{ "Event": { "published": true, "date": "2024-02-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-02-23", "timestamp": 1708732981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "12c906e0-369a-4aa0-af90-dc28cdbaf3f7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea9e9b4-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708705673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705673, "uuid": "cc91e4e7-04e5-4853-be33-2e953c07dae7", "comment": "Malware payload", "value": "dabca7d1a7b3549b2e3fc1f3db4a1ddb", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705673, "uuid": "599b71db-685c-4990-a0f6-ddc5212030f6", "comment": "Malware payload", "value": "00e5d9ba05e00d968020bd69dfcf1b6e645c22e1446dc86c49dc573116c337b0", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705673, "uuid": "9301604a-aa4b-4d7d-984c-b7964ae726ba", "comment": "Malware payload", "value": "c1f33b07cfc8a552009c56e2782a7f76222805d3", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705673, "uuid": "eb23c730-ccb3-48f6-a9d1-97e716fa8d53", "comment": "Malware payload", "value": "69b0b24bc1d5cb5d088da324828304c16e933a57d1f04382c4d22ac4200387e76b8345922f4d21be6b8edfb6cbd202b4", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705673, "uuid": "46fa72b3-b79f-45f2-a0a6-e08d9f42f425", "value": "T1F492AE2CF64EB0EECC2ED47F881851FD1A6D7044AB22982DA8867D5C179448F766C1EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705673, "uuid": "28850d86-1d41-43e1-b491-4f9606f171fc", "value": "384:Cv1NdhHhLmBPJ2cCLWyTWyHg6zaG9xgoL5d5eUhrkgRsEagFzh:CvzBLmBPQnF9TbX5e1gRsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705673, "uuid": "c912bd88-4c24-4bbb-8a0b-0bfc494d181e", "value": 19552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705673, "uuid": "49c351c6-b6ad-4c22-a0a7-1350d1f9e543", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705673, "uuid": "32ae901b-8d43-4de3-947e-bc3692e25690", "value": "884 NEW2.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2187852e-d25c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708700363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700363, "uuid": "d8c166c7-b5c8-4b89-bc9c-488422b3f255", "comment": "Malware payload", "value": "4dfbb07f824d4f1106cc7fba9cbcfeb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700363, "uuid": "2d77dd39-ab7f-4eb0-870b-934babd7b7fd", "comment": "Malware payload", "value": "03097d72e93fc715793b38011623e2d8d4f98caabb082c6c80a53f27da95a10d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700363, "uuid": "6613b8ba-bd68-41c0-adc6-505a972dde71", "comment": "Malware payload", "value": "f225ce68bc6dbcaed82aff71d96315f692c947d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700363, "uuid": "2be36b44-290d-4f0c-8e25-11f59d54b38c", "comment": "Malware payload", "value": "8b14dfc2385ee940f8806ff5e59049153f10fde1b1d8858b1b99d7735888cc9a8aefdcb59e4f6f1190fdb8fd9031d56f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700363, "uuid": "2bbe3e24-c7cb-4a04-8514-d58ead83fc51", "value": "T1DD06336AB79218FDEC47D078E9541314AB73F81B8710DAEF4B98A2611E53ED09D31BC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700363, "uuid": "3a1c3f3a-6622-43d1-a845-0ba79ad53d51", "value": "22fb7e12ef0e3575df1d5b6564aa32c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700363, "uuid": "95a34159-4fc8-4188-a8c0-060c1c1e9edd", "value": "98304:VM2pUm28sdOfjrAcZKiO6E52oevIj09uvmb+Ef:VM2psRdOFZ5rghvmb+Ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708700363, "uuid": "c66dbb27-f114-43b8-bef4-a206b3bd3c2e", "value": 3966464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708700363, "uuid": "aa0f41ea-9274-4ab8-9dbc-ad29c7e5961d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700363, "uuid": "e1fed9b0-78a5-4de8-bb6e-0685da959b02", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ea72f8-d247-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708691537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691537, "uuid": "7062c9cd-91da-4610-9b45-7561b6ad2583", "comment": "Malware payload", "value": "7f882d0e4d71abf50592996f9cbb93a4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691537, "uuid": "4e273f2d-92c1-45c5-9057-1ee30d7a380a", "comment": "Malware payload", "value": "0385980c6cc2522b27f75a5a64264d64f0a1459c11b5e6220fd0ab89122d6469", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691537, "uuid": "b7f749c3-9b80-4155-b28d-9cf89b61ad9b", "comment": "Malware payload", "value": "735830b9fe20a183d4a764d5fb795d5ab40564cf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691537, "uuid": "570a15c9-74a3-40f4-bf5f-b138517090e6", "comment": "Malware payload", "value": "85e78570bbb305c9f3580cc33dd614d5211c0e595cf98689a9b567bcb4fbdfd29f1162638408efe7633ab3d358a38e31", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691537, "uuid": "4023a151-28d3-474b-b8b9-65b886d590e4", "value": "T16B51EBA9C12D0014C0D37472A4869C75EF073487F62EC857247B87E85C9E0AC4B1B879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691537, "uuid": "f6819e6c-b6a9-4e3b-ba83-4f774d9a2827", "value": "48:9C5tFNeKSjaLVOWSH+Vqi+iDD1I1lncmdrSi:YffIa2H+Ei+O1I1Oqei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708691537, "uuid": "95768d0a-a046-47a6-a3be-164e7ba6d266", "value": 2932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708691537, "uuid": "e129d509-81c5-40bd-816b-556d376ccffd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691537, "uuid": "f31d19c1-3ef8-460f-8f38-235d8c5d1ba1", "value": "Docs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95440c59-d27f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708715590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708715590, "uuid": "ce9501c1-42f3-44d1-ab25-f0308b499cd3", "comment": "Malware payload", "value": "571a0c88df4b124cb02a0107fc02896c", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708715590, "uuid": "02f4e858-d639-4e96-9790-657f6d38359b", "comment": "Malware payload", "value": "03a23b591496c1e4e2541839975c67874ffb1ba515b1ebb13af225d668759989", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708715590, "uuid": "2b7b456a-a3f3-4c67-8b37-a463e6d5a35b", "comment": "Malware payload", "value": "a56b280e5b393ed878d79b27379378cccaedb818", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708715590, "uuid": "3d5461a9-83ed-4c28-950f-34a267a192d5", "comment": "Malware payload", "value": "b97761a639043ccf55f35c59634c69e36681a3d352aad25b88659bba423a4c030750a47c02f606bfdebafb7a0c74514e", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708715590, "uuid": "cffbf7fa-1955-4208-98af-18916384c62a", "value": "T1D392E125C5B281FD44BDD4AD2D91634E287F6C8C0BABC940870376EFC9C2859ED34E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708715590, "uuid": "dd05a12d-b2f0-45d5-b019-4f09be43187e", "value": "384:e3Q7Muu/XZhX5LCaCH7DTig2x7bthKngR+OBMQ3AWMAbQUkPb6DRl65AfR2eNUos:o1JDCaCX8hRsOBMQ3TwUkj6DRliAgozA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708715590, "uuid": "9d39f072-6361-4a44-a83f-50c3555f2926", "value": 19609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708715590, "uuid": "6f2173f7-7e7c-4274-aa8d-722910effa42", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708715590, "uuid": "5de03657-0d84-466c-b5a5-6397ee22ff41", "value": "QUOTATION REQUIRD.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63b81e1-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708705820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705820, "uuid": "9187d5b0-6038-48d3-9c27-1deda2e99627", "comment": "Malware payload (Formbook)", "value": "d457ed39866a520df4abc5159b1eec3c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705820, "uuid": "fed3efd4-784e-4eb3-8504-314b19672833", "comment": "Malware payload (Formbook)", "value": "041cdf9a722e27563575aa7b3a5125e6be1208b1de7d90603b55b014c03de40c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705820, "uuid": "638b762f-1b1d-48ff-9c4e-e82ea65a65af", "comment": "Malware payload (Formbook)", "value": "c7e714a36ebec745ff9ef89ce7b98fc1bc6c155c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705820, "uuid": "c8396f7a-aa05-46bf-87b0-c60901412324", "comment": "Malware payload (Formbook)", "value": "6655f421a41ef4e869d38b00daa7a2c34c9379fa9e5e9e508a8c113aed62bc56923fae18889ac76bb1e4de6fa72abe66", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705820, "uuid": "1a4139fd-7b74-43bd-ad97-0edb5a5ea760", "value": "T13BF4230973B95A63DABECFB6202D1A814373E1836115F9C81CDD35DD65EBF482B29823", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705820, "uuid": "065b4fc6-b4e3-4b1f-b340-87922a8d1065", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705820, "uuid": "dfb5e22f-9d38-4995-9dfb-9cb925104180", "value": "12288:slW3jmzBh358/pCznZFXpQgnJ2DRmek3ouyN6AFMpvsyvdWSWUsiAqVGkR:wB0pCrZF5QgkFqohNngsyYUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705820, "uuid": "5ec69cdf-7bd8-4f4e-8661-7eaa188a21ec", "value": 768008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705820, "uuid": "effb9fa6-92e8-4703-90e7-c3cccac934b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705820, "uuid": "6a7aa020-e0d0-471b-b570-d5491035cfb5", "value": "DHL Shipping DOC_69793741770.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42345a68-d261-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708702565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702565, "uuid": "41a9ae3a-7caf-418b-88a5-84d70b7a4262", "comment": "Malware payload (Formbook)", "value": "e6ff3ff07c56108635b0168948101a83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702565, "uuid": "5f3dfe30-d0e7-48e8-8094-2cff12991c79", "comment": "Malware payload (Formbook)", "value": "047ff870ac53c586bf0def7e35cc07b312e25c8e75f0989ef5ff7729d42c193c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702565, "uuid": "7ffc2b9d-f798-4827-9eaa-01faf0ef248f", "comment": "Malware payload (Formbook)", "value": "1f9f8e18dc10ff09944ff40dd96c9f1ccfa87532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702565, "uuid": "6d968b61-3a1a-4dd6-a1bb-a6d1dfe3cf85", "comment": "Malware payload (Formbook)", "value": "ee24ce42cfa90fd849ffa43e448e454472aa6a801c18249498af6d8e67876af6723d91f7c1cfe045ddfcdac5df93c039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702565, "uuid": "8b475f21-f8f7-4489-ad8b-c4edc9cffd5d", "value": "T13EE4129422BC6B67F13FB7F925A0210113F9647B7A76EB584FD700DA2922B14CE09E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702565, "uuid": "d2168009-3880-4990-aba2-7033f04d0b2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702565, "uuid": "a8b1bc2e-4e9e-4be6-a80b-8b20f6a38c96", "value": "12288:W2nIX5Ujd53LlvWZNQwRmazU00aq6XnRYQMkJ2OaV7O/wTPAovPnWnN09jB:W2ngKY/ZRp7RSKoTIuWnNCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702565, "uuid": "1ae479b2-ce02-4139-b053-fdc05c4e353c", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702565, "uuid": "641a6375-8ee2-439e-a672-f12843c15b9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702565, "uuid": "7d4860c9-7ba0-4844-aec0-ccba1bddc8ba", "value": "rDHLFacturaElec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a7244c-d234-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708683244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683244, "uuid": "14c0db12-26e6-4a0d-b9b0-6839bb8d0442", "comment": "Malware payload (Moobot)", "value": "5a3099efae335c62f1f2cd7d0a4f81ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683244, "uuid": "dfda156f-9a19-4d96-986f-43980e601e07", "comment": "Malware payload (Moobot)", "value": "04b7aac89b88ade586afcff59f8b14caebe325de2ceec0816f3ef0a08eaf6cd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683244, "uuid": "280c76ef-f5da-4898-be8c-9ea4d187cb97", "comment": "Malware payload (Moobot)", "value": "cf907cdec73fbd33ccd2dbee38f75fbf8c17f6c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683244, "uuid": "4ef3c630-ad61-4266-9428-8c14b711e5b2", "comment": "Malware payload (Moobot)", "value": "8e2829ccbdc31d7915d66d8a03c84f0c6c32cc9d5d8bca4cd704242962ccf7493fc3cc9ac57092fb26b3b31afc5b0f6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683244, "uuid": "1d9e4402-91cd-48c3-9212-cda409378be8", "value": "T116335B21A97A1E17C0D4A57A62F34329B2F1034F26B8CB2EBD730E4EFF1594461176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683244, "uuid": "12b6bae4-3117-4a7d-aeb9-9e0c9a887f87", "value": "768:ctoXq9WTq7lzf415tQWHxD/KrnHq/Oe+O+kYTDqqN:ctKSWO7lzf415OWHxD+nHQOeMk6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683244, "uuid": "2ff95053-0091-49b3-b719-077377148d6d", "value": 50884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683244, "uuid": "388c5ef5-67da-4736-a62f-4fabd8c79d92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683244, "uuid": "9ccda5d7-2f9e-433d-96b7-8268a79fbf9a", "value": "5a3099efae335c62f1f2cd7d0a4f81ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd10bac-d299-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708726821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708726821, "uuid": "c91e2792-27d3-426b-8471-ec6ea420ba6f", "comment": "Malware payload", "value": "f2cb09305844b62dea3dc3054dea166b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708726821, "uuid": "0447a7ef-1f5e-4ae4-bcd2-2d32376ebe9e", "comment": "Malware payload", "value": "072737a1bc216105380f487d94854aa9d618b5491a5ac280c26a4fd860d6bfce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708726821, "uuid": "5171091c-98a8-4de0-8511-aee11954a5ba", "comment": "Malware payload", "value": "9d12bd1cd1316dd9c47897101198b506134518b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708726821, "uuid": "b9e8ebee-6269-40a9-9790-05f5b06711d0", "comment": "Malware payload", "value": "3303ba04c7c8f1328c51fd9590b7c44307d27e5ef9f492546e7a5aff4f42c12c0b00338ba92c979adb4c5c50c7edbf13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708726821, "uuid": "295f6e71-b6f2-43e0-b5fd-fb121cb84f01", "value": "T14FC68E2F72E4C229C16EC17BC1978F51EA33B0B91736C6FB16A542641F12AC59E3E670", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708726821, "uuid": "cdbb0632-9533-4d05-9a79-ffbbb414ae5a", "value": "6bf781da6df663278b0bac9d575eb5ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708726821, "uuid": "6018b696-506e-466f-92de-de1ae71a3194", "value": "98304:JbjM2EYAsjnpWXW9ghnaIfVFsW7JOo23bSCD3/uJt53re0xr+po7x:JfM3SnwX9haojs4Jr23b132tZre0xrZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708726821, "uuid": "27bfa210-a16e-4284-b50f-b7b73780bf52", "value": 