e3f", "comment": "Malware payload (Formbook)", "value": "f6394ccda408715ab66bf77857cec9151af093ea62dd137851c274cab11b4acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978102, "uuid": "b6b587bf-da89-4299-abea-8cb305147496", "comment": "Malware payload (Formbook)", "value": "363e4d1357576e2f6a46e8d090ff67326b9e059c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978102, "uuid": "37015fa5-3163-415a-bc84-2998e7c532b1", "comment": "Malware payload (Formbook)", "value": "5000c05fbd2dbcb7945ccc12f5d399d5f3bdb076f911b5d90d64755335cdc7f045b4662cdfcaae1a2d58c1099b10ebca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978102, "uuid": "9eabb6ef-547e-49dd-95e2-ae1d5b81dd61", "value": "T1C8D423A478A24BA3DC9A17361ABC103A8370F660E401F7FDC99E57CF09657486972F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978102, "uuid": "39f44056-e12c-4f4c-9bb0-9cbdef6f0713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978102, "uuid": "0483a12d-d3fc-4b78-957a-d948ce610918", "value": "12288:3x7255r5zzHsaGaHuImN4xs7VLoiBRRNuVZxAXOl:ADFbHuh4SVLTNguO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978102, "uuid": "f454b5c4-eb85-4910-8a98-e4634c01d983", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978102, "uuid": "2ec82b45-1885-4e1c-b978-c5abe9637c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978102, "uuid": "3afd4fc8-4247-4418-82af-449c253a4d69", "value": "COMMERCIAL BANK ENERGOTRANSBANK_USD112008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07305d62-5e95-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695970465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970465, "uuid": "30e2cceb-6afc-4583-aafd-d94fccbfd3cc", "comment": "Malware payload (Formbook)", "value": "33e6e514a8a39873caa1961a2db5bc45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970465, "uuid": "c18da283-ca59-4530-8c4e-21c485403fc9", "comment": "Malware payload (Formbook)", "value": "f783b15fc1e213a63dc1272a4f46d630ae0542d3a7cff83ae1df1b9efac6fc4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970465, "uuid": "a588e0dc-802e-47aa-a702-53a6ea05e48d", "comment": "Malware payload (Formbook)", "value": "130e5ce8668129f7927f27c68f533cc326cd73b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695970465, "uuid": "6077e49a-5791-40c7-b834-e542916d369f", "comment": "Malware payload (Formbook)", "value": "5d9642908a27f3c17cc866c1a83db8a73e494da6c30a0d9d781ea80224ab5ed40ee0cd2c61d473fbc420fe6895724124", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970465, "uuid": "d7d071d5-bd22-4d89-b60a-58c63f97a150", "value": "T16005F53C10ED2A89F36596BCF3744EFF57D5796F81ABB8B7AC4CA59306A97C04502220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970465, "uuid": "376ba148-eb9b-4b8e-8498-27e0ade25809", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970465, "uuid": "4030fb35-3333-4e41-881b-390ca21e6120", "value": "12288:9ujA/EP5AypEsNZw2hGdkKFFAo7SBkFEkhPgep4KoGA:9uU/+mypEsNIkAF+BIVD4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695970465, "uuid": "84f2418c-7ed7-4fc9-8917-d3b770cbff90", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695970465, "uuid": "2eccb95e-7ae4-4b78-b279-40b0dbad2a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695970465, "uuid": "e287b2a5-7e9a-4e0b-9af0-0dd991a7c527", "value": "Urgent Bulk order cms quotation request 4179202023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520d83f8-5eb2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1695983046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983046, "uuid": "fab926fc-b352-4df1-99cf-29e96367ad10", "comment": "Malware payload (RedLineStealer)", "value": "8eb5c1c80671e260eeba3ed25998ad1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983046, "uuid": "50b2acc6-bd02-4c99-bd17-0aca7a9d2dcc", "comment": "Malware payload (RedLineStealer)", "value": "f78f9e0ce0ede55d7fc162bf631069d6afd9ff28b425bb6a84be62ce7f8ef9aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983046, "uuid": "9ee43073-afd2-459a-a029-afa946625dd8", "comment": "Malware payload (RedLineStealer)", "value": "21d210818a40f13cf1022a31f8db87b0deaba53b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695983046, "uuid": "7d677d45-966b-42cf-a684-ad325c4495dc", "comment": "Malware payload (RedLineStealer)", "value": "9c509f888513737dde02dc7be7f6554012c74a0938345f4ca41320bc9ab1613440ac0cb943c61071bc97ad15a6e0bc99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983046, "uuid": "afd76c7c-0e5f-45fc-bdf9-94d1afe2dfe0", "value": "T1A284F10B62E9BC70E56786329D3ED6E8B73FB5714E55676B33145E6F08702A2D2A3300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983046, "uuid": "a7881bc8-e947-44a5-be57-814b52cca4b2", "value": "2a568f33595a0107732fea57be00f8ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983046, "uuid": "d385e959-ffc3-4e53-b769-6176cfd3e65c", "value": "6144:fy4ZdBYXFRL6ZJedPu6gyoOZ451lBbn8TZ1RDLeuJgzdApDhTc1o:f/PYXFigM6gyoOZoqTZ19FJg+DFwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695983046, "uuid": "8004d230-16a8-4d1a-b125-3aae45e1a446", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695983046, "uuid": "7249525b-2b93-4ec6-bd6b-951d41fac712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695983046, "uuid": "151a43a6-5a71-453f-961d-46f714666131", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb35bb20-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696015891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015891, "uuid": "4274dd0e-8f96-41c2-89b9-2d05972a49a7", "comment": "Malware payload (Mirai)", "value": "a862320d833ef559f53da537830a0248", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015891, "uuid": "b17c3278-63e9-41cf-bfcc-6b7b36d2621b", "comment": "Malware payload (Mirai)", "value": "f7edf6ab509da57660e46e178b3d4421f4c95ce51c511fe5ccb068ec93c58627", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015891, "uuid": "7b50b833-7943-45ae-936a-58335cf20a3c", "comment": "Malware payload (Mirai)", "value": "0d3cc9641a5329a5b2b381da5939bc5df3170d33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015891, "uuid": "ece1c604-d22b-41f5-a0c2-c5652ea1ca46", "comment": "Malware payload (Mirai)", "value": "dd52a2160b0a8063c5effb0a94034bf53521a96a536149512b69cb9308c7ce31170ef32ee7efee9001b031107fcb7a7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015891, "uuid": "38320a07-e18d-4cad-8c15-65f23617d0d1", "value": "T18814D60AAB620FBBDC6FDE3706E90B4135CCA51722A43B357674D528F50A54B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015891, "uuid": "80e6e8d7-a0bc-4029-ba4a-0cf96cfe1a60", "value": "3072:ZRU2l3xZmJnE2hoYJp+l2rIFMmFjJsXW9Mm:ZRnVmnK6p+JDDsm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015891, "uuid": "232bd522-63ea-4eb7-ad26-578d3d8eac8c", "value": 198860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015891, "uuid": "7d198de7-1f15-4d8e-bb4e-d8b234654f47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015891, "uuid": "25514b41-ef65-47dc-bd8d-5122bb73db14", "value": "a862320d833ef559f53da537830a0248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94997fc8-5e90-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695968555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968555, "uuid": "5df15510-4a2d-4ee8-96bc-f43c8e473453", "comment": "Malware payload", "value": "1066f5ad77cc1f7aadcb6685567b806c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968555, "uuid": "47adaa06-cfe8-417d-9298-240068f33719", "comment": "Malware payload", "value": "f803550bc17b722e7883bc60dfc07a28ee5e540b343f7d2729bd69c487a9229d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968555, "uuid": "2daf21a3-3b01-4ec5-b4c2-92c49da4f6b5", "comment": "Malware payload", "value": "55a6bf954a4050806558d18e70c38e737ca5ac79", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695968555, "uuid": "43ff6444-2c1a-41bd-9b96-cf3498670f8e", "comment": "Malware payload", "value": "3564d228df7f48bd049926a7cdcbb0cd5512ef3a67cf637ff96e90eda614930429f91347969de1f95d69cfb2a7a73634", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "webdav", "colour": "#CFABAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968555, "uuid": "ad7d7e91-dbe4-4fa8-aedd-bdf0670c9995", "value": "T15641BE1117F61314D3F74B3DA8B6F3129232BD65EE529FDE024096885C64528E8B1F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968555, "uuid": "322b5f13-1483-4ddf-8c1d-5f4dd874aac1", "value": "24:8XwMmP4aaDvTwCKGIWNOAJBWkp+/CWP2+/Ci0w+Q/ISDSjy4I0WQLULqpK6+/CIW:8zmga0VNBJN+p+QoIiAqBcaTcaQ3zq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695968555, "uuid": "bb374b99-3835-4feb-a22d-5376d165e46d", "value": 2185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695968555, "uuid": "59d1996c-2614-41db-bb36-94f3133e79e9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695968555, "uuid": "dbdac539-a424-4221-a643-5a4d4971bec3", "value": "PAYMENT.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8eb5cbe-5f00-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696016720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696016720, "uuid": "780a795f-937b-4078-8c2e-9431614fa9fe", "comment": "Malware payload (Amadey)", "value": "aa305d193e030df354f932232c37492f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696016720, "uuid": "38cf2eba-7e75-45a7-b18c-e0c80bee911c", "comment": "Malware payload (Amadey)", "value": "f8ac9d00a184e45b3c8600507eb21194712ea65d0e8e72657963c870f039d21b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696016720, "uuid": "ad9c3ed3-9d94-44e5-b3fe-888ea392cc9d", "comment": "Malware payload (Amadey)", "value": "26f350fa286c442695483e888ae4ad2f91575073", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696016720, "uuid": "a4299cee-fd7e-45de-87dd-48b77ac42788", "comment": "Malware payload (Amadey)", "value": "21188901ed7e0dce14f157d2a5186305d30e6fbef50e063a2d73017cae2cc3b6b58d672da570268f270fe655741148dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696016720, "uuid": "07096a2f-d735-44db-8bae-ed26af3a3e72", "value": "T13844BF01B4D1C473D872113209E4EB765A3EB8200B5D5ADFE7E40E7E9F607E19732A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696016720, "uuid": "1816f3fc-3f22-413c-bcbd-6e42e69246a4", "value": "e6417806f636d3a26a1e8916d3e05d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696016720, "uuid": "febccb68-1499-407b-9b74-7c5b661865a1", "value": "6144:YYUctlMQMY6Vo++E0R6gFAO2igELvwog35:YYrtiQMYlXoixvwT35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696016720, "uuid": "07fb5d9a-0ec2-425d-8a1a-850a1fad20cb", "value": 276344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696016720, "uuid": "f76ecfda-5c1b-4d15-8093-f823b6175d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696016720, "uuid": "1ae41a4f-2d65-4c28-813d-0f96f580bc6e", "value": "aa305d193e030df354f932232c37492f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06b4280-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987043, "uuid": "80114ef7-e250-40d7-8d3d-4772916e4cfd", "comment": "Malware payload (Mirai)", "value": "16d62bbb98fba391ab2faada4afdb5fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987043, "uuid": "6295a4e3-7e3e-421c-84c3-c348c4d10b30", "comment": "Malware payload (Mirai)", "value": "f985c3877a162c0c6da4f267c0e9e215c41de1096c84da58010947fce1f4a3ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987043, "uuid": "8319d2d5-f056-42ce-be69-60910c1d35be", "comment": "Malware payload (Mirai)", "value": "ab72607afc92c699acc2270bc4d81fb9eb7fdc9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987043, "uuid": "95bccef9-0f7e-4b9a-9b3f-486ba4e0eefd", "comment": "Malware payload (Mirai)", "value": "0bbaf0f7e4530116d2e4307736cf3798739657aa7e8f1f0259d52258006e39e634d8c8fe6798e02a8bc55ef8929131e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987043, "uuid": "a87ea1fc-306b-425a-b935-eb07d0574a88", "value": "T195E2F197D3B2A451CE7827F2F96D85CB2ABD4BACC57630A31A0556182E9F0535F3C483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987043, "uuid": "d4fd848b-5042-404b-8e75-6cedbcc15fb2", "value": "768:uoiWiO031vpAPbrVWZK3XVGxm9XzSn9q3UEL5IF:uorm1vpALgUJZLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987043, "uuid": "fdd56648-a7a5-4302-aedc-89854dc0a7b3", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987043, "uuid": "6293ae71-cd63-41f2-b1c0-1c707e79b599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987043, "uuid": "b1190dbc-52d0-40b7-83d5-a3753941af71", "value": "16d62bbb98fba391ab2faada4afdb5fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190b5e87-5ee5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696004855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004855, "uuid": "8f96e24d-199f-4ab0-8086-90c9ac90474c", "comment": "Malware payload", "value": "302b7c8826a8618dbdcb21808a27bcbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004855, "uuid": "0898ad0e-ba99-4967-b9b5-7a11789aeee0", "comment": "Malware payload", "value": "f9a77f4ba5cb72e15dfafd79512f3381ec8263fce13db3282757b8268a1f07a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004855, "uuid": "3b6fe6fc-dafa-4c0a-b740-21bc8560309a", "comment": "Malware payload", "value": "7cf4f2c267723e914c4995082e2b26217f727483", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696004855, "uuid": "4db5e900-70a1-4fff-a3f6-dcb33c047b77", "comment": "Malware payload", "value": "b279f97de0ab490dd6b8327943623b6fbe13538857533b53e7518dec5210aa82c2cfe690893a9c98ef9b3251d87b2844", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004855, "uuid": "e76a7bed-eac1-4037-af9e-cdc6e2760daf", "value": "T1DE53B71A2E658FECFBAD823947B78E259348339536D1C285E15CEA011F7034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004855, "uuid": "4ec0bb66-7c9e-4dcc-bd7a-d3a820a040e2", "value": "768:WUN/0NcbOLJTPzms4AkD0NBzSVyKUUBqBNazDmzejsC1qFiY9YqY9YEY3YhYHcWF:W3ECzYD03zSQ7GMGWHDDIeXvfYQSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696004855, "uuid": "60094183-db3d-4038-ae5c-0f880cf1d53d", "value": 63672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696004855, "uuid": "6d9d98bc-7881-4fb0-af4d-7d53ed2c2f23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696004855, "uuid": "c0d8880b-1d71-44dc-9fcb-2738b4a31c02", "value": "302b7c8826a8618dbdcb21808a27bcbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a63f184-5ebb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987006, "uuid": "220bd313-916a-430e-aea8-ca32865236d5", "comment": "Malware payload (Mirai)", "value": "af361b16e28c674454789f38be3eb6cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987006, "uuid": "5c5acbd7-e8a6-465b-9d3c-94e1e1c69edf", "comment": "Malware payload (Mirai)", "value": "f9afaf2dd3e0a390c7e72ef7954b8d05f00d240c3add526146ccb400f04c2130", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987006, "uuid": "cff9a6d7-0bb4-4e62-8695-8f719f7ff99a", "comment": "Malware payload (Mirai)", "value": "7364800c7ced5eefb87ff6faf40638ef95502f0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987006, "uuid": "0591545f-9ea8-4720-a66c-8d5f67e43537", "comment": "Malware payload (Mirai)", "value": "c2b9030492b94144689c3409aa009acb1a0b0914781aba63ca561452affb8189a556906129392497066ee1628fead97e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987006, "uuid": "13585d12-0b96-4c91-8bed-3642e0620d8f", "value": "T1B2F32AC7F800DDBAF84AE33744530905B130B7E215925A37729B397BED3A1993867E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987006, "uuid": "25237aa9-9b87-4b3c-9bcf-12ff68bb6b04", "value": "3072:V5n9IdYxIItkvyLer1L383GSRaG5HYVrjbisLVQQOnyskNroaGD:jnqvh382St5H4LVQJysqsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987006, "uuid": "edf6faeb-128a-420f-8189-ae890d5960bc", "value": 158112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987006, "uuid": "885146cd-8d47-4d18-ba14-d33cc5c52bcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987006, "uuid": "08ac0b72-407a-4862-8b23-26a91f01e384", "value": "af361b16e28c674454789f38be3eb6cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b20693-5e72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695955805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695955805, "uuid": "f926f594-fc1d-4691-8c99-cc052f5f78c3", "comment": "Malware payload (Mirai)", "value": "42c9da6fe19efa4b3cb45a76f3aaeaec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695955805, "uuid": "03493864-1476-49a7-b3ab-7d52645aacde", "comment": "Malware payload (Mirai)", "value": "fa6a904e1dba8718ab6a14f2a70724845660a81cdf4621ddf04f8c5adf50e9c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695955805, "uuid": "bbaef568-e270-4f65-a5d4-24c72d249b32", "comment": "Malware payload (Mirai)", "value": "7e90a5fb702fdadb7470c308ea4fafccc65043cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695955805, "uuid": "5c19ed23-a6f3-4b74-87a6-e55543261a72", "comment": "Malware payload (Mirai)", "value": "8e1032ea586af69a991dde23bd02de3144af4c5eb6e1d90cd5d606283a4045352d570e675a3c7dbb5eb4870f3c8661b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695955805, "uuid": "e00f9191-f998-445e-b414-70c17f8900a3", "value": "T1D3230271880E9DB124703C76EA95939376E129B1C6673113DA280A3C6F75B131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695955805, "uuid": "75a63fc7-9b04-4315-8536-aece8be30f7d", "value": "768:S/TYCoIxdEk+AxoTZAZHFeq8b3ZM+9q3UELbUXfi6nVMQHI4vcGpvR:SECFd+A6YHAxZMjLRQZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695955805, "uuid": "7b70e398-1374-444c-9c02-de7943ad92da", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695955805, "uuid": "7f674ac7-9002-4c44-9d09-158a5b111868", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695955805, "uuid": "528afbf6-0b25-4cd8-b34c-40f035a25fba", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae048366-5eaf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695981912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981912, "uuid": "ac84747b-94fd-43d6-a918-dfbe4c1257ea", "comment": "Malware payload", "value": "c803fe369b32ab4ec926afafe24eead1", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981912, "uuid": "ce312455-ec3a-4035-9673-6255d836c7fa", "comment": "Malware payload", "value": "fab9c469a3491a742379fb087779bc31bdca73702feaf5b43bffa174b94a4317", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981912, "uuid": "cc6d0ebc-fbe7-4754-aaae-98668980aac6", "comment": "Malware payload", "value": "0793c295e4e9d3042f9fc19688a55e1a6ddfe621", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695981912, "uuid": "d624cd1e-0c8c-4707-b087-f65660fdd250", "comment": "Malware payload", "value": "0ea0c0ab445a2841df1d3deba4a524ef39ec61fd9312549ad6ef65d5b7fa99b4b88e0364df24cb96b8cdd0c7c090d6d0", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981912, "uuid": "33776371-6df7-4477-b33c-29186e3608f4", "value": "T1B784122DB052C52FCC67A034CCC5B4C7E724EC896F44A78773C9776E56367A282B2998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981912, "uuid": "87812eb5-d602-4fc8-9df7-afcc6dced18e", "value": "6144:Pn1m9kdbwRJqfLWnNnBkbE9UXlD3vrCuwCpxoxT1UARmgZ+M3TCt:POe251BkrlD3jC7nJJRtZSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695981912, "uuid": "7d9ff307-93bf-4bd9-831d-14b9761f6c9d", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695981912, "uuid": "edb4c9e7-1394-4377-bcb5-1f1c0bd2fad8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695981912, "uuid": "765854d9-ae04-4c48-b40b-33964616a825", "value": "specifikacije 28.09.2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6eabb73-5f0f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696023239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023239, "uuid": "521d88be-752b-4d2c-8c6e-268a25a8371c", "comment": "Malware payload", "value": "0f5b7ce066feb2c7c2b9903b3dc2cc9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023239, "uuid": "ad18dd02-13e9-4f21-a972-e505aca0e1ae", "comment": "Malware payload", "value": "fae5dad09fd3075a8f07ebd380620b27d3ea343e0a522c6aa4756c008779877d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023239, "uuid": "736952da-8802-44c9-bc15-123cc72c7ef3", "comment": "Malware payload", "value": "dbdd268498c54bdc6c76a6dd56399770060dc91c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696023239, "uuid": "51f6959d-9070-47ca-b1db-21906291414d", "comment": "Malware payload", "value": "838fb28fa8b17431a6cf6e301ac0ed64253fbe11c14b56d97b64ea7bc0c39d9b3a55f811bb0929ee40ae2d405ef37f93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023239, "uuid": "dbf628ce-e7d6-4ff4-9649-90169a18ce93", "value": "T16BF4239EAA049DF08AC58C6BC2F358858111922A313A8F574639BDEC570F8F15BDDDCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023239, "uuid": "cb40ab1d-e394-4f96-95fc-55e05af59f5f", "value": "12288:zdY35xWxrqrOLtPxBxRmXiWvFvlVg3sU3wn0oMx9bcEscUh/8jlK0M1iO7kzAesI:zupxatZsXxFvTgciwn07FsfhylizwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696023239, "uuid": "77cce86b-4968-4b6a-a893-80d706321327", "value": 733232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696023239, "uuid": "750fd9d0-c90e-42a3-85a1-1e33e8b1cc93", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696023239, "uuid": "635ba8f8-7927-47e5-8603-033034753d05", "value": "@00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e75a4eb-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024245, "uuid": "31ecc985-605d-4904-830f-0149c8c507ef", "comment": "Malware payload", "value": "0b5237f0a458c4a7929f71501a1a4edc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024245, "uuid": "9adb6ee1-4fd0-430b-b411-cee5268cfd91", "comment": "Malware payload", "value": "fafaa143f7070c475d4b0cfe95e5960f160e5c86aa07f1cbf3e80c94e76171fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024245, "uuid": "ea7178e3-62de-4d96-a976-e92e6ddcaf89", "comment": "Malware payload", "value": "f10ef46d85e713c8ed871174d4398838806f98d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024245, "uuid": "3eaecdc3-f780-4ad1-af06-cdc981a3864c", "comment": "Malware