12396832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708726821, "uuid": "2aa1a866-901b-47cd-9b6d-4e6055f8c447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708726821, "uuid": "d8cbbd59-ba9f-4791-b023-e4f6fd972c65", "value": "SecuriteInfo.com.Trojan.Siggen26.35426.31504.21163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326e9e62-d260-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708702109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702109, "uuid": "8d35f146-5425-4adb-9c4e-88ba80bb4a9c", "comment": "Malware payload", "value": "8b6a45d8fa4e70b0e1c06c76b523cbc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702109, "uuid": "bc0c1081-48e2-4092-b41b-4e065d34b046", "comment": "Malware payload", "value": "07487a9b997d8f757501912961bce0e4d72acfe80760ebd50ee4b485b89210b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702109, "uuid": "b5c24d51-6ca1-4633-bca4-d2e04132ec8d", "comment": "Malware payload", "value": "71ec9aa061ee5136730a7d0abfe196ff5c8b7dd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702109, "uuid": "26e53329-988e-4ea7-9bc9-d66e2be53b66", "comment": "Malware payload", "value": "d307a41cd8f7e5f279bfd83b820754fb065557a8ed438113515b34e29c97a1b3b76e9e7f031b38d0dbdf3eaf8c2830cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702109, "uuid": "1167a274-4841-4245-b980-260eb6cf5960", "value": "T1F3B25B8A2EA80FB1C9081C381C5E3776B733DADB7C57A113A264CE391DB5785E43D652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702109, "uuid": "ec282bbc-2aa5-443d-91ec-b27c8f226972", "value": "20b0e5ae70b508773a5ce1469630cc99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702109, "uuid": "a31434e4-8385-4b0b-ba16-5e9348a0d100", "value": "192:XH4SiEy1Hf9fe3gSLfn7g9ivf3qw/RgBdP29K4f2PdV0e8VaxRBnbaHCxyzXJyOD:X4bNe3Lns9ivwrl4fwGadnfxyDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702109, "uuid": "ad9d6fd9-d48d-4a6c-834b-4f8883f6bba1", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702109, "uuid": "b8a75145-3019-4bc9-9159-ca25cc8ea67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702109, "uuid": "bb2bf43d-5c14-4e33-b58b-f2f6958ee452", "value": "SecuriteInfo.com.FileRepMalware.10040.9737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22552d9-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708708847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708847, "uuid": "5e7f2754-f29c-4efd-a1d7-0be091160858", "comment": "Malware payload", "value": "cafddd17b720ad5406b922d9d83ca67c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708847, "uuid": "cfc96088-d302-4217-8c8f-2a047534be41", "comment": "Malware payload", "value": "080d9e7d7fd848bb870ffb7a2bf35c0534af866f42b45357dcdd1261ddc39fb8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708847, "uuid": "b14650bb-16c7-4f30-83b0-2ab087ec14ac", "comment": "Malware payload", "value": "cb8f6d9eb78288129c369572cddbbff0ea589212", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708847, "uuid": "35735207-d5d7-4142-b80d-5ed50fdcc673", "comment": "Malware payload", "value": "ec165d76df75f8d864be50720f2bb100b2002ae30506f97f40b42403b8f85cd1b580b74052beef4df6b65fe70d75dd5c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708847, "uuid": "ef6e464f-e037-4ab3-b74b-af73235fc832", "value": "T1EFF2095DC74F40A1CF54A373031A8A8946FCB73EB20645B675AC83753BBD82E09A657C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708847, "uuid": "09ccacef-103d-4f17-a52b-4ab957807dcf", "value": "768:yI/7Je+ivFoYA3KZHbg6HkdkO4kmL1Huqof/MUMXZ:v7JRitovIHguk6ud/r4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708847, "uuid": "f6a1719b-c24f-452d-a05d-d04c2a0a180e", "value": 35995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708847, "uuid": "74d28c73-a2b9-4c1c-8798-c8fc5b5e9b98", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708847, "uuid": "17e0b143-be66-4505-8068-792ccb5f03f2", "value": "cafddd17b720ad5406b922d9d83ca67c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fba1707-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677731, "uuid": "d360cb6b-8519-4f35-98c2-0f21a1ca69f4", "comment": "Malware payload (Mirai)", "value": "ab994850f9afc96a126ca21418f0947d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677731, "uuid": "dd8fd0ae-dda2-4452-8336-5df43e098fac", "comment": "Malware payload (Mirai)", "value": "09831b2722cbe11288bb299a582588c0363ddfe8367abcc02f4dbc4c48a48d7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677731, "uuid": "af0df8ab-17ee-44c3-89cd-14beb2ee77ac", "comment": "Malware payload (Mirai)", "value": "60b79b909c314852910dac7ce49ad2f3d8fb8200", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677731, "uuid": "b597d590-d7ed-4a11-89e9-965b61a5c8d8", "comment": "Malware payload (Mirai)", "value": "e8eefa709cc8b20d5ea002f05c15a20fd33380ab8c0247fc6a3ba06faef23270c89e5db367da20c3feb5f3cae4d7b607", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677731, "uuid": "dfdedaa2-2933-4545-ab55-18aa31db45ec", "value": "T12713E795FC92862FC6D0137AB76E2B8C37A267D8C3CF7313992017613A8651F1D22E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677731, "uuid": "d5df0185-ad6d-4d79-8072-2f6cfd09afa5", "value": "768:sROo1U9I1eN+9MG50ma4qLzHLJfjPrlzjDC6S5Wod48Q0piTPBHzbqowt3p:sVeI1eN+uG50L9fTrlDC6S59pijBHyph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677731, "uuid": "d800dbb7-3cf0-4877-aa84-631653fd6ddc", "value": 43192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677731, "uuid": "00db6ccd-9e4b-4262-b7b1-aef5514ed6a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677731, "uuid": "273f09d3-c2f9-49ea-b525-68fe6871e6ed", "value": "ab994850f9afc96a126ca21418f0947d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f6d765-d281-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708716348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716348, "uuid": "428edea9-e9d4-4737-98f8-097db907b491", "comment": "Malware payload (Mirai)", "value": "c0ee334a9e368a2e39828a8e10d5da34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716348, "uuid": "2d4c05b7-259c-4bfd-b95c-6b0858e7872a", "comment": "Malware payload (Mirai)", "value": "0a774fe4a01326c76a459ef246ad4d3e9d8955e4902ca4cbb5726686884b620b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716348, "uuid": "c2aea758-b0e2-4e87-a093-225c8271350d", "comment": "Malware payload (Mirai)", "value": "e5364e02b412f959af1f04ae172470e3ab019b62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716348, "uuid": "0e084489-29c6-401f-8259-e45f095eb2de", "comment": "Malware payload (Mirai)", "value": "1052e1e96af7df03559af218959787f3f3fc98bcd72d18aa263c72cbdafe64617c68a692f420a2e7b7cd95954e82226b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716348, "uuid": "d2cf8d17-8339-49df-b569-1b10ce553ba8", "value": "T1E113F17EFD0961E2C99BC43953E48B242E7A095EF423EA106569EF49FE4361C74AC3D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716348, "uuid": "09cf2388-9e83-4d2b-a3d3-16315780b83d", "value": "768:xnmfqkzUI2grhM0QZsDs5ZE6/zQEbuTrJgGlzDpbuR1J9Bud3zKXyph9:xn2AcWRCKJQEbulVJupuJzKiph9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708716348, "uuid": "4d6643fd-cc85-4a7d-a889-0f29a4b61199", "value": 45132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708716348, "uuid": "53718f3b-0da3-475a-8eab-f627eb2fa2ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716348, "uuid": "d395aa51-9204-4003-ac0a-b47f81b41463", "value": "SecuriteInfo.com.Linux.Siggen.9999.13213.21431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c575da-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677708, "uuid": "34a30968-72c2-447b-a784-daa82883685d", "comment": "Malware payload (Mirai)", "value": "65cc10c53bf1203b00c947e3c4f8768f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677708, "uuid": "4cca742f-87e7-4ada-806c-34050657b604", "comment": "Malware payload (Mirai)", "value": "0bd3bab393f35ffe6379b1164aca3767565eb186795ff445c8432d424e60b3f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677708, "uuid": "23d4e52a-9c84-4700-88b6-f423919cd6e5", "comment": "Malware payload (Mirai)", "value": "f790dd1b800ee272a71a2c4458d448966de89751", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677708, "uuid": "290de67c-93ab-40fb-bada-fa8feaa9ba56", "comment": "Malware payload (Mirai)", "value": "6eef2df6b4efe37d0805d50448b952b67c02597eacf5670f7f9374c63e92a05ba0e7cce69db548ab665e9342164a0b5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677708, "uuid": "4ca8875f-def5-4cc2-9ce1-52d453fb528a", "value": "T1D2142A46E6418B13C0D727B9FADF42453333A79493EB73069928AFB43F8679A4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677708, "uuid": "aa3fd6ed-98f7-492b-ae71-233b2c74843a", "value": "6144:3T/2qJZk4au2ROU8OXY1PNlareX4M/RYWZ3P:3T/vZk4au2ROU8y2jfXt/eG3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677708, "uuid": "c3820a9d-9280-4485-9ce2-92605bc0686d", "value": 201278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677708, "uuid": "d539c6d9-21aa-4af1-b2bc-888688c261ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677708, "uuid": "4fe31f2f-0617-49c3-823b-fe70f42f9c16", "value": "65cc10c53bf1203b00c947e3c4f8768f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149548e4-d235-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708683591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683591, "uuid": "720f994c-679d-45e5-8791-1ace83dc143c", "comment": "Malware payload (Gafgyt)", "value": "264bfce7da89d583a930c96095a6d594", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683591, "uuid": "b9a3d981-3f2d-4292-899e-ba2e37edf0ec", "comment": "Malware payload (Gafgyt)", "value": "0e4f7f8e75f06e1c9cab9f8b7d1053afe28db52bcf62d14a1737528bdebb9f7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683591, "uuid": "0df675a4-683e-4138-98a5-63f12e108c60", "comment": "Malware payload (Gafgyt)", "value": "0449c047db52e88ca322437614c19b2989a0e7dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683591, "uuid": "2364f128-a656-4b29-b9a4-8b64d3be0d9a", "comment": "Malware payload (Gafgyt)", "value": "f02dbac711092d166f1b8aba4605456cf560555b3bcc8660196221e4e8a3225e9a9acec0327f3c4d89931ac3c4c053bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683591, "uuid": "8cecf6d3-abf3-4921-a1a9-bfd693707a64", "value": "T1C5F2E1D5F0805DB9EBBB3D7F07B6EBC61F9004CF3B958796B0486A1046582331906AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683591, "uuid": "9a8e4cbf-8de2-4bdc-b7dd-20fd99d1019a", "value": "768:OUlctgo3ekTdcFCcoeE9AoT3v5bBBqpRqAZH0R3plYMwq4uVcqgw0RNWXa2J/zpu:EWo5TdmL2AonKlUR3plcq4u+qgw0bWX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683591, "uuid": "a68f3d92-0202-4d34-9ae8-29085bcd3789", "value": 35888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683591, "uuid": "9e072441-a831-4265-8b34-5dc528dbe456", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683591, "uuid": "1fffcba9-0ac1-4a38-9066-8862237101ee", "value": "264bfce7da89d583a930c96095a6d594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9b53d0-d21e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708673862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708673862, "uuid": "cccb6da4-269d-4053-8fec-c390339b7b7f", "comment": "Malware payload (AgentTesla)", "value": "20be5bb148f5fe169199234121d644e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708673862, "uuid": "d405f255-5c01-467b-aa92-9aa680c8cf8e", "comment": "Malware payload (AgentTesla)", "value": "0e6b324fbaef626b2ff2b4f96b6056ea94d65e8655e5e74e841c1eaee2aeba9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708673862, "uuid": "9e0b8d42-50d2-4dc4-86d6-10d420a6aefc", "comment": "Malware payload (AgentTesla)", "value": "cc6927544fbc0d7bc5aae749dc26c31615197516", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708673862, "uuid": "657d1e00-5840-49e6-8ddd-722745c8115f", "comment": "Malware payload (AgentTesla)", "value": "aa5b29f17f98269f144ae2fd11c6bf36874ce84206ff1c854d73407ff4fe091decb42b4b9f401b72ba72868aa58e371b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708673862, "uuid": "0f9ef81b-b805-462f-8434-901b73529ebc", "value": "T131E42360B7B00BA2D65CA7F22E556501AFB0742F5C71D3586DC160FAA9F7F004A2AF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708673862, "uuid": "7e2bb2e5-769c-4f74-b195-ebe54fd3310b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708673862, "uuid": "7ee84575-7cac-467c-8fd7-6f7493c535e5", "value": "12288:tws/+P5Ujd53LlvvRKthuuJY8FnGFsojQfk0a3Y/4/qTA8G2+X8WrcojVUKkR:eBKhktUuC8R2VjQ8vEBTAKm74ojVUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708673862, "uuid": "9fba1b79-279f-465d-a6e2-cb3110501bac", "value": 720904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708673862, "uuid": "6efc50a4-a886-43b2-bf40-16632d663456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708673862, "uuid": "866b4e76-eff1-48d8-9936-80624f7840a8", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d134a0-d20c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708666301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666301, "uuid": "b1df1e37-e2c3-4225-b5c3-783fa382161e", "comment": "Malware payload (Mirai)", "value": "b51fa3774396fa8668fc2cb9abf3a964", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666301, "uuid": "99307271-bc5f-4bcd-9eb2-05a2af3d5ddb", "comment": "Malware payload (Mirai)", "value": "0f37e68b078863183974b0d5db61eeef927cf84fc4ad84f3836c100ff66091b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666301, "uuid": "c16efc84-92e5-4c8c-bad7-22f43487bd45", "comment": "Malware payload (Mirai)", "value": "3386dc60e68083887d8d7373743eafc0f4914e91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666301, "uuid": "c0ea7f16-9c55-44ab-93b0-fde5eddb2f72", "comment": "Malware payload (Mirai)", "value": "93076af408170b089191eeb85a884e66c11cc6139405e9758f570122a060858a853515a1c0558b6564eac7ff9401877f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666301, "uuid": "2016244d-8dbe-44df-b50e-b82d1e042adc", "value": "T189330A8EB8029D3CF91BE6BE54164E0DBA3177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666301, "uuid": "dd0165df-c067-4f99-8a0b-6b85747fb14c", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGQ:r/hqaJMcjeqK806MHdMfQXoHuCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666301, "uuid": "0d042ea1-ca6b-41d0-8cba-1473b416c627", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666301, "uuid": "9aa5e6fa-6774-4de6-958d-f007e7654749", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666301, "uuid": "8a30f295-9ac4-4d7f-92ac-4f29f8cf9984", "value": "b51fa3774396fa8668fc2cb9abf3a964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3fe4665-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1708705870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705870, "uuid": "5ba8bdd2-54fd-4ce0-95f2-22a0493a75b5", "comment": "Malware payload (Stealc)", "value": "6de6ae7b51d7e7644c988406829b0331", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705870, "uuid": "0e849a9e-44d7-4259-b717-d435803088f3", "comment": "Malware payload (Stealc)", "value": "1140e139bbdfd915c3d86eadcd65aa8d643e4a0aa0cd5d9e536b1b8c528ae4e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705870, "uuid": "e408302e-c819-4987-a019-8ada45bd07e2", "comment": "Malware payload (Stealc)", "value": "a970b37799da109ff1d492df81c4b64fc6c0e595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705870, "uuid": "1182e79a-d2af-48ed-97eb-25837bff21c9", "comment": "Malware payload (Stealc)", "value": "7d4b5dcf563caad30ccfb9f59980ec661ca839a0084af21121211f058856eb9047f0991ac797bfbe8e8e86bdf22e949c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705870, "uuid": "d358a63c-05a6-4b8d-a587-33c40a6edc58", "value": "T14246336F2391AC41E7576DBACB281EC40B66FB7448E5917EF20F14E4690A31DEBE3205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705870, "uuid": "4a84ae5f-86f5-4ddf-94a2-b591abfb3925", "value": "39389b46d0fc73ab23c0909b184bbcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705870, "uuid": "2def7653-3166-4d5f-b02b-8db06fa1eacb", "value": "98304:cj0ivwXuhNqQZBlnOAiu5lbntsjZVrV3JCeeAmWAVF3fj1JaTIkn81eVAxbSmo0W:XiVhBb1lL5d6j/rFFeZxFL1JaMkn8pSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705870, "uuid": "4d639a50-0f74-45bd-aa3a-12db736fd205", "value": 5871856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705870, "uuid": "36b7beb5-ef75-44a6-b474-84cad3d3a487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705870, "uuid": "7f4e399a-3b9f-4d4b-8fb5-d46db8cb786e", "value": "6de6ae7b51d7e7644c988406829b0331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9852adce-d247-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708691543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691543, "uuid": "d5b90a54-6b9f-4d7b-b711-2ea35987a939", "comment": "Malware payload", "value": "dc296c5eb67d73e355ac03f088d6a67e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691543, "uuid": "786b6d95-46d3-4dc1-b262-b4061a4aa50b", "comment": "Malware payload", "value": "12320eac427ef19b52537c3c12900b992708786df9ff1c3e13f6ef89b3f8de28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691543, "uuid": "afe6de52-68ee-4f39-a229-645b4b6fd636", "comment": "Malware payload", "value": "6168a4b42451c96b2d1adb11f573e928e172524b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691543, "uuid": "6c9dcb41-6e43-4692-9ebc-b1e86e53f490", "comment": "Malware payload", "value": "0b62c82ca0f41028c0ff1ece27ca06b0e41d2bcbbae2e77964e297af55cd60263a68019209597f94aa2a21b9bad7a30d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691543, "uuid": "3fea4deb-bc7f-446d-9a54-d9464e147f0b", "value": "T12903E1DDF312F86BEB14E87B13FC524045B09F9FAB53CD05758064928B1A4C5A817EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691543, "uuid": "0c6ab3ae-f627-4ba2-9e8f-acabba968c8d", "value": "768:u3MuudSy5ofXiua60i4W90KWnHMtcVlofTAQPGeJgGlzDpUYsVc8CEYrQY:u3MuudSR3WfbofTAQPzVqYt82QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708691543, "uuid": "1fabbed0-bece-4ea6-acc5-54d338f78a7b", "value": 39024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708691543, "uuid": "a8582540-58da-4981-9b88-701ace9da4de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691543, "uuid": "4c9ff320-635f-4e71-8605-6f953d845106", "value": "SecuriteInfo.com.Linux.Siggen.9999.3684.17834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1655c0-d235-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708683582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683582, "uuid": "f3f83d61-35f0-4d73-931c-dc11a460fb10", "comment": "Malware payload (Moobot)", "value": "9c4eb89e29a7fd7ad936b27389e36406", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683582, "uuid": "e3ff2428-220b-4b6e-8a00-018101190cf7", "comment": "Malware payload (Moobot)", "value": "133694bc5850320cf10bc3ee21d0508ddbb085aba349950d6d844c7e8a5a6dae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683582, "uuid": "47ea3308-3ba5-4c72-b3d3-95502470e3a8", "comment": "Malware payload (Moobot)", "value": "e688b26c5d5d79388c38be550decc1db08e8073a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683582, "uuid": "83923e8f-c6f5-475a-bb15-5b3df5025de5", "comment": "Malware payload (Moobot)", "value": "0764dbd19bf2ee666c90c0d9bdc82c3e24d34a31a5bce0fb43546528fb7b7196235c19aa9bae168dacc48643ff2e45d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683582, "uuid": "ed55af53-dc58-4044-8510-b6a7561f5d8c", "value": "T13643FA46B991CF11C9D412BAFE2E118D33136768D2DF73129E106F247B8B96B0E3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683582, "uuid": "151d21c5-8aa5-479c-a94f-0bd78cce66fe", "value": "1536:aknmU9WPMQ/C7v9/JS0cUrlauKdnIBRP5INifbrDvGM:oPMSgxJSerlNbrDvGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683582, "uuid": "58394b45-6df6-42a9-969b-c2850811cffc", "value": 58164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683582, "uuid": "61dcf655-5d0d-4640-a515-aa63ca5fcad9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683582, "uuid": "f45efced-2213-48ab-92f0-723b0a59e44e", "value": "9c4eb89e29a7fd7ad936b27389e36406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ac829f-d20d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708666715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666715, "uuid": "4a6cbb04-dc07-403f-a23b-5d817a8f3d55", "comment": "Malware payload (Mirai)", "value": "d8c759e59ede749201375daf1891a174", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666715, "uuid": "07c212bf-4187-432a-a800-960eb1f54644", "comment": "Malware payload (Mirai)", "value": "150676341dfa855b11561f2e0cf0ec3a85485e57f0867a5be0da426216c295a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666715, "uuid": "4ecd86a6-b51b-4fc1-b7c7-618f4c2ba1e3", "comment": "Malware payload (Mirai)", "value": "21f09dbce52872a45b707c5211229f6dffa730cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666715, "uuid": "057ab548-4623-43be-9e45-c960aebc6066", "comment": "Malware payload (Mirai)", "value": "5dd0c51607b8674cea977cff59d640acc072857885da3de4be1ef9fd88218843360acbda918626925426797ac86d8f89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666715, "uuid": "b77ae4b2-3f3d-4081-8639-4cf5ad0dfcc0", "value": "T10FA2D025D349AEF4DBAF9C9053C2C2C27AF547C72786D8E240EEBF012906442B788D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666715, "uuid": "fd19ce9c-8e8a-4b42-af51-30f1215c627b", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5RM4uVcqgw05VxJJ:mRxsSVsMD6xiJJE5zRWNc4uVcqgw09r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666715, "uuid": "77fea1d1-7821-4a32-b271-04ceadcbdca5", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666715, "uuid": "5feebbcb-2a7c-49f0-a7fc-c17c9fa65561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666715, "uuid": "bb656fc1-e65e-4e96-98d5-d816f3082720", "value": "d8c759e59ede749201375daf1891a174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a997e309-d27f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708715624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708715624, "uuid": "ae22419b-ba3c-4ff5-be84-dbb2c4e04f17", "comment": "Malware payload", "value": "5a090bfba60f77b2d46601615fa5879a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708715624, "uuid": "d2e03fb3-a9cb-4337-8302-f71aabb01b36", "comment": "Malware payload", "value": "15ebfa7d5cca98eaf5190c84e73efa53a21f8646ecb4c4cb56aea5fb0390c188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708715624, "uuid": "476971e6-4b47-4ea6-bc0f-9ce0b4778850", "comment": "Malware payload", "value": "9d5feb28911b6bcd9aba0ef3d2fc0c24a283f9bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708715624, "uuid": "de88fe62-2891-42d5-8b03-b305564c836a", "comment": "Malware payload", "value": "49c753d55ef54b4644b862b322a6ef020ef79dedb8c959a20e8c31d8ba70d0ee61b93479c74b458f794c9d83b96914d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708715624, "uuid": "0d683a81-2b48-4e84-bceb-0dee6511244e", "value": "T186D423870EE2906BC5E3477346F3A6A6D6B79712297B918F1B508FBF0D75B138A025C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708715624, "uuid": "88ac4754-0b8f-4807-8142-6b45aa132f68", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708715624, "uuid": "adf61874-57b8-4129-bc4d-0e2ab0290cd1", "value": "12288:9uRtJnfJk+Jc8J58JazDAjMDla4TEGzxGtV9Tj20z168E7rg3ONKUH:9ulnhk/8J5yRqvTFxgTjxzk8QOyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708715624, "uuid": "997d4e91-c6a6-45e7-83a9-727e60c24afe", "value": 603936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708715624, "uuid": "b783ba3e-0b1f-4138-bc4f-9d7a3dc6847a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708715624, "uuid": "e56e9364-863a-4dc7-9d30-37ecdcca0d3b", "value": "Ekstre.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7a2846-d28f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1708722611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708722611, "uuid": "0823b72c-dba1-4247-b771-4cb5a9718859", "comment": "Malware payload (RemcosRAT)", "value": "01fe5e5c4b48be008eaa91ec7e6f2c5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708722611, "uuid": "24501a9a-0465-45ec-8bf4-a6ed2a89d369", "comment": "Malware payload (RemcosRAT)", "value": "1a5e416c52c05aa813b4baaeddf2a13945fc20d667c13fbafe4e52d73ce17292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708722611, "uuid": "8b18e7c9-f932-40ad-a2ea-00f369d384f5", "comment": "Malware payload (RemcosRAT)", "value": "d99ffa5535eb4d9399aa85fe5af77028cadaaa85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708722611, "uuid": "b9bb9cfc-a14e-42ef-ae8c-6da57dff85af", "comment": "Malware payload (RemcosRAT)", "value": "743b21c31f6af47140039f26ddc0fd7436fdfa7fc2ce0f9225667642ea4584a3dd0c83b6d68cf1be4f6f3fdb4f9402bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708722611, "uuid": "65fcd1b3-f242-4e5c-8b76-4e73c6e09ca6", "value": "T1132512AE1290C885DCF946B0DC1F99342DE0DD6A996E105E22E2B77F69F320D4A073F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708722611, "uuid": "65567f76-ca7b-4dd5-bb70-77aa5fa1b05e", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708722611, "uuid": "63185009-fb4f-40ef-8d08-b047dc8c2533", "value": "24576:ycx2DOGnZwpLrYRJBDwbFZ+9ND/2oKRMiYaSHVDfZ:ycx3GerKfED+uoKR3YaMVDfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708722611, "uuid": "452e8b62-6d5b-4411-b35a-16ce87d90e51", "value": 974424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708722611, "uuid": "222d4d59-6642-40ec-b207-4ddddde07b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708722611, "uuid": "671a11b5-be91-412a-a092-96eda84696c5", "value": "01fe5e5c4b48be008eaa91ec7e6f2c5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c7b6e9-d260-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708702301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702301, "uuid": "f5e804cd-1d78-4b90-80ff-f2dc5e8ee984", "comment": "Malware payload (Moobot)", "value": "f8c2a83d0efb1b514c29f538a0358831", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702301, "uuid": "a8bfce66-2236-4c9d-a9d7-1bfde9ad58f9", "comment": "Malware payload (Moobot)", "value": "1a7f1809cc4bfea713bda4225e4db3f488048e2fdd7b8488702052d5f80e4be5", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702301, "uuid": "f50e1e3f-c2ba-477d-b386-58e624a4d809", "comment": "Malware payload (Moobot)", "value": "da5e5c16524bf9d136691d4b5544dae844ab222b", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702301, "uuid": "6381ec48-bc45-4615-bef9-79e0f74edaa1", "comment": "Malware payload (Moobot)", "value": "cf1268d5030405d301e549c908e20ff6d9333a7f3f1220941d5512fcac4a20e7ff6adf030a12a7956d5ad674abc6753c", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702301, "uuid": "d9d69174-2a1e-47e1-8b43-c504c26f4046", "value": "T17483A51E7E218FADF76D823147B74E25A75833C627E1D646E26CD6002E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702301, "uuid": "9f168c96-1ac7-46ac-8c89-94eda0894de8", "value": "768:Ws7qYPrM/zq0ItRhOuN2U8NtlPd7Tj4wHmRXwcrvH66yOJSsILvC7HBnfIuy8gRM:Zqzdc2U837HCzyOHIL8FAebuZLyYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702301, "uuid": "5334840d-e374-4e94-85e3-7705fba984c8", "value": 84828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702301, "uuid": "44ef447c-bfd4-4333-9b4f-d4427094f126", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702301, "uuid": "cdb9c5c0-a7c2-471d-8d39-030c5a88b11f", "value": "mips-20240223-1531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5601ec-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708705802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705802, "uuid": "11705cde-8b8e-4dd9-81c8-378cf26c3ec1", "comment": "Malware payload (Formbook)", "value": "b034ee4d4c64ee52e4c67a6447df647a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705802, "uuid": "c097ca71-c34c-4cb1-b32c-66afafd7c0b1", "comment": "Malware payload (Formbook)", "value": "1cc6692c6eea90b5d59134a8378183f6d0add1ff91d61d760cf5a89b9d4ec82e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705802, "uuid": "bbc7cfa2-bfc8-49dc-bf9d-bc0f1258d7e9", "comment": "Malware payload (Formbook)", "value": "c42921584b15f52b4810e63bf4be989e75a65aa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705802, "uuid": "f571868c-aa14-41ea-993a-406cd11cfd2f", "comment": "Malware payload (Formbook)", "value": "a51f9f4cdc92d4d59693f7cb443b03f213bad4d258f94c37649df164f21bbb992a74176f8628751ef8f094910d205c24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705802, "uuid": "2ee5de38-a4bc-41d7-bd18-c4f946f25de0", "value": "T126558D0E7F81802EFE9AD1320A5EF233F6786D563127A71ED2543FE9B970161062D672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705802, "uuid": "8ed26865-0f6e-4a06-82f4-7b85e50ebe4b", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705802, "uuid": "695ed998-d5ee-4f64-a45a-9c7f4435b556", "value": "24576:8qDEvCTbMWu7rQYlBQcBiT6rprG8a7eg7DhYJbtA8phgnGtdynhcTNQ:8TvC/MTQYxsWR7aqgB6Qnedynhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705802, "uuid": "c24e253b-7c4e-4b6a-b02d-b4240a114ca5", "value": 1405952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705802, "uuid": "a7a5641a-944e-4a92-b2ef-6d6f6e6b4f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705802, "uuid": "cf34d43c-3b8b-4801-a04b-8995832a32e2", "value": "E-dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c893774f-d220-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708674874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674874, "uuid": "77270619-446e-41b0-84e2-fad85400094e", "comment": "Malware payload (Mirai)", "value": "8e33bc091ddf22d6fe28933d1916fc5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674874, "uuid": "8c6314bd-ac82-4873-b6eb-c773af8d441e", "comment": "Malware payload (Mirai)", "value": "1ef61ad073556aecbfc7c6de04619eb460d415903e4c9e9a52b8894688997bf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674874, "uuid": "0ecfb190-9e75-4169-b001-d7d61ecb3bec", "comment": "Malware payload (Mirai)", "value": "f35d4d378112d7c31c3357e20b52e3bb1979d9b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674874, "uuid": "7a0b2af2-c760-4b3c-815f-acae5752351d", "comment": "Malware payload (Mirai)", "value": "badf4a7c2d865675c3821376874ba641b816e0b99de9dc01a57d6310a789ae6c553b78e0d2cb0aa7a94ec76db78ce6f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674874, "uuid": "63b0ba4b-8c67-4c40-83b6-1a12bf6f3b51", "value": "T1FB21C2A6A5D9EC33DA6201B651C56F4E2755CDA114A7FF0B8D514402EC396D1E132264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674874, "uuid": "9d43ff4c-f286-4bca-bedc-f4c165d08c14", "value": "24:FltC8MsWOJFHxgxCl6ZSiSZSLc1fGHwEprGuWpiruQ6aQNfTanw:ftDoOL5sSi0SLc1swErSp2HCNGnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674874, "uuid": "12faea25-dea5-4822-b233-06bced95f142", "value": 1176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674874, "uuid": "93f18085-aec2-499d-bef9-5bf345a08d3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674874, "uuid": "b170c4a4-42d0-4989-bb8f-4e527407a57f", "value": "8e33bc091ddf22d6fe28933d1916fc5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e53e904-d226-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677380, "uuid": "2d6802ec-86a2-453a-b0a0-5d5563a625ea", "comment": "Malware payload (Mirai)", "value": "c4dac330d94c26d0e0b5f4728fb5c927", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677380, "uuid": "d427692a-448d-423d-88df-0e70b2b5bfbc", "comment": "Malware payload (Mirai)", "value": "203c63fdb6d230693f9e3a85f116446bbef3efce3cdb175799254004524560bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677380, "uuid": "49b7214e-7686-4e63-b02b-4323c1182eec", "comment": "Malware payload (Mirai)", "value": "6870a8c96a6205617d4f88668c05a3ff6108cbfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677380, "uuid": "a566ea6d-5400-4b77-bcb6-6ef7fb27e295", "comment": "Malware payload (Mirai)", "value": "5ef1145830089d2a36ab4e18678c0b41bd0fd346316b7c9c172fa24d73f97430a9a99f429e7dc2a78efa03b57514b373", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677380, "uuid": "a6859b1b-3629-4d60-baae-0d92f25e66e1", "value": "T10FF30A56F8819B11D5C111BAFE1E128E37131BBCE2DE72129D246F707B8A87B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677380, "uuid": "c98757bb-4db5-4290-abb4-5d1c3871220e", "value": "3072:DEK0G7NyUNk2fatXGEHurjBbaf0r2oMIfCUo2CCr5/NKf0:b0/mratXDH8lasKMfCq7r5/Ne0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677380, "uuid": "f4ab44da-c49e-40c0-a0ed-c789d9dd7c39", "value": 159484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677380, "uuid": "2f5c0974-361a-4eb3-a008-4c9fa61d0ae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677380, "uuid": "417f6891-dd69-4dab-a6e1-1fa1a19c1c76", "value": "c4dac330d94c26d0e0b5f4728fb5c927", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544de342-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677685, "uuid": "c95a8320-fa46-4d79-9a28-2262300ed090", "comment": "Malware payload (Mirai)", "value": "3b5d2c7f5375b951f3d5db6a7bfaf0e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677685, "uuid": "feab2413-eff7-41d1-8811-ade83640a875", "comment": "Malware payload (Mirai)", "value": "2128b758140a308a427a90c341c16f6d754a82459ffe2b1ff313f21fd614076f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677685, "uuid": "7205e88a-dceb-42c5-9c70-0c470cfc475e", "comment": "Malware payload (Mirai)", "value": "9d8d1ce75df0027bd5818c7627a6366b4699d28c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677685, "uuid": "123f3967-7a3a-4a91-b497-8e1c21a07c58", "comment": "Malware payload (Mirai)", "value": "571f59b37c4138292a92ff6655cb4b29f6c6a6179002ccca76d30a509ea1591ac62487be3fc6914357dd5b22a8fdc8f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677685, "uuid": "cb9172fc-7ae0-4fba-aa22-12432d186fe2", "value": "T1C3631A56B8814B22D5D5027AF92E128E332317FCE3DEB2229D206F20778796B0E77D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677685, "uuid": "06c9dc19-42be-4354-9aeb-4ddd7d3c4c86", "value": "1536:cXnZOf2Z3Sfw2hoLBgXaJjMjiQNMiiILawU5pYIi:S0oLBgXaJQLawULRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677685, "uuid": "605e0673-7c9d-469d-8645-36acad02bc2e", "value": 72280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677685, "uuid": "0e0465fb-385a-4fbf-a568-877d1149ec09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677685, "uuid": "b373c722-8925-4b61-983c-c49bf9f7a4b2", "value": "3b5d2c7f5375b951f3d5db6a7bfaf0e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f14962c-d258-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708698775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708698775, "uuid": "ab56bdda-27df-403f-a70f-2bc7756365a2", "comment": "Malware payload", "value": "a548469585481a1b7f98c9b09d271349", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708698775, "uuid": "c2dc8b82-84f6-46cf-b3da-2d5de4f5a442", "comment": "Malware payload", "value": "21340c04b12af92f3bd3dd076e5a4f20c0fe5558461b5ff3f848e5d5b7183322", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708698775, "uuid": "e4f70ae8-11a4-43fc-af04-bcc4cd39a7a2", "comment": "Malware payload", "value": "677eabeb661d965c7d3d5ff6f6b9336e27b80b91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708698775, "uuid": "535b49a7-ff54-4ad4-8b31-f646754256ce", "comment": "Malware payload", "value": "be1e3af3519cc280687fcbade1cf3fd78375d16506609269f4f9cd8c8478a99ae1fd9b6a530c0ed43c077a3e949f2f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708698775, "uuid": "c9cac4e1-0ee5-4aaf-bca4-39462c96b747", "value": "T1D7A5232273C4C175D4B706307AF9E8B599BEBD228E319A5BA395035C4D701C0DB6AB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708698775, "uuid": "11492415-ecf8-448a-a749-67c5332a2a91", "value": "e6f4169f2a5c3a8f93171d9f593bd22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708698775, "uuid": "8f8d1606-e3f4-4f88-add8-801bf9b5bdd7", "value": "49152:UMBQcZoX44p0k4icOpl048bBIaPeF/BXoG05ChlszkSJl:UMBQWo7pZuOplcSas/poG0Cvs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708698775, "uuid": "8539e073-77de-4e50-8d85-a2cb7f4a5e1d", "value": 2102272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708698775, "uuid": "7ce61b41-69d2-4ae3-80d2-08f201cd042e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708698775, "uuid": "0c36c11e-04cf-45db-93e1-b72ce43d5da4", "value": "0219830219301290321012notas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd988f1-d238-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708684919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708684919, "uuid": "6a1228c5-52e7-486e-a033-2e7fc27aa83e", "comment": "Malware payload (RiseProStealer)", "value": "4d372e1be38eff759f9908f5f1739aed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708684919, "uuid": "976f5a72-0765-44ad-b622-db9edd6731a0", "comment": "Malware payload (RiseProStealer)", "value": "26547eefc12ad433a0f06eb2fbc2cecb17b2d31166d5a106c78d2158e417a439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708684919, "uuid": "850d8106-3384-49f3-bc3e-e86682fa2b07", "comment": "Malware payload (RiseProStealer)", "value": "bb09b75b414a52d3082e8e042b5736379e5af33a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708684919, "uuid": "2e02a35a-7954-40bd-889a-d540ca1522fc", "comment": "Malware payload (RiseProStealer)", "value": "f8d304ca1e9cb5813ceb0b902bc57e9b5bb06786821849e732a1dfd3c8cf951bd9285a4dc54482162c24a03758c20f37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708684919, "uuid": "be87826c-d8cc-442f-8de6-10b6e6516c56", "value": "T1C15633E5A64B8050C4665EB1034BFC3D7CF31B7A4572780B6695BA9ADCF3E2CA633502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708684919, "uuid": "3907c742-cb69-4f5d-ac89-f093a0963a98", "value": "e7ba9cf649be312a3cf12f22936d3f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708684919, "uuid": "d07e8cb3-3fe7-4a16-b515-6b4c937601c2", "value": "98304:6GyBQaoyEBKFdxeZj5FsHAqy5mrDs5h4qezM/EfEDrON6k85Dfaj3LvVf:6GrbyEBKeZtFsgusrez26EvPkyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708684919, "uuid": "f308dfa7-aae0-4274-b12f-01d9f8fed806", "value": 6301696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708684919, "uuid": "3a8cc7b1-0b1e-45b3-9e28-84936e718986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708684919, "uuid": "47cc739a-fde7-43ff-86fc-6066c774d492", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf2a949-d220-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708674854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674854, "uuid": "030d6874-48fb-4531-b2db-9227ac88cdc2", "comment": "Malware payload (Mirai)", "value": "113c11fc253f5c3af6caf64939866982", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674854, "uuid": "e7c929f7-b33e-4f6e-85c1-d46dd356a7ca", "comment": "Malware payload (Mirai)", "value": "284e1156a60287ec407401df00e23d551d453c442e92a442d99916881d54e769", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674854, "uuid": "59352c68-450f-4792-8de0-f208282ac514", "comment": "Malware payload (Mirai)", "value": "f2c470264a633afb0f0150e96c9322d1c80139c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674854, "uuid": "de65a464-775a-4e4b-8ef4-71023d4d48e6", "comment": "Malware payload (Mirai)", "value": "20d742b7b2ec664257aca6907805228bb85fe64a71133652b36fa507d927b6489ec6ef7428e0c65addd4c2dc975560ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674854, "uuid": "4d2dc8c7-bc2d-4e3d-a84c-b752feb12ec3", "value": "T17A21EF0DF7457D4FDDAB2578182B02277020765AE4138513E7668E3F7E7F5D4121A18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674854, "uuid": "75e08b8e-c682-4efd-8c04-85f7c3ec0bd0", "value": "24:3MdSAa8DzSWPpbP78Pwy74+CinTH3YjhH59D8ECAfG0iox9tdysNT137V:ESApP3hb/mRTIjhZd8DAfGorNhLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674854, "uuid": "91c1ef35-47dc-43cf-8aef-29c27e8646d0", "value": 1240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674854, "uuid": "99677a9b-da73-4985-a873-1a0494615225", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674854, "uuid": "71553f2b-35df-4d44-87cb-d2197ce9a476", "value": "113c11fc253f5c3af6caf64939866982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfddb8ff-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708708843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708843, "uuid": "09ab97f8-68b9-4c3c-9d0e-73c264c36d1c", "comment": "Malware payload (Mirai)", "value": "8f70e79d74b225f64dfb4c216d2fa8ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708843, "uuid": "07436cb6-e6ba-4cf3-b743-9783ddb949c0", "comment": "Malware payload (Mirai)", "value": "29014d17a6b436fceaae2b8d985919bf9aeece45ecefaebb56a72643f19750d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708843, "uuid": "e21a38ee-092b-447a-9b26-a04e41787c21", "comment": "Malware payload (Mirai)", "value": "7816970020c7ea3b47cceb6c0e96dadf8150d830", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708843, "uuid": "084d31aa-d981-4c76-b73f-151df3dc0f5c", "comment": "Malware payload (Mirai)", "value": "4d269a11d2a7fc910441678ecfff1cfe8c3e5bffab7c26f6b501fff8ca6322b40c55ada1bfee8707a2facb1a22756e23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708843, "uuid": "d7c466df-c744-4773-8e9d-1193f7d7f17d", "value": "T189130274489CFD3081F17BBAE1ACCBB796785A60C0EAD1306201F5ECD5C71CA456A52F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708843, "uuid": "6306c84f-979e-431a-a28a-92a4755177a9", "value": "768:0PnVQ5eRevMAhw0BxiDi0jkBRREaUt1bzwwUs3UozRhiUSut:Cn+5eRevMA93rRTRYt1wwxzRwut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708843, "uuid": "5cc6dafc-5b96-41f8-9f83-55066cb21b8e", "value": 44668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708843, "uuid": "2ea323bc-76ba-422c-85dd-8e91d2b9078a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708843, "uuid": "a7ef4e37-b38c-44b1-b401-54bdbc31d6a1", "value": "8f70e79d74b225f64dfb4c216d2fa8ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9df381-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708705749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705749, "uuid": "cce43282-5b1e-4dbf-9163-6d4f1dc34ac0", "comment": "Malware payload (Mirai)", "value": "84c1843a76ffedce66a77187a6db416d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705749, "uuid": "f2b5c5dd-ce66-4bc8-93fb-026e2b075bb9", "comment": "Malware payload (Mirai)", "value": "295f75a0a6d5c26b9414f82a4e8c8088f8b81a9995852b75dbc423a197c99f76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705749, "uuid": "e1109a35-ab97-4199-96c4-cf499d9d908d", "comment": "Malware payload (Mirai)", "value": "2960cd03e77431d93729b582b85ab3d21481a641", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705749, "uuid": "a8e2ffda-640e-4626-b378-8afdd94a35f0", "comment": "Malware payload (Mirai)", "value": "e1f5cb59ce69a1000f5ed4bf00c0c4b6c117929d1b512635fc2673588ea764bf8d71c94e478ff233d359e4003530e62a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705749, "uuid": "9f9fa785-087b-4516-9fa2-964940bd6ebb", "value": "T126C36C73D8656F98C651D170B0B08F792BA3A58081875FBE29B7C2B58083DDDF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705749, "uuid": "9231960f-106d-4cc4-b224-33832dcf19c1", "value": "1536:iaqtiLPyHAnKRvvPyUgn+oWaKnC2KpvU5anpIJtnZWBmXHJl26hNzS:i4zy172WDnoprpIzZWkXHG6/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705749, "uuid": "837bb184-e48e-4a8e-af94-20f5f0829bfb", "value": 129920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705749, "uuid": "4e133190-714e-44ce-9ad3-ca0613b39e8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705749, "uuid": "c31c9cf4-b2a2-4d14-aa88-85359c7a2cc1", "value": "84c1843a76ffedce66a77187a6db416d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab06b586-d260-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708702312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702312, "uuid": "976d62b7-d37f-4cab-93d3-975c9965f30a", "comment": "Malware payload (Moobot)", "value": "42857f81292a4f84dd78a65fd864e04a", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702312, "uuid": "74d34ef7-c53f-4ee1-acd1-a9b3df54ba7d", "comment": "Malware payload (Moobot)", "value": "2968c577167aeef5c0bc9659c62809dfa35b11f8200e5339ddb30bae9a5e3771", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702312, "uuid": "6b6b1ef9-2f90-4a13-8316-3dd9dc1c7cd6", "comment": "Malware payload (Moobot)", "value": "726a99f125b76ecc74d252d723daef47b6ffd570", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702312, "uuid": "21fc1f36-cd5a-4fd2-a424-bdcf5b890d63", "comment": "Malware payload (Moobot)", "value": "b1336e16658635ee5b2d80c7a3424c9de954678159061ccb2b8b77d707b7fa6ead70a719ef87a7ae020a8ecf36a02d52", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702312, "uuid": "b1b2856e-80c4-4d54-b03a-b38c3b84d8fb", "value": "T12873F856B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702312, "uuid": "995e88db-7cc1-4691-9ad6-1ef1f9abad5a", "value": "1536:Kln25xPBXk1wnnkL7+eEo07RYs02aDN0XIbiZN0svHTGsV5GYIyh:HxpXCMkA7BfawN0svHqsVERE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702312, "uuid": "d1fa4140-14d9-4f78-a18a-ac6d6ff4105a", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702312, "uuid": "7c6550e0-43da-44bf-bf08-61a054acae93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702312, "uuid": "8cd21c9f-2600-4771-816c-f5fe5b841668", "value": "arm6-20240223-1531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45827b3-d220-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1708674866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674866, "uuid": "2297bae2-3755-4fe0-82ea-26423365dd96", "comment": "Malware payload (Amadey)", "value": "6b50af3a5002a62b4a8e79b2156651d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674866, "uuid": "2cc3844e-35bc-45d8-9d47-86a913bfe33e", "comment": "Malware payload (Amadey)", "value": "2976321f9099212f38d9b6f616126248180c4ecfca62fbfc66a3a26de0bdb946", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674866, "uuid": "37e58e1d-f129-453f-afda-771451b44ad6", "comment": "Malware payload (Amadey)", "value": "3b797c84d042fcb4011a14d100510f8ebe36089e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674866, "uuid": "a80bc343-6bd4-44b4-ba7a-6856b3a69fad", "comment": "Malware payload (Amadey)", "value": "cb081d53bc798f81acf79b8744ffcae352d5f804fba9768bfee6a0f89f72822991dede9fbd6bd7b64b47308329d146ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674866, "uuid": "0cec0679-8be3-4ec6-897c-8908cc6b42e4", "value": "T148B35B217591C472D6AD0A791874ABB1CB3EB810DF745DEB37940A7AAE342C29F30D36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674866, "uuid": "ac1a4a84-9f7d-43d4-89c5-d3355c1de066", "value": "61d6334c6ae4948c906d9fa7fdf019fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674866, "uuid": "c3aadc31-3c16-4653-be8d-2cd848b9b21a", "value": "3072:MXuSD+ZwruS0bGguZRtCsS9J/QJIegRQod4l:UuTiabzuZRUBXlD4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674866, "uuid": "101b02fc-862b-4057-a723-0c257f4cdfda", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674866, "uuid": "71835c6c-a547-45c8-b16b-e240358945a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674866, "uuid": "760d49bf-799b-44a9-ab94-8bba306bb7ee", "value": "6b50af3a5002a62b4a8e79b2156651d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7085c0a5-d287-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708718964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708718964, "uuid": "abe9f5e2-306c-4314-adcf-e1f9e5565aa2", "comment": "Malware payload", "value": "73f69cf667670634d5e76e4a880a8d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708718964, "uuid": "4f796813-b068-4bcd-9c18-b091141e52b3", "comment": "Malware payload", "value": "2adb4934d8f9333b0e5ab20c06afa5d83e5e477f09df978effcd362074b4d0b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708718964, "uuid": "59deaa39-a2c6-45d2-8b56-1c7ad2898c1b", "comment": "Malware payload", "value": "6ac8342ae2463ab979ac22d564ee508bc6f40240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708718964, "uuid": "ed4e7360-8bb8-40f6-80c5-e59494b3d4f0", "comment": "Malware payload", "value": "b5c4ab9057313b4811388239e465b69b55f1434ad0e4f7e8b0d93ab996b05f4e46f2d857f6736d68d0d312ebf91a488b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708718964, "uuid": "ed93f991-e441-42d6-b271-85461d132536", "value": "T1F954BF9366A1BC71DB6647718D2EC6F83AEEF921CE59632B32295F2F44701B1C223711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708718964, "uuid": "2138d8d5-5e8c-4683-affe-b94f4c8b1827", "value": "8a2d974d23031a4e8b7d19d4cbed4814", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708718964, "uuid": "52818b7b-f44a-4518-80ee-a61106d8106e", "value": "3072:aEWlDIX2EmU3WDRciGGCOqHslNn1YKny4rOWN7vDbKGIdPxIX3Iv2+57iTCejVf4:iEOdezE1TnX6UDEPxI2iTCep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708718964, "uuid": "b70c7dd5-cf32-45ae-92a5-f5f8f5c57d6d", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708718964, "uuid": "3c92172f-f2c1-4583-95b6-6b71cae4cb9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708718964, "uuid": "28285e7b-97de-498b-9efb-02b7f309976e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95afb99a-d247-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708691539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691539, "uuid": "5f3a3437-ba87-4b80-92c5-85b7255c59bb", "comment": "Malware payload (AgentTesla)", "value": "81c99218c97c247ec966c9af86280b8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691539, "uuid": "bd27acec-54df-45aa-9448-fbe67598f34f", "comment": "Malware payload (AgentTesla)", "value": "2bb44dfe2f7b114241a1878adf3e515a06be878052e09b366fd3e83efb59ced6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691539, "uuid": "3320b516-3ac6-470a-b805-42b744b10087", "comment": "Malware payload (AgentTesla)", "value": "620374a403c7a762e7fdc3cdfb6c2017f4990efb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691539, "uuid": "a8abe06f-e225-42a3-9145-1b414ab23df9", "comment": "Malware payload (AgentTesla)", "value": "b260f20a3a6cfcdf8c0afeed953760dd539cced5d3bec055b354f16e30863b37acffe1a159f67ea5987285b0102856ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691539, "uuid": "a68cb2cf-c407-4edc-8e0d-6b2b3159e9f4", "value": "T14234FE037E88EB15E5A83E3782EF6C2413B2B0C71633C60B6F49AF6518516526D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691539, "uuid": "de47b8db-276a-4ffb-833b-068eff3be204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691539, "uuid": "35b4a609-8936-45bd-a2be-dacfba1e7831", "value": "3072:FimyuyG5gxzbMTbI0YuBEuPWqbs5fgNv20z:FimyuyG5gJb4bI0Y+EtEZvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708691539, "uuid": "279f22cf-f56f-4284-8658-c1d246070d3c", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708691539, "uuid": "5bca31c0-0bcc-423d-87aa-6ddeea9326d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691539, "uuid": "68dd111d-3800-4aaa-a758-ee730e7e84af", "value": "factra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac799fc2-d26c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708707468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708707468, "uuid": "93dea84c-e06b-4d15-95d0-f8a43c7808f0", "comment": "Malware payload", "value": "5a00d26fb5a91ed9aaa18b63a855ae86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708707468, "uuid": "4cf480f2-c05a-4c82-9944-c9ee1775e127", "comment": "Malware payload", "value": "2c70eaecc9c8ee5084aae91a55116e11c57d63bcbc539392cc764b8580d1e5b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708707468, "uuid": "6a7ca957-b26e-4ae9-bac3-dbdfd18775e2", "comment": "Malware payload", "value": "99e15f5c635f20f6423af6d4d9ddaea8ce5fbe68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708707468, "uuid": "5f0a2344-d662-4b50-aee2-72ee9d4ced94", "comment": "Malware payload", "value": "f6a56ae54bbfef95e5dcc2ac18ab90e0b18a14e104b2fe13dcc1f40d5c65b8b1ae9f11aa96eadd14dca74fd9785a2305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708707468, "uuid": "4c7794df-3958-47a3-a560-840053694d65", "value": "T1C2C3C5FD6C456034C2F7417445F26D26E2286A8C9FC97112333CB6EEABBB8585643B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708707468, "uuid": "1fa0ef2a-5110-4593-9c5f-b3d1239979f7", "value": "3072:9fk29dliNETddwY0JwsR4TbswYqkX5bEdGDOjESHhddJWjjY/ffIg0ju2UBs5CqS:9F9dXHqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708707468, "uuid": "c95bc40a-b887-49a1-bd89-70bfdf1da92b", "value": 121192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708707468, "uuid": "60f7f7cc-f5eb-4f21-953c-ac5701506b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708707468, "uuid": "b5ae6623-1af0-43d5-b0ef-9bc2c3c946fe", "value": "BloxStrap-v2.5.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dfd41b4-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1708705216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705216, "uuid": "e5480894-0035-4469-9c2d-832030359471", "comment": "Malware payload (RemcosRAT)", "value": "a20c0b5c93cf0879718ef989218cedb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705216, "uuid": "71a89363-642e-480c-a10f-55c91036cc1f", "comment": "Malware payload (RemcosRAT)", "value": "2d557010ee25ae325ccf46c7c7f49ea759e863f84cfa6726accca87d492717c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705216, "uuid": "94600704-571d-48e0-96a4-90343932ce88", "comment": "Malware payload (RemcosRAT)", "value": "04506a61d55e6dab295588df637a64d3a5175d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705216, "uuid": "867dfd1c-619a-4466-8a77-0b7b73687180", "comment": "Malware payload (RemcosRAT)", "value": "2168c1aec3ecc3158765d4e3de3ded0b747d522e523ecf7cf4c80ba9fd7e3240cc3d617841c23559a499a20c7dbd634f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705216, "uuid": "26e1a9de-8609-48e6-a95f-d95d3b4a61cf", "value": "T117937CEC5AF84A26D1AD877DC1B250209B369A027303F35D5F82A0EB1D633878653DE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705216, "uuid": "9719f22c-d8ed-4e98-b434-2d372e4302da", "value": "1536:SytXF8TRtLnapEBGsLsjKOICCGpM3NN1RcrvzkaqPH4ojAvcR1a33jyAzfic5+4I:SytXidtLnapCYjs9vRwzkbHjAvH3xfiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705216, "uuid": "c68f660b-0df6-4037-a798-ec78d3793890", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705216, "uuid": "de55185c-c016-487d-a6eb-6f05cf82f636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705216, "uuid": "67312497-c724-413b-b615-b416de7186e2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43df4e7-d1eb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708652157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708652157, "uuid": "fbf8c327-06e2-4878-81cb-482b1faea1b0", "comment": "Malware payload", "value": "228c9f1f5b3f533e806bd8f9cf83d856", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708652157, "uuid": "f545f4b1-a9d7-4c0f-89f5-199dee62668a", "comment": "Malware payload", "value": "316b9aa593ed9b6be6eebc3471d77c46ffcfed771d32679b85dd93abcd947bb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708652157, "uuid": "c8cc28f9-47b7-4fe3-966c-961040d27a18", "comment": "Malware payload", "value": "7aea494036764ae9d3cdca795d4ae683c536ff67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708652157, "uuid": "4606129f-1fa5-4868-bd40-37f04acf07ee", "comment": "Malware payload", "value": "5a102d2e4fd4aaa0333a66946a4dfb2ebff04b4239dba655e9d599892ae253396c66556edb78e5d36553f8c79a9fa615", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708652157, "uuid": "58316b08-c198-43a2-942f-584f51e82647", "value": "T1FF5502B1BB98832DE976F7B7911BA4F4D6162C27F8E04F2D5615B281C7B26D2034C4CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708652157, "uuid": "612f0981-86ab-4039-89d2-0b1d75ac9365", "value": "ee44418bd9d64d1e6e948095be00f0ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708652157, "uuid": "048c8bb6-3342-4ede-824f-a8eb035d63c4", "value": "24576:gr1LBay955+3KQtWdBrO3RXiOY4dg5viYLkANdS50YYVuTz2qq2rxogrA3O:gtBFY3KtBYR9YMg5viYL9Ndw3YVezq2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708652157, "uuid": "f4150c6e-91b3-42ff-9bd1-e05690495732", "value": 1281032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708652157, "uuid": "8e8a21e3-890e-4ee0-b75f-ada151466d9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708652157, "uuid": "ad0e8187-fce2-4577-8486-4e6521bb2b88", "value": "SecuriteInfo.com.Trojan.DownLoader27.28375.18704.16604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a15c919-d235-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708683600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683600, "uuid": "1d11154f-a123-46bd-aca3-728a638cfe15", "comment": "Malware payload (Mirai)", "value": "104924f229f348094552de0d5a881105", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683600, "uuid": "09c0eba5-b0d1-46ef-b5e8-ab07d690cca7", "comment": "Malware payload (Mirai)", "value": "320cb75f840c678694d2a844d6011f55ba51fa776b682d4fa85df91e618e225f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683600, "uuid": "24171ac2-2443-46fc-bc90-264f92cba463", "comment": "Malware