payload", "value": "e2a154150aaf8ac140e89e4134d85593eb55e51103d67f1b3316dd7e552fbf84c533abd137679d799108725b30e5fc6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024245, "uuid": "0261f776-51d1-497a-ab58-85cef7a2c8f6", "value": "T155342342D95FD3558B8294FE57FA25E8C3C2A702BF2AB1B8F91778D48D04B4DA51C2E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024245, "uuid": "d9f2ccd7-2d9c-47d0-958f-943b86785908", "value": "6144:M/bvhrozigFxQzRC25ZFzk6kyE3Gm/T5u+sRob:Mp1cN25vk6a3d5/sQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024245, "uuid": "6fef6dd7-9b7b-4d59-8fbe-c1692b507011", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024245, "uuid": "30efbee2-3468-458c-9a26-c5f46527fe8c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024245, "uuid": "a97faf2f-1026-4c2f-a10c-5268618274e9", "value": "288313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269c016e-5eb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1695982115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982115, "uuid": "12665c93-5572-469c-a78b-7d5a5316f8e4", "comment": "Malware payload (AgentTesla)", "value": "a2de3305800c73761531a3d737468720", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982115, "uuid": "a15777d7-c89f-49fb-882e-91bfb753831b", "comment": "Malware payload (AgentTesla)", "value": "fb728e7adbe50408709fe1ece61de636040b4b840b23b33971f80f5858bae991", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982115, "uuid": "43047f16-ce65-4aa1-bcb2-4c6629b7e8ea", "comment": "Malware payload (AgentTesla)", "value": "334754947854ea4c6bbd888c5061fd0b0dcffd00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695982115, "uuid": "5aa2beaf-a98d-4b6d-b549-939eb5ff4542", "comment": "Malware payload (AgentTesla)", "value": "1a07af8913fce8c8cdcef440e9e8968851f16e2164ac87a39b4b1020f4a13346ecedb9d7fe745bcb7c3fb9d6daea6976", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982115, "uuid": "44226dfb-9f52-4425-8a98-70d64b87a0b3", "value": "T117840226B154C62BDC068470DCEAF5CFE634ECAAEF04A34F31C6775F43326A24169699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982115, "uuid": "ed246200-814d-4505-8fb7-f09fa0443173", "value": "6144:Sn1m9kdbZPpeZJmU+ZKy4ij4a3DjKcUXQbySY6iRXl4kaOaz5IHt2IC:SOe5kqKjij4a3DjMQeSPi9naUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695982115, "uuid": "0806b0ef-dba1-4972-a230-3b470978d2c7", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695982115, "uuid": "8cf1c5d9-6336-4e60-a748-e29b45aef8d1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695982115, "uuid": "80546647-d4f1-446a-afa6-371ab9779367", "value": "comprobante swift.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00408752-5ec5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695991070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991070, "uuid": "b76f6873-9423-43ff-be2a-669937e24443", "comment": "Malware payload (Mirai)", "value": "1e39a0ec27a2af1004231bc06d2e7861", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991070, "uuid": "84b12cfd-1fdf-4cae-85c8-eef1b237a91a", "comment": "Malware payload (Mirai)", "value": "fbde2ab47f62dc14b4c0e989de799f38d920c8367cbd0e57b276ebd613838bd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991070, "uuid": "aeea4927-186f-4a95-be46-2dfd5d4f36de", "comment": "Malware payload (Mirai)", "value": "a553ded1c574cf713f05be1ea042686ac6e1ed0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695991070, "uuid": "19ee0e80-4ff8-4f04-967e-c110e12e37c6", "comment": "Malware payload (Mirai)", "value": "162bdea367ab119f255a3e42a3fdfeb0abb22a8eeafcceacc646a62a2e6a79b11f331c1cbbd84b5dc4df4b1a90393287", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991070, "uuid": "d15133c2-486e-4523-a47e-1b22d54e41e0", "value": "T16E138D73C86EADD8C20986B8A874DF7C1B53E10496631FF94A4586929043FECF6493F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991070, "uuid": "2c732004-ab7d-4e61-88de-6b631e8b5d3c", "value": "768:+azh/wt9xWFz31pe18msaVr53zHiFy9Mw/qbC/WgoVAUYICzi:+al/wt9kJDsZ53zH397/qb0WPDtCzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695991070, "uuid": "d61a522b-316a-44c4-8d75-3ff8ddc5997c", "value": 42420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695991070, "uuid": "5066b34a-1802-4c73-844c-b14d5a44df88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695991070, "uuid": "64a6bc93-5060-4ef0-ac4d-0cb7a12288da", "value": "1e39a0ec27a2af1004231bc06d2e7861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8946aa6f-5f12-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696024371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024371, "uuid": "f1c1a08e-d799-4cb2-81da-d74e999d5e42", "comment": "Malware payload", "value": "44150adab455b76bd354ee19127b7797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024371, "uuid": "a7c932d2-470f-4e10-a4fd-0dc7c3c77901", "comment": "Malware payload", "value": "fc15a942e2337980731d1ed1331f652664cc37d3bd2080aaa00a5e9a41ec4a26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024371, "uuid": "53ca984b-4f23-4c60-8869-3a9ac90d76e7", "comment": "Malware payload", "value": "df4959ae0590d7f803af05d193b33dd0027a69bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696024371, "uuid": "2b6b61a9-ea41-4704-8d6e-d4e6c5647254", "comment": "Malware payload", "value": "da322c5cf1b79db1188469227847d93aff8bd74840d185ceda22d2cde23c0645b99256c812080553d63bb56f654dd6bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "win32", "colour": "#901D57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024371, "uuid": "c9e3fc54-2a32-4ae7-a0f6-fe22d383c83b", "value": "T1003423FC8B63855DEC36428539E3CEFA7D014A976B9ACCEECC444682DD3E41D4C2912A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024371, "uuid": "0986cffd-2a88-4c78-98cb-5fb322f72507", "value": "3072:8DUMS+pKA5ASohhY2ty/16XI0rTMm1AZUJ0ie8LIg1pA6A9/DhfrtR4uC2/au+PU:dWEAuzH81aI4TMe68j1q6ATLyZL9HLGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696024371, "uuid": "61d5f687-4845-4b2f-bdd3-9a363985a361", "value": 251936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696024371, "uuid": "eaa6f5e2-6f22-4ef2-886b-f544a3f49542", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696024371, "uuid": "e64fbcc2-44b6-47ed-9512-5444d5898106", "value": "288329.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1048a651-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1695977353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977353, "uuid": "9b1e4209-6e54-451b-b3aa-1672664b0999", "comment": "Malware payload (SnakeKeylogger)", "value": "2ba38d110d7f63bef0ec0dc14bd71f9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977353, "uuid": "fd36e576-3be5-4464-b694-b2e065507362", "comment": "Malware payload (SnakeKeylogger)", "value": "fc4b30802da59aafff89ecc9cac8981c35109b22cbdff3049bc1df46ca1543d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977353, "uuid": "26fd3a8c-4a3b-4ca6-ba59-e8772ba74c52", "comment": "Malware payload (SnakeKeylogger)", "value": "32b24d9e7227516f58ee1928872af6f6a3dd98b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977353, "uuid": "c8f892d6-09de-4fdf-a904-08538115d082", "comment": "Malware payload (SnakeKeylogger)", "value": "bf39e43338789e9b37f943c725e2e0ce308f77bf6872d1c83d3639de104f585989b83d2366738e8f7c45b22d2bc4933f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977353, "uuid": "b18fdce5-2886-49be-8c58-ca1968afff0e", "value": "T1ECE4F1A1F2A888AAE45942B5882DD8100E73685F60B1C66E35CF767D5FF33831553F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977353, "uuid": "6f91a513-55bc-4661-8400-d29d0b9365b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977353, "uuid": "a977936e-256e-4b90-998e-666049cacf5f", "value": "12288:J80WWObWINS+bX4QJNmzgSi7e/HxqQSRsrY0yTT2Vqsy3kxi4bTlmS:V4bNSaIoNOgSiqoQSRsrvyTaG3YTlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977353, "uuid": "721f8cda-9c6d-4309-8d3b-0e855fb003b4", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977353, "uuid": "db323ea9-595e-4bc8-8fae-8429de04c5c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977353, "uuid": "4ae7a52c-696d-470f-8213-d4347d19ac63", "value": "Qz8jD8IBXlSH0Gp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0f0b95-5efe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696015836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015836, "uuid": "8c6398eb-4d46-472b-b886-652b5d3a98b4", "comment": "Malware payload", "value": "ec22b0f93bf2e35f9c2ed338d59fed68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015836, "uuid": "7bf0f392-ed2f-4895-8890-e551e1237aa5", "comment": "Malware payload", "value": "fc73b102e40787082518533d6c871d300ce4c4bcb83700e0c21b5e4fc6098203", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015836, "uuid": "d364814c-d7db-4da8-ac0e-015c39a816a8", "comment": "Malware payload", "value": "a381b0fa8727c7fc723638546b7378850beeb8d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696015836, "uuid": "98b83961-f733-4d1c-8f15-8093cad6b3a9", "comment": "Malware payload", "value": "91b15414babf2cc8f326ad5f2f4e4be1e00cbb61e3d46f55aac22e5ccd78cecfc6605d10ee7c79462c505497b2fdb6b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015836, "uuid": "8b1d8045-6e5e-4fe0-8a68-e833fc8cf923", "value": "T167B533203FE2E1FFC5522136868877B082F6E3595F1F0EDB9384DA5C4F68A92D51B690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015836, "uuid": "b385a758-2351-44fd-ae0c-2f3eb9e442a6", "value": "4ba3ea0d6362a841ec66a1fc0a1b874f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015836, "uuid": "19b9e8b2-3b30-4a26-a4a8-6e95011ab26c", "value": "49152:ufuyo2d519Lb2sLqcFVbnQtcYAue8AK+qs/62N9JkmN:h3m19Lb2oe29JF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696015836, "uuid": "6ba43786-a4a8-4f16-b702-edec1267f6b1", "value": 2284967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696015836, "uuid": "3318a2ee-28f8-422c-ad2a-834e9b75e5bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696015836, "uuid": "7ff832b5-406c-4feb-8c81-65db3b2e3d98", "value": "ec22b0f93bf2e35f9c2ed338d59fed68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650b4fb2-5ea5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695977495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977495, "uuid": "c9811903-659e-408e-8193-8648561a6964", "comment": "Malware payload", "value": "561a18bdb7aa236f5a934345aef3ba18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977495, "uuid": "8f510435-0d4c-4f95-882e-1659bee8bfce", "comment": "Malware payload", "value": "fc868bdbb54c49f3a33399c4512d2a5339befcf734606c3e446b00f1ed4aa900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977495, "uuid": "f3313930-a7a1-436d-bd35-e5259703c3ed", "comment": "Malware payload", "value": "2871a9253566d0ee72f1161cff425355d2a5e842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695977495, "uuid": "277f6303-6d92-452f-a97b-1730d4076e2d", "comment": "Malware payload", "value": "7e9fdcfff4bfcbf894d45f9318a5aa42f52ae0d387c24c924fef6ac6479e0722e40188870732b2a7d5facd98d74a85b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977495, "uuid": "3197c0ed-b6b5-4aec-acb0-1ed1e99df9ad", "value": "T16A659307BAC789B9C148D737C5DB0C3403A4D7A17223D60A798F236A19633BA5B49F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977495, "uuid": "b9c6587b-6dfb-49df-be53-0e721fa704eb", "value": "24576:A0SXh+At5byhDBR4JFp0YxINGC2ovcgHpz/9QpzdYWw:VAuBJ9mgHB/9QXYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695977495, "uuid": "4d00d450-99c6-4ec8-9e50-dea86dc83250", "value": 