payload (Mirai)", "value": "f6db94e27a08ab1b2c007e91407d571ebc50180c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683600, "uuid": "69b5b8c1-df56-407f-9063-9a3710d7833f", "comment": "Malware payload (Mirai)", "value": "ed1d5ebbc88fc3e52e33e6c1a9cf849f8ccca6db44ce45eef916d9808232cdc73250d963dd8f96bf8f3819d9d9881216", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683600, "uuid": "59d420ca-16db-498e-888a-c8de301db939", "value": "T1B73309782556F6ACEDE1007DF44320F5299309183ADCE3D3A0835536EFB9B8C7969E29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683600, "uuid": "9d7de4d5-a263-4254-8cf7-484275cf73be", "value": "768:gTxkc7WfI+UhS7S64F1ftmhVWDvKAROYaO7Pb0BCq4pwN+g:qSOHF1iWTKcOYaO7oBCe+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683600, "uuid": "87cdab7b-0af2-4b34-a94a-784c0e1fc0a7", "value": 51436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683600, "uuid": "1731561f-179f-42e8-9da0-0a95964d219f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683600, "uuid": "394d5347-9ac4-4f39-b99b-eb3f31aa6af9", "value": "104924f229f348094552de0d5a881105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d40afb8-d24f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708694799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694799, "uuid": "3b9eab67-dd91-436f-b204-8f6eaf8bf510", "comment": "Malware payload (AgentTesla)", "value": "26c95e5acba77d7fd14d109c94f75cca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694799, "uuid": "1b4e6cff-b3e4-4e2e-be8d-13293889810e", "comment": "Malware payload (AgentTesla)", "value": "32272f676a500007b4321f7c076ec3169305615e230dad3d89c63e0cfd24c1c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694799, "uuid": "de705ec3-d4df-45e3-8c45-2dd6bb9d655e", "comment": "Malware payload (AgentTesla)", "value": "56359d96cd63d66b51eb49acd46d8df25f170c30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694799, "uuid": "ed718c6c-6691-4de5-8a8f-bd18f31228e8", "comment": "Malware payload (AgentTesla)", "value": "05e42169f99c289c6e23f033ae6877e781d108b45ffc99f5eec9a5f26bae7244d15c710ca87d34069dad55fc2ffa7861", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694799, "uuid": "1ef52377-ba01-4bcd-baab-d4c91d139e04", "value": "T17F038D11E7ECC63FEDBF53B9A87110125331E756A242EB4D9E49C29D2857BC40362BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694799, "uuid": "3e6f0929-b974-4c9a-bd4c-b2e95eebf1c9", "value": "768:1pc7ngE+7L+Phy83dWrz7lwHZjl7GdoUNIBBv5r:1Aj+7100rz7lwHj7QSBvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708694799, "uuid": "e616ee5e-4548-4312-9156-ab1417d49a9e", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708694799, "uuid": "a17c6fe8-613a-4dcb-98d7-19b8e24e00a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694799, "uuid": "0319f8f4-a6c2-4d44-a401-1f6f7ac3d404", "value": "SecuriteInfo.com.Win64.TrojanX-gen.24429.31258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbd3133-d1e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708647822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708647822, "uuid": "134d7498-5d29-41ff-997d-3c9adf86a72d", "comment": "Malware payload", "value": "7c637b2dc8bfb1b47256869530bf4f36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708647822, "uuid": "5a043c7f-a7ee-4e7a-ba59-9508f129ecbf", "comment": "Malware payload", "value": "34fef7573e20414e547ce51dea187fe8641f37bc49b650b14dc6d4c882231efe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708647822, "uuid": "da6b9cf5-336f-4273-87a6-441c912f4a82", "comment": "Malware payload", "value": "0cfd09a2d8031acca13404cd5f076dcc9d412e7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708647822, "uuid": "b4dacad6-dc92-4666-b044-76e4e43ce3eb", "comment": "Malware payload", "value": "9e0d4405b72d988919021b2b6f5b5d110392ac109ccff40657f66af56672b75b19671a1713e633c50740a28637f54e07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708647822, "uuid": "55c72586-256b-411a-8160-4b25c45fbb16", "value": "T1D4766A076E28D71EC625123448B2CB9067267C4A85D7A517B389F31EB8F21BC1E6EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708647822, "uuid": "52940044-8a65-445f-a7cd-47210a357e00", "value": "98304:CjydqP/NDaZubonlK6cSKLYFsKOMHmWLR04m8:C5nNOMn9LYFsNMXRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708647822, "uuid": "fe75503b-29af-4ef1-bce4-1f704187b5b0", "value": 7199368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708647822, "uuid": "53b6bd07-49d6-44d7-a236-092ad8dc2e4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708647822, "uuid": "250ea57a-f3e2-4c1f-81e9-55db3b960542", "value": "SecuriteInfo.com.ELF.FloodAndMine-A.25701.25351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2e128a-d214-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708669561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708669561, "uuid": "ca977ab9-87ed-4988-8322-8781fc8019f0", "comment": "Malware payload", "value": "77a0b04107e006de491bf9477ab4e538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708669561, "uuid": "d0a4977e-8db1-4cea-9946-9305cab8cb98", "comment": "Malware payload", "value": "3527ea0bfa89232a390ebea95392deaa67b7cf1dfcc54e1d8c9f5c759b428ac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708669561, "uuid": "9821f56b-f791-468e-a771-7556ec7da350", "comment": "Malware payload", "value": "a2f56969e84a46d1b899db6867642d263b28a6c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708669561, "uuid": "e183e3ad-7ef3-46d1-b1af-252f05908fea", "comment": "Malware payload", "value": "c9c17ec2a524f05a93727b656d8453a34df64eee6951738f67b439eea65666fe8b93196a8d7e867d352794e49b733da0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708669561, "uuid": "81dff1be-2d4b-4450-b3f1-32aa26d36b8b", "value": "T13A542A90F692FDBAE9598FBD14F11309429EE2C0E71DEB333960FD2C0159A5C46B364A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708669561, "uuid": "66a39505-09df-4b99-a841-3f1b11ec5821", "value": "33a9be00a2231089f919a83a51a7a879", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708669561, "uuid": "cfbf4051-973f-4fd7-a6a5-bae99d61ede8", "value": "6144:Wlqq8k/1MW1WqEImz3/Ws6Jact2yXivWqMCTVtS:wFq3HrLuj49feuTvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708669561, "uuid": "e6ae19a6-0717-4ef5-8389-dca1ef4f6584", "value": 289470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708669561, "uuid": "3763cd2e-69fe-4cbb-9f0c-228c6722c0e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708669561, "uuid": "a6e1b482-1f77-488d-be14-a31261a0f9bf", "value": "SecuriteInfo.com.FileRepMalware.14838.29703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97210133-d247-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708691541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691541, "uuid": "b8826780-7ddf-4691-b324-293c0589fb2e", "comment": "Malware payload", "value": "0fcde60cf63faf96a06cc5a29544bce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691541, "uuid": "b00d175c-14ba-4efe-ad34-9cfe85b8d589", "comment": "Malware payload", "value": "35fb95b21588b5070aa220085f80783ab85db4469b099cab14f6aef25d22b5af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691541, "uuid": "774a8218-0de0-47f2-b6f9-4662b805f3cc", "comment": "Malware payload", "value": "64acba6b955699c93780ff57c993b5f4bcb70db6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691541, "uuid": "d7c09797-8221-41bf-89f5-80b2fa8860c2", "comment": "Malware payload", "value": "edbaac64840c346f6ac20a8429c859d445f44706ee7192ecb99a74f60ab86d0e5918175f11e2c7f34a746acbda3cdfbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691541, "uuid": "165daf5b-95b0-49f1-a5d2-5581d09ae88e", "value": "T1DCA37B0633D400F9D5679278C9F69915E3B2B8131B36878F2728866B1F337815E2EB72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691541, "uuid": "4d146048-8c8b-44b8-af0e-1c2d90b5c877", "value": "6aae2dfaacb262a36d793fde41a53f4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691541, "uuid": "d7c92bda-e8f3-418b-a172-ed0a5a306cdf", "value": "3072:0gIiFwjetEDTi+T5Gbuqc+M8ThCuI0mljJJ9:nrEDTbT5/qM8TfmjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708691541, "uuid": "443c5a8a-9e93-4605-9502-51844947f9c2", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708691541, "uuid": "636c5cc3-f5b6-45b0-ba3e-27ac84520976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691541, "uuid": "a72750fd-670e-4977-b061-93ccf7305fe6", "value": "mapid64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e75e3e8-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677702, "uuid": "e7845ce6-f498-4da7-95d6-e9d8a2f1a51b", "comment": "Malware payload (Mirai)", "value": "789e20170a716cec0951b18c4c4712ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677702, "uuid": "7e295e13-f09f-40a5-a982-3f9ce56187f7", "comment": "Malware payload (Mirai)", "value": "3640f63dfa371c23c0bd8440835851189c09ab78192dec374d6f60f8bb9c92d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677702, "uuid": "2e4df7bb-f9a1-4414-a9a1-7b8226ee77ab", "comment": "Malware payload (Mirai)", "value": "ef298c6756d6becf10919a7693f23c5b8c49c01e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677702, "uuid": "ccf9a9a9-6d6c-434e-8115-240a92e0121a", "comment": "Malware payload (Mirai)", "value": "05fe1ea976e5c9397080e3c834074a6caa722376559e6d837f34680555f02eab73dfbbdb30ef9331498b78aa7fa7d375", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677702, "uuid": "5a4f5c47-7e30-492d-87dc-7823b0939ba8", "value": "T1E8533A45FC805623C6D1227AF66E028D3B2653E8E2EE72139D265F203B9792B0D77E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677702, "uuid": "92888b2d-068d-4c8d-bb1f-a142238652f8", "value": "1536:IdHBd4yvXYe7WvaZq2dQeApnEUmecgYQ7:IdwLxgQe7neP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677702, "uuid": "1b971ff6-db7e-47da-b079-c9fa71bd2fee", "value": 62876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677702, "uuid": "9bdb60dd-c90a-426e-aa1d-83d91eed4b49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677702, "uuid": "1068d87d-0c47-4cf0-9ef7-a0c0b42bbc7c", "value": "789e20170a716cec0951b18c4c4712ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3dedbe-d1f3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (TinyNuke)", "timestamp": 1708655338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655338, "uuid": "8dd28936-7ca9-432d-b74a-0c56bc47b881", "comment": "Malware payload (TinyNuke)", "value": "7314ce4f542fa257cd2e29ea3c69816a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655338, "uuid": "114d259a-925f-4c9c-93ed-06212af20509", "comment": "Malware payload (TinyNuke)", "value": "366b0435558c80475ffb353570635ff4b6782732afaf39a84b57332c4b80d9c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655338, "uuid": "53e539f2-ed1d-4dad-b2b6-3d0897dbf4cf", "comment": "Malware payload (TinyNuke)", "value": "4f358623c8ad3b0a76a9b37a9a62f5dcc6048a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655338, "uuid": "bfc2c44a-8412-4829-8fd3-94a0f9aae03f", "comment": "Malware payload (TinyNuke)", "value": "2178d702bbd824f957f1512cecf81b1019b5b5d125c715cd512bf09f582f0670c8dfcaf33c63d3407859c64c84cc6a28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655338, "uuid": "d5d214ed-0a57-42b5-a519-2364ca33b326", "value": "T13646336BBE5A4074F05EFA715C218657CB35FC3123228CE921463D2B0A339A7D726E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655338, "uuid": "79a21bbb-3e69-421a-ac5b-a2269fbe0bb8", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655338, "uuid": "b394088a-4de6-4654-ae09-5ee80d139aa1", "value": "98304:c55UP/tfc3URaB6DsU7bKr4T8z8ua9uRKBuohztNcqRG87tMNicZKD:H9fc3/B6DsEurroudsgopt1G8AwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708655338, "uuid": "8fb02643-ecc0-4847-ab44-44fcf0103ef7", "value": 5424267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708655338, "uuid": "c1fccdae-3205-49d6-88fb-9013971a81ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655338, "uuid": "bb62f6f3-a33a-4cc3-8dff-851709b9da6d", "value": "SecuriteInfo.com.Trojan.DownLoader30.28195.3108.3748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9457d8-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708708785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708785, "uuid": "14e7ce0a-9f35-469a-b260-57d285b0aea1", "comment": "Malware payload (Mirai)", "value": "16be037beaaba116ce6da6ebd64a425d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708785, "uuid": "65f0d8b2-2b85-4dbd-bbb2-b1786ff35e17", "comment": "Malware payload (Mirai)", "value": "374ecd9df82fc2f0b10ff45d7fef400751ce90c9a32527b33712401657cb433e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708785, "uuid": "a8e0b930-4cf3-457e-bf22-ad734c97179d", "comment": "Malware payload (Mirai)", "value": "cbfa71670f08b4e7a512a6de9c96a4eb403aec2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708785, "uuid": "cd802b15-bf62-4300-9633-d52c6f901c8d", "comment": "Malware payload (Mirai)", "value": "4e7761f23dd7aa546ea322750f2097f79ca5f3115c5abc2328ef52352f138bb5da970f7ef964fabf9b2d9fa68543d20e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708785, "uuid": "6fb6b6ad-686f-45fd-8603-ae31c7bd4dc2", "value": "T1C513F2978DB4E542EBC4407E49EEAC1F9C18511AB80AC5E6C9C031B29C67BBE6574718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708785, "uuid": "2d455941-d3d7-406c-a7d5-cc757ae81563", "value": "768:bh9I5TVubpyhDXh8JaCbzUy201JLKOALEPOQz0UnbcuyD7UGQRjCDvCnGMG:bsT2pYDXhKaRO1OKnouy8GyeGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708785, "uuid": "b44461b2-e25d-4e32-a77e-28958eb2e0e8", "value": 41896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708785, "uuid": "da6f3fa4-f0b5-4b67-b4c3-356d9164446c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708785, "uuid": "a70d8a8a-62af-47d0-9511-c3fe8edae982", "value": "16be037beaaba116ce6da6ebd64a425d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50ba091-d1eb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708652158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708652158, "uuid": "c67aff85-6163-4465-9e05-337c678c4c7e", "comment": "Malware payload", "value": "1886d0a15a497b684af19e3567a21927", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708652158, "uuid": "24e7afff-7d6f-4f9d-9bcc-6a17567d55e8", "comment": "Malware payload", "value": "37687cf94aa6a6b66538f825df373c581f20606b635bb6440a7294d41cc2724f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708652158, "uuid": "32dafb82-0500-457d-a814-b0f08a26abf4", "comment": "Malware payload", "value": "8c4b0f9e33ec0a06b2a71eaff93fc6c51023018c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708652158, "uuid": "2df74ed2-335d-41c3-998f-2fc40ac9f12a", "comment": "Malware payload", "value": "0d13f05e87ce718bd5b33b600c93faa1ede311c5253e51f0ea7cc0d72a7080f6d0dfccecc635ab6bc044270005ec7fef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708652158, "uuid": "c34b1770-1808-4c38-b854-b206dff612a9", "value": "T175E30D617D8B1826315F12CF6007274C60CBDFF9EA62E5E5F5F39120A2B9CD03BA25A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708652158, "uuid": "2bd362d4-a02b-4e6a-81ed-2bcb660241e4", "value": "3072:pwdOlMCaG35T+upGM+oxhy48LnUcmlPGxFGOHr:piOlMCaG35T+upGM+oxhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708652158, "uuid": "87eb6789-821e-4d35-bd11-dea1fe33196a", "value": 153084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708652158, "uuid": "b3da273b-221b-43f5-b0f3-7ccf6e42661b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708652158, "uuid": "b4c6d2ee-df31-4d90-b3dc-95c74dbe4c36", "value": "SecuriteInfo.com.Linux.Siggen.4218.29404.12355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f300de-d20c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708666326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666326, "uuid": "31486d1b-1562-4f96-9a70-8fa6297eb042", "comment": "Malware payload (Mirai)", "value": "1ca5f8441589444cd62a4d1c9b99d1f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666326, "uuid": "24fd472a-2c12-4254-a5e0-0ac4ebe74378", "comment": "Malware payload (Mirai)", "value": "388b97a0edc8e24139ca5fa8a95363b6391e83fd56906affd25500ab563a2eb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666326, "uuid": "c093118e-79de-430a-80ee-f6b3e2cc3ce4", "comment": "Malware payload (Mirai)", "value": "ab33f288adfad074dac98751adacd900eaf0419f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666326, "uuid": "1abd17ad-868d-4d02-b513-eba4c05a1e6e", "comment": "Malware payload (Mirai)", "value": "d77e07cfbd7ea16c200e4ff90239ce7d510bc742fb02097011808103b3e430418088574cc4c9b4e73aaa2d04c525caa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666326, "uuid": "7a2a480c-63d6-48ea-9d9e-fbd54b6bbb83", "value": "T1BEA2E11072A32D56F3ED1C3DC96E835BF9A70BFC80B6327639415620C94D24A3E39A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666326, "uuid": "6cc1154e-46c0-4416-a173-515d95a88f44", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjBewhymdGUop5ha:TvQn4j+ZO5fKAlxcws3Uozk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666326, "uuid": "75e57f6d-e37c-4a75-8fcf-6500d6281b3a", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666326, "uuid": "9c382340-6e04-42dd-9a1e-0c2fa0be0873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666326, "uuid": "740da061-972b-48e1-9019-5cc59bd66fcd", "value": "1ca5f8441589444cd62a4d1c9b99d1f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf84288-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1708705347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705347, "uuid": "3b50a185-1b2c-467b-a28a-04443c5cb85a", "comment": "Malware payload (XWorm)", "value": "171cd4c04d1c9a3f45c5e892210d8c95", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705347, "uuid": "f9bcf844-97d9-452c-b39f-d922bc5eef68", "comment": "Malware payload (XWorm)", "value": "3ba52855b804f2ed0d6a11e9848289e82cf3f412f468d46a6a4393e760457de3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705347, "uuid": "b96f6df7-c9ef-40bc-a606-0a5b0298e850", "comment": "Malware payload (XWorm)", "value": "6f2bf7a8ec36c2959af9ddb6321bfca69577173d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705347, "uuid": "856177af-e4e0-4ebf-912a-63c69d0f7c02", "comment": "Malware payload (XWorm)", "value": "911cf9db6ade71fd6f6e1f587922cd4b215f9cf29607633904053329dce72d042b3b01cc96ede2ccbee47c304f212b22", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705347, "uuid": "0de1e785-d584-42a3-9f09-4980b56377d3", "value": "T116F05EA2BBFC9210B37367086539B2A54B27BE65A47CD34C45D0280F0EF0F8498617B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705347, "uuid": "be702c8b-31fb-453a-a6c9-9684a4cc2eda", "value": "12:Q2ma29+FTFa2MlghrwjHha2JoYl1a2S9If8fzE8wNcyXwJ1mN:Q2z00aF6hrwNagoYlYNef8fpwN5wJ1mN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705347, "uuid": "fa504d49-11d1-4202-b9fe-8900e72f018c", "value": 590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705347, "uuid": "c1bd7a76-32f0-44b9-a86f-51548c715863", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705347, "uuid": "aa1e77ab-49f3-41d6-9c3a-8bf127462fb5", "value": "F732V4110.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d340a6a7-d220-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708674892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674892, "uuid": "9c31c8dd-a797-43f4-8376-965a370e8a47", "comment": "Malware payload (Mirai)", "value": "4a4dc3165cba932ee9b8034fd84d0fd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674892, "uuid": "8b0817da-9f46-4d4a-92a1-5e903fed34b8", "comment": "Malware payload (Mirai)", "value": "3d708eee5447a36d85d1cc753e049dc9da9d020442b67254200fd20bb7b20a69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674892, "uuid": "2f9fe60b-9ab9-44f1-a5d7-2fe833d219f9", "comment": "Malware payload (Mirai)", "value": "24f57fc191d6530349f7e43cff82d1ce0a6af4b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674892, "uuid": "3219646f-5e52-4c25-bcb1-df75317a75b5", "comment": "Malware payload (Mirai)", "value": "960e00ce248057b2bde6edd7768dfddb898d3b28e4793d11a5f6d7c9d5e05b9f7f964154f3ab7f68a27f32075b41f7b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674892, "uuid": "f32a689e-a6e0-412d-9e4c-d2d88772b60a", "value": "T1B44102CA5F725EF9F05AD53C87370B3937AA524843C04289E1ACDA101EC530D45DEBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674892, "uuid": "c4a4f645-ee47-4631-b73c-0f88100fac56", "value": "48:Oji5E4GYg2HNAd1EKDD/9LuEpEon3gxeBl:956WHNmNvMEpEs3pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674892, "uuid": "d0d649d2-03dc-4ead-9baa-ddb24c5f74cf", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674892, "uuid": "14700106-5538-45a4-9993-72abc2b38d79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674892, "uuid": "08f00a5e-a33a-4230-b168-3a8981c76958", "value": "4a4dc3165cba932ee9b8034fd84d0fd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0db246-d22e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1708680867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680867, "uuid": "ae3c81c0-94e0-4caa-a004-399df750aef7", "comment": "Malware payload (QuasarRAT)", "value": "83237aab82d0093bf867c131f8f05965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680867, "uuid": "e89d90f8-2b12-4962-997f-f5e52af50fa9", "comment": "Malware payload (QuasarRAT)", "value": "3e7c56cefd2e8e5e388393ff9944bd45a5ba54225a3af66e7336c023d5771c02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680867, "uuid": "965f186a-ec81-4d5d-b72e-1217f5527c8f", "comment": "Malware payload (QuasarRAT)", "value": "b76074588a6fe0b4046e841661bbcb9dc7c24e50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680867, "uuid": "23f29869-c7b0-4a47-b35d-76066edc65a3", "comment": "Malware payload (QuasarRAT)", "value": "ff1b07dfa5e7911c4fc11e91809513743372084c5953eff72db27813380ef8f4a7976effbec11fa962af6ff70d17b08c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680867, "uuid": "1912144f-bf0b-4848-b6c5-026cd8d2c87a", "value": "T13CF57C143BF85E27E1BBE277A5B0401267F0EC5AF363E70B659167BA2C53B409C016A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680867, "uuid": "e389cdce-1604-4c6e-9f94-ebbc9af09f51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680867, "uuid": "f3d3814e-380e-4094-9278-43904e581f76", "value": "98304:Hvf22SsaNYfdPBldt6+dBcjHHVRJ63yp:PQ7jvGyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708680867, "uuid": "987f21a7-dd03-4054-885b-f4f1d5249c9c", "value": 3483136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708680867, "uuid": "0cd385e8-f869-4d1e-af8a-76c811862f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680867, "uuid": "9d44df6f-dbaa-4869-b214-ded79edb9a3a", "value": "malaria.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2beeca60-d24f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708694797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694797, "uuid": "8547520c-3fa9-4f6f-921e-a9704ed0789c", "comment": "Malware payload", "value": "afd5cc256cd0ed7c744fa61b311618e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694797, "uuid": "cca99c99-94b2-4170-94b8-845ac7a9dec7", "comment": "Malware payload", "value": "3f318d77e622734a5f8c58617c1780b434b5959cfc757d27115d4868d81d4785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694797, "uuid": "5a8c7fb9-b274-4217-9688-b092e84b27e0", "comment": "Malware payload", "value": "22bea90ec197df6f336c5f4b629eb31229082947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694797, "uuid": "8c0e1bd8-95e3-4479-9747-cb1a2f73a6e4", "comment": "Malware payload", "value": "40739570a8dbef37d6862abf934c58e036d7b843cc2f85eefdbc4cbe3b868e4fd273725a1d892cc8773f977311475c69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694797, "uuid": "f81adc41-5c71-4a4c-abee-1430fdda18a6", "value": "T1955401264F88C755D2BEB93811B26549F7F86805DB07CF68FFE541D90E5B6820F82A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694797, "uuid": "77f27329-5bc7-4efc-8506-c94ec4b847bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694797, "uuid": "f3c8d851-8c90-479a-864c-eb266829c014", "value": "6144:2Jt3Be5sbJqpzHyH3bRhmBfEqxEBLT9QzkPJ+xx35ofxoxSEK1i:cre5sYpzHSb/OypikR+rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708694797, "uuid": "4b09df67-7997-478c-8805-f8414ab657f4", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708694797, "uuid": "3fc66603-7039-4254-9dc6-d002f9fd1bfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694797, "uuid": "5640e12d-864b-44c2-962f-6089ed1e943c", "value": "SecuriteInfo.com.Trojan.Msil.10764.12254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50893bc-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708708852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708852, "uuid": "bef6ad90-7af1-4de3-b08f-249eb72e4af1", "comment": "Malware payload (Mirai)", "value": "130f291ab110ecfa006c008da46dd4c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708852, "uuid": "7087a376-7330-4dcf-bd7b-cc3312f93ee2", "comment": "Malware payload (Mirai)", "value": "3f6daa2f1683437443397f41f8fd306714c7b42f1cdb62bd76c24160de12d5db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708852, "uuid": "e87016e2-1efe-429d-bd3e-06b795092768", "comment": "Malware payload (Mirai)", "value": "6708576bb2575c5db43d0c40ecff6344e55bbadf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708852, "uuid": "133c5d0c-9d1c-4720-bae1-f590fffaeb21", "comment": "Malware payload (Mirai)", "value": "56313c067c86636e3528e5fe2a1690a9281898c4ac7a211310dd679004a6f03e6e3f8b3715efec7ece1e9f0a7ae749dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708852, "uuid": "c05a0aae-3f17-4f98-aadb-5711b659123b", "value": "T17E13F16665C84472CD559937E97A06EBB19D03EFE6F2F0212B96C37887CF086E430792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708852, "uuid": "fb2981c8-14f2-49a3-a1b2-799fcd0e2ced", "value": "768:/xVVBHh0fpWE/CBACKVXTNHGXsf815nJLxxlV+W73pjaTHRs3Uoz3Gwek1xDrf0v:Zhh0cqC2Cqd83nJLxzV+W73pjaTH8z3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708852, "uuid": "4bd824fb-62d5-4dd3-983c-d39b38703cad", "value": 42376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708852, "uuid": "4b1f5c66-d684-4224-8e15-0309e8757531", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708852, "uuid": "85d75bab-01b9-43a7-a607-d052cb45e68e", "value": "130f291ab110ecfa006c008da46dd4c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be16518f-d20d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708666696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666696, "uuid": "5ae6cc3f-2dcd-43cc-862f-7a6dee907e7f", "comment": "Malware payload (Mirai)", "value": "6eca7b3e7a0f75d26169a7b33dcac6c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666696, "uuid": "5a31b6e4-6b4d-4815-a842-85cd51c29284", "comment": "Malware payload (Mirai)", "value": "40b02307b140ae12d9abaedb575674868c73c48b7f20dc5be4c0671d33d1946d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666696, "uuid": "87f46cf4-e25b-408f-8253-281f9c3d4d1f", "comment": "Malware payload (Mirai)", "value": "a1c83c4ad0e45aeea6ecdcaf3c5ce91ae095bb84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666696, "uuid": "48cfcb08-bd43-4a8d-bc4a-800b23711b5f", "comment": "Malware payload (Mirai)", "value": "aa3503be00c56c342a17ffeb8ba10f32807f593cb7c8ed483b2e1d641b07eeaf3a854266f60c3141e2170e284d4dacb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666696, "uuid": "b072fbe6-5ca4-44f4-bfd9-dfca0adcbb2b", "value": "T14CC2D0E07726FE31C420AC3DE52A4D8A3A510A7C91FF393654558C358FC1A9B67F88E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666696, "uuid": "8bdf880d-53b2-4e20-a1c6-db7c84bbe52d", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwr3k9q3UELuz:OKy4qfqoeJdXWg9L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666696, "uuid": "1db8b658-e6f3-4aa5-9cd7-2b00a64c82c4", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666696, "uuid": "9b622c8d-b8d0-47d5-a488-18f71f1d347f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666696, "uuid": "74d364a7-fda5-4e56-a0c7-7a763960c720", "value": "6eca7b3e7a0f75d26169a7b33dcac6c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba81521-d266-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708704782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704782, "uuid": "594b0db4-800b-44ac-ab51-412cb0ddc55a", "comment": "Malware payload (Mirai)", "value": "5372d1df14ce5400783a6d22e4a50fc5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704782, "uuid": "735e95d8-2b7b-4de5-8e4b-63fc06eb8a37", "comment": "Malware payload (Mirai)", "value": "41950639f9bf25f7d17d8ddd6142a36566290b6701adb0dd630f98338d614eac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704782, "uuid": "0829c0e4-113c-4919-9909-b8385fd66424", "comment": "Malware payload (Mirai)", "value": "f9bdf10ca630dbd398a3819f14f324c47d34b17b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704782, "uuid": "fe203ebf-cf2d-4ac0-93e6-801cbfbd64c6", "comment": "Malware payload (Mirai)", "value": "c27e8787d684034cea75e51277e318866df6dd6d44e2c9290d437faf6a27007d8d4d98eed04f199720865223caa37168", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704782, "uuid": "5b5f0367-9fc2-4b9c-b333-4b9b32e0a0a8", "value": "T1D7E35B0BB5C184FDC4DAC1744B9EB93BDE32F19D1238B16B27D4AA221D5DE205F2EA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704782, "uuid": "c0d30831-d6c0-466c-a2d2-d9c9306aa87b", "value": "3072:tc2jTvefVVkUN1WapK95bXKAvFnDEyc/2EiLPku2H1:tc2jTvefVVkUCivqSH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708704782, "uuid": "290763f1-a9a8-44d2-9d52-a8cc975be919", "value": 152024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708704782, "uuid": "da3a1d79-3fed-474a-bc3c-379e7c151293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704782, "uuid": "e488840b-230e-4e95-94ce-ae1301949fa3", "value": "huhu.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f747ce-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708705360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705360, "uuid": "eebd0c03-7d24-4035-b19b-fd7f7106f6a7", "comment": "Malware payload (Formbook)", "value": "63f6f06c380e5d1ce7325b504b5a27fc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705360, "uuid": "b6c205d6-aebc-41dd-9cfe-fa72e5300bb1", "comment": "Malware payload (Formbook)", "value": "41f76926477c7f8759900567ced4e5e1f9057e40d2a151badc873d23f372997e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705360, "uuid": "a2b614af-0c45-4e54-a7d6-05ab11d584f7", "comment": "Malware payload (Formbook)", "value": "0a64b4f2424ada6c4b8efe421f78ab43f8372bf0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705360, "uuid": "adb8e9d7-05e8-43da-a43f-4590c4bd9005", "comment": "Malware payload (Formbook)", "value": "647ae0e355b98bc29b02257be5cb00d1917395a54cbbefc3ed1c8ed3023eb2fc8d443f5b5693d6e37efe988e41bfb6f1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705360, "uuid": "d34df9b8-4942-44da-9eb8-c9e03184d7f9", "value": "T13531911277E58259F2F75B48973328340B3BBE56593DD14D06D82C4D0EF3A0889A6BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705360, "uuid": "260fb878-a7b8-4142-9d17-c6daf891b5bd", "value": "24:QZHtIH+GN7ngN7nGN7njesYOrAATYawN2QSqjqSTzaZ7e:0IH+G5ssYVCQSqmSTzag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705360, "uuid": "aa03ca2f-b143-489a-b132-3a70a5881c9e", "value": 1450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705360, "uuid": "2e7916ac-780d-414e-8982-e07c15dcc561", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705360, "uuid": "605953ab-c7a3-482c-9ea1-3ba41d1f5f39", "value": "comprobante_swift89534657687.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2debd2d0-d24f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708694800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694800, "uuid": "24941965-e16a-43c9-8200-58e31bb7f7e8", "comment": "Malware payload", "value": "f6d93592a03902d8890efd8916c70839", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694800, "uuid": "c8b53ca5-8d92-458e-8489-a4b2e4908e77", "comment": "Malware payload", "value": "424b55254947a758e37d1dbe0dfedf6c2be02556e7fae13a90b9f1a7517e8033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694800, "uuid": "0a445ca8-84c7-4225-94c0-390499f75997", "comment": "Malware payload", "value": "d2ec72b0fe55666e1da95e83e39be41c6512487b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694800, "uuid": "a349c1df-7185-46a8-90df-419f5fdf112d", "comment": "Malware payload", "value": "3d015a0fdfcbb94219034f7e571aa7ea877de51027e178bdfbfde5258562c91737f382913cf7a27ba4eabb6369c78b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694800, "uuid": "cc81b6cd-e459-459d-99d1-ab2975076568", "value": "T177A36B5175D78062E08E4DBB8053C73A4A63B4B85B273DDF2EF5C9E5861E0E1DB1AB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694800, "uuid": "e92c8458-4457-4fef-823f-d369f180dc3f", "value": "1536:a0DDe+iRcz3xy3vZkhp2MgOFPHTu8GipEBtqWw6FX:7iRcYZ5OfGilZ6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708694800, "uuid": "59e4f5e4-8a5f-493b-9f74-7fa9cd464608", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708694800, "uuid": "ae0dfcc1-878c-4f7d-8c66-8754ccb3bbe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694800, "uuid": "1ce4544c-da16-4de1-9bfb-c64dcb890214", "value": "SecuriteInfo.com.Trojan.KeyLogger.1965.24277.27622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a008f05-d226-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677372, "uuid": "e11bccc1-21a6-485f-821e-19c25303b596", "comment": "Malware payload (Mirai)", "value": "2eadd183292071e32305b1edd687513a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677372, "uuid": "e8501792-11e2-46a1-b37f-83a66210cb4a", "comment": "Malware payload (Mirai)", "value": "43e3c10f7615a1b220e72cafee74e4bb60bd4c25ac31a2355793ef57e29cb149", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677372, "uuid": "65601b78-72e7-4ee1-8d3c-f6b6ebb87481", "comment": "Malware payload (Mirai)", "value": "d79502fc4a26bf21dde17ca03ec7862b8640b03a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677372, "uuid": "adc0dee1-e413-4204-b694-87db7cb66575", "comment": "Malware payload (Mirai)", "value": "841ae3bf33f156241836f10614a4df877de0e91d8134c7619afcbb6ead6e2a27e1d373b7ac02924ed6eb816f3b51be68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677372, "uuid": "f16690f4-e218-4222-9846-f36d27bf6afe", "value": "T1BAE30845FC518B23C6C712BBFB5E428D7B2A1798D3EE72039D216B21378A85B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677372, "uuid": "6ae06362-1806-4501-bba8-ea58ca82294b", "value": "3072:MwGVETBqa5sMFyr4JdPN/Y8ssRCuFmS6v:MwGcqalQr4JZN/YJjomSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677372, "uuid": "ad410f35-f1ae-4df0-89c6-9b2243ee9ea0", "value": 150240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677372, "uuid": "7b081793-099f-46d2-9d24-85d9606e8b91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677372, "uuid": "a996532d-a6f8-4f99-a7ec-cb68fc5ac207", "value": "2eadd183292071e32305b1edd687513a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1c0b5b-d20d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708666689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666689, "uuid": "29dbb30b-94bf-4a0e-8dc3-726a3946c63c", "comment": "Malware payload (Gafgyt)", "value": "c9b6dffa9d4ccb438e307d59d46dc873", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666689, "uuid": "99c920ca-af72-4347-ad11-8ba5f48fdf32", "comment": "Malware payload (Gafgyt)", "value": "44aba77c9c325a18d8dd19010b251ddc1ddda645fa8740c807de9252c5f83228", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666689, "uuid": "757a58e8-5e5f-471f-bc22-f1a34c3bb56a", "comment": "Malware payload (Gafgyt)", "value": "2bae3f94dda8ba80d146adccec410866233a1ba2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666689, "uuid": "85bcbb65-c055-4dbf-8f61-8dd0ff4c938b", "comment": "Malware payload (Gafgyt)", "value": "217ec665bd217aa3544ff11131e3926c58917846da859ff38983805d268250dd0a1664fcf015eb3793e276597a5fa9d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666689, "uuid": "0470d164-77ae-41e1-a1dc-3bdfa72ce5e8", "value": "T10EE34905DB408B17C1E2277AEBDB424933339B54A3DB33099638ABF43FC27995E26516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666689, "uuid": "8f2d53d9-b32e-40c1-aeb1-25aac4581201", "value": "3072:ut8iFDKEfFN+Fa+1sWgh7nI8txVpUMbmQwfCMQiGW:s8iFDLf/+FaNRh7nI8txVp5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666689, "uuid": "2f43c396-9b7b-45fd-9197-19f71b8c0921", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666689, "uuid": "417a338b-f36e-4072-ba06-de98568f45a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666689, "uuid": "6fe40430-20eb-4c49-bc78-d97fd29cc7ba", "value": "c9b6dffa9d4ccb438e307d59d46dc873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c719126-d247-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1708691550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691550, "uuid": "2d34f6db-bf93-4fb5-85fa-c7d79985e6ee", "comment": "Malware payload (Adware.Generic)", "value": "9f5888ba5ae3cb6b5741753cda27aa4d", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691550, "uuid": "c4c6de47-bb33-4677-9e02-e27ca30431d9", "comment": "Malware payload (Adware.Generic)", "value": "450c623e2a9b4215221b0af83fe40a4666e51087f1557691d094ceaa4e889d10", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691550, "uuid": "9452cb5e-b956-4f5c-81e6-df85ef13d281", "comment": "Malware payload (Adware.Generic)", "value": "ea968864a5fbd896146b11473b7a77cd5d785305", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691550, "uuid": "d3b83da7-ec5a-46fd-9be3-452670f02164", "comment": "Malware payload (Adware.Generic)", "value": "74049918b43a401f5ae528f870d268665987cbafa702e8291207e8c92fcafe7fa3a229f0745e517d4746fe69b167dad5", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691550, "uuid": "f170febe-52ff-4d0c-8e2e-5f69ff187fc2", "value": "T15247337FB2AC263FD0AE4E314677931099773A60A42A8C0E57F4584DCF2B5612E3EB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691550, "uuid": "ef8385b8-ce11-455c-babd-1c5d1cd057df", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691550, "uuid": "8892b247-7c81-4fc9-992a-f9a88756ed42", "value": "393216:T3Bz7YbnNtovyZgcezWzQHGIvnYgRwRpF5/LCvpqBiMbnO/RLDK3YKtZUltaT:LJ7YcK+e2GYYgiF5/WOiSO/lKIY6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708691550, "uuid": "8965afa2-051b-4dc3-a2c1-cc36e394eb1b", "value": 24812101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708691550, "uuid": "88d3245c-b048-401c-b2cf-42c549582954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691550, "uuid": "f9bf759c-0837-4e1a-93ed-ac01ca00cdb5", "value": "SecuriteInfo.com.Trojan.WinGo.Agent.32255.15328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8407b9ce-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708705682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705682, "uuid": "438d83bb-00cc-49a0-a28c-cd28b50ee177", "comment": "Malware payload (AgentTesla)", "value": "81060ff4c39e6955c1e4523c759e90fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705682, "uuid": "ceb98198-33a9-4746-a1d7-d06e61db4395", "comment": "Malware payload (AgentTesla)", "value": "453a50aec0b029f077090b41b580119103542b9dae4db4331de2e766c9f5d0b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705682, "uuid": "278bf709-ed29-4c8c-9ec7-d5593f158495", "comment": "Malware payload (AgentTesla)", "value": "d41c1eeb891774cce18ae03ab5d98a11d441c9c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705682, "uuid": "e4d204c5-6643-4aca-8d9c-398d9fb81c3e", "comment": "Malware payload (AgentTesla)", "value": "6378b0863d9395a1a7ba6f2a9f5cce06daff862925589ce5215cf1b0fddfa3dec07cf3a24c3ebb2c3db73ce1ef576f36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705682, "uuid": "db7772dd-74f2-4721-b5d5-9f7309acc1fe", "value": "T17DD42381A05B497ED69A167BABB6400C86FF3D448877ABC9DE6757C90DEA3303C14371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705682, "uuid": "506e1186-6e5a-429f-9919-c624d8883644", "value": "12288:cRnWgCo5hmw9XyDld51WX3Wf0RHqLyPIP4uKYyuAP41QcevU:AFuld5g2f0JQM+lKo4mXOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705682, "uuid": "c9975ace-4521-4e12-81bb-311b80bdc1b9", "value": 636128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705682, "uuid": "62b9822b-a367-477e-abac-6e92111d0da7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705682, "uuid": "e127945e-dfa3-45ac-9563-53a6c3ee19bc", "value": "90971985 DRAFT.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d8c40e-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677736, "uuid": "42cdc14b-48af-4490-a139-dc3fdc7a132e", "comment": "Malware payload (Mirai)", "value": "ecca8aeaeaa7ff8c1de8a1e75bc1137a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677736, "uuid": "9d2bfc78-da4a-4a1c-a3f2-3d38fa572266", "comment": "Malware payload (Mirai)", "value": "456a984571682f9a2d8ac1f2f8e5aab0f4596122e00c1210049903f557724d31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677736, "uuid": "a0a47935-b841-44af-b495-a619f5e976e2", "comment": "Malware payload (Mirai)", "value": "8663c6fa9b7a335b556b50c4f71a0c1df046d231", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677736, "uuid": "65102e34-f079-4b44-8f82-de5fd5829625", "comment": "Malware payload (Mirai)", "value": "44c8c559185792c20c8537825064c075b02184a6aaa7280bf72472d5e67cdfb6a8a5c9aed2c83c59430589e1f9f1702d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677736, "uuid": "47f5d049-96ae-4dc9-8ac6-fde504fda2e2", "value": "T1B614D71AAB620FBBD8AFDD3702E90B0639CC555722A43B363674D528F54A50F4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677736, "uuid": "19aa06fe-a860-4490-9510-8929c74222d0", "value": "3072:cNYW0dDSB56/UfpwwVSfvjJCnVV4H3NnTZFa:cNYWdB568BwmSfrUoHZT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677736, "uuid": "bdb486be-5664-4ce6-afe9-ac37408e17ac", "value": 198684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677736, "uuid": "af230940-2b8e-4417-ba99-f6da5fe9277c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677736, "uuid": "ed411097-36cc-4bc1-a0ac-cc0257e0b2a0", "value": "ecca8aeaeaa7ff8c1de8a1e75bc1137a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b388c722-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1708705333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705333, "uuid": "c184c8f6-cc99-4795-ac41-ba3b62e497ae", "comment": "Malware payload (XWorm)", "value": "76796ad89a5a8b28a9f484cd1e67b707", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705333, "uuid": "1c1ed9cc-93b5-4b08-bc63-708c1f25364a", "comment": "Malware payload (XWorm)", "value": "45a556278ba91cc9b4b9f448ac0744415134833e6e042fe8c473e90f2bace783", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705333, "uuid": "d5df5e2b-1e17-4d87-86fc-a7cccbfa8d7c", "comment": "Malware payload (XWorm)", "value": "76e19946f3fac6c758cf70c3a35045c855b35ec5