1543680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695977495, "uuid": "bdae091d-ccd6-4f47-8118-5b7f9e7756a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695977495, "uuid": "1dbac165-ec70-4400-8c5b-6cd8bac6a09c", "value": "Lrbmzccd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28880154-5ea7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1695978252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978252, "uuid": "33bd0b33-e550-4537-b645-c0fb537713a3", "comment": "Malware payload (Formbook)", "value": "a18c188545d8021b47ad42bfd5d1226f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978252, "uuid": "70a58f54-874a-486b-86ca-da881f446f6d", "comment": "Malware payload (Formbook)", "value": "fcef6adff66649f4af2268cdd80349d44ae31c9bf87d2ba341253ec607789d06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978252, "uuid": "53931165-8826-4bae-ab74-17d1d76cd9f9", "comment": "Malware payload (Formbook)", "value": "578e1ffb8e7f6eee008ab2c3f7317b3b1e5c5d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695978252, "uuid": "e3743104-5e48-46dd-b612-fece5846ee3e", "comment": "Malware payload (Formbook)", "value": "736e14a88e065a811f5353a6498ce9ea995b798f4b807165227f95471c3149aa10dd328379924b3e4baf2b35619a5db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978252, "uuid": "72bb8105-bd56-4596-ab55-3ce6af567628", "value": "T125C4129CBBD48726C18C6BB20ACC529643207629D811E72CCAC769D71D7A7F92633F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978252, "uuid": "b68025b6-dbe0-4eac-9121-6184118ae0ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978252, "uuid": "a4c90637-3da0-4947-83db-a3a4c491d512", "value": "12288:yJ725cin5jmmkXpMw1mCkQBizlotp6QJgFysjPo8oub:fL5jm3pMDQUSngFFw8oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695978252, "uuid": "f950c862-a5c1-4800-83e9-4a590d6243f9", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695978252, "uuid": "da99d1d8-a037-4cdf-8638-64ce394764b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695978252, "uuid": "8a0322fa-80c5-4f4c-8936-f75fd7d796da", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadea877-5ec4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695990980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990980, "uuid": "d308d2d1-8a5e-4ffb-9c72-9e323c8cc268", "comment": "Malware payload (Mirai)", "value": "45633d7f083292219560f55b332cd8e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990980, "uuid": "856fa2fb-8eaf-4130-a45d-05e683ed868a", "comment": "Malware payload (Mirai)", "value": "fd457a17ba00f68c913c95342eb06399a1b0784848bfe61839bbe4b8017359d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990980, "uuid": "70cdd04a-2cfd-4aa0-b8ce-61e546ee6bf5", "comment": "Malware payload (Mirai)", "value": "b656c59168fa018b14edbc8632ecd3628e22d40b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695990980, "uuid": "c319d1a2-ead3-4e16-b24d-211744101c47", "comment": "Malware payload (Mirai)", "value": "b677b8a30b11bcbdb144bf535cdf9ad7985730f581b3928d42d254e66cae00a25d534380d5d8c222d60963fb6e162e14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990980, "uuid": "f4fe8fe7-87cf-4b37-9ed2-6f8a58b46ece", "value": "T1ED23F21320E7ED13D420847FD8159DA97D044AF9B9AD7B7729051690C820F12FEF2ABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990980, "uuid": "0621ffda-8aa5-4fbb-9195-c0da058c45a5", "value": "768:SK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFd9q3UELv1Q06pMBwAA3i5W:M12O1LCNguovDPH7TcryLtQ/pSAy5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695990980, "uuid": "4028c088-5fc9-4bd0-9e2a-ee08b3489c2b", "value": 48716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695990980, "uuid": "e119c1b9-d9a6-4c78-9ddf-a9cc6b51402e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695990980, "uuid": "6b9f8b31-7f3c-4217-8893-b34c993664e3", "value": "45633d7f083292219560f55b332cd8e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551541ae-5e96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1695971026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971026, "uuid": "e214425b-6ba0-4111-be4d-e417a0b4817a", "comment": "Malware payload (AveMariaRAT)", "value": "5c89bc42ee54df2b5a0e40f4e28ca03b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971026, "uuid": "50f31339-116d-4a87-b0dc-8cd3719072f8", "comment": "Malware payload (AveMariaRAT)", "value": "fdb06318c6aeff1ecb89b2b6f07ff18b88c8af5647101be0af938f1c00369d3d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971026, "uuid": "545953c4-a5e1-4fa8-ad81-0aedfac3180f", "comment": "Malware payload (AveMariaRAT)", "value": "f26bd8415929af792ccbbd27c82a49afd732bc58", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695971026, "uuid": "9c8925ba-836c-43b6-a15a-183835d65a1e", "comment": "Malware payload (AveMariaRAT)", "value": "33d4f4cfc6c67a33a4858877d8de640914353fbf40807105c5ee5ec3dcaf8541c54267be5c13e1f4b142a7ffd2af0a7f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971026, "uuid": "04eefa64-36f2-4465-b86a-413c71b68cbf", "value": "T1A6D423BE1E2856BCA34CA53EEBB56671072C7DF9A200210F33F7C87C861EBC44662556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971026, "uuid": "973a2d2f-d68d-4b95-acd3-fed264c4f055", "value": "12288:P/QL+0bJiSxY+p+5Oe7KCYOEFgxR8RfmZY818QtiQBIgMJxL:XcICw5vmNO0k8YZQkIgoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695971026, "uuid": "4b9f8941-2f4f-4c05-998c-15b93e5ad1bc", "value": 613377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695971026, "uuid": "b4e5cabe-f4bd-475f-a12c-6c0f8dceed4b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695971026, "uuid": "94e270a5-1e4c-48fd-80ac-e0ce05b63e72", "value": "Bank Payment Copy for Invoice No. 202308460.doc.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9827ea-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987386, "uuid": "7b504ea2-bf5c-475f-8314-70fefd8f7c9d", "comment": "Malware payload (Mirai)", "value": "b018bb842d55f11fc9e7e6a181af2e4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987386, "uuid": "5812b0c5-a70f-4cbe-b161-96c867ed16fd", "comment": "Malware payload (Mirai)", "value": "feb61030d67c88f783904d456d94a7e28b079892eedb6ad69fd939066c0af981", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987386, "uuid": "6b62b48e-cc44-4074-a5bd-62e4a8487d8a", "comment": "Malware payload (Mirai)", "value": "84f3616151c94a52ab1e2abcf5c2a7a410fde2c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987386, "uuid": "f43e3357-b6d2-4eec-b038-e33bbf3c623b", "comment": "Malware payload (Mirai)", "value": "c9602507ccefdd7c1be78fee0282edb4868bdc4e6e0a7252f42571ec2a200db86aed53dd0f0cc877654c984b8fa76c4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987386, "uuid": "a18b664e-c782-42c5-bb3d-b882f3d49179", "value": "T17E333BD6B902AD7CF98BE67E80270E0AB53123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987386, "uuid": "51280e12-8b5c-410f-921c-78ef43d5ee2d", "value": "768:8CeKEfhe5Xdrben4I1fN5KQnaodgFHx+iPuvWeffpqmUJT6r6Lu380DM:dsfIBZeXl5nKFx+imvppqmUJQ6Lc8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987386, "uuid": "c8f3bc90-1f6b-4ee3-bb3a-6297228ffa0e", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987386, "uuid": "8878ba87-1592-470a-9ce8-f822f9174c9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987386, "uuid": "44364aa4-0d52-4b12-9a6c-a2a0f632e286", "value": "b018bb842d55f11fc9e7e6a181af2e4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04becb57-5e81-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1695961871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695961871, "uuid": "7b853d37-404f-4488-8312-54641582d9dc", "comment": "Malware payload", "value": "07df66d095522f92b865368514d6013c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695961871, "uuid": "22921daa-a006-4ced-b16e-09fb41406938", "comment": "Malware payload", "value": "fef939b4a90ee28e2cffe1d8f0dcfc0d5dd174b0321e2a2c6cd46c65b7b79a2d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695961871, "uuid": "fd5b07a8-e3da-4fb7-8153-6ac4dea774b8", "comment": "Malware payload", "value": "d7ec4ec50b0008f8d0a09098c3a59acc6795bec2", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695961871, "uuid": "fe6a2ee8-9e7b-4fbd-bbdf-711f1170a01d", "comment": "Malware payload", "value": "07f8dd86b487c9d3072990f0d90b8c61f66fc083cb1c388f4bfe60f8d6f56a7ced1ca12c381f1e4233759405f993529c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ViperSoftX", "colour": "#B7D3E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695961871, "uuid": "66e71498-45af-4ffb-b775-064b9195a952", "value": "T1DBC0A9498219D2AA0E4F31600862AA58828C2AE220E3A082CC889A80340019C9209A2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695961871, "uuid": "3bad1d36-7afe-40ce-8e0b-d2fdaa5fdc53", "value": "6:qn+1v6MmsARwhHIXqTANBLu4uTvUG/uxsn:3uooXCAX64ujUG/ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695961871, "uuid": "83cb57c0-77e5-40e8-9e82-061bbe01f09f", "value": 193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695961871, "uuid": "b55564d7-950c-4f96-a372-3b98c27c3ccb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695961871, "uuid": "50880158-c029-4c3b-8ca6-e02cab44da83", "value": "D4152EBC-11F2-42C1-B1C4-9E55CEC4C6F9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff5c284-5ebc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1695987472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987472, "uuid": "324b6dc0-9088-49a8-b286-9fa64945852f", "comment": "Malware payload (Mirai)", "value": "bc21ee6d74448dc1f05912c3af7f367a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987472, "uuid": "475cfb92-7224-4773-b6cb-948a5e0bfbd4", "comment": "Malware payload (Mirai)", "value": "ff6114a2c4e1e6d068f8388738dcf857a578b43d7fc0bbcb15906c185d80abb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987472, "uuid": "54994d74-3e9b-443e-8618-83a13b31ef5b", "comment": "Malware payload (Mirai)", "value": "bd27da21edc7638bfe3fd90da8f97f0ee857ff5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1695987472, "uuid": "488070f4-b0db-498a-b236-102ea8da4214", "comment": "Malware payload (Mirai)", "value": "be4f72034f0d8371c92e42624796cb1d108237959edbf849e2b4822472445f7dbef8ff9acd6b876ad1e5d3a22a357a57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987472, "uuid": "a402a248-5c11-436a-a1b7-86cd5c928cb5", "value": "T148D2D0AEE5B482C5FD4D5C3E808C3FA10E1AE181231BDB9667118C4D5B36C5BF16A4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987472, "uuid": "2da6135c-be8c-471b-b726-874552a13e68", "value": "384:Q8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjhxV1RWGVCz0Nvb:FMYHb62x4ahQ3CfdwLjinWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1695987472, "uuid": "650192be-b221-4465-93d7-7c669ae0b6f9", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1695987472, "uuid": "b8856f52-120d-422d-ae7b-ea3f86e45075", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1695987472, "uuid": "1d027138-1640-45e7-9549-7d8c211751c1", "value": "bc21ee6d74448dc1f05912c3af7f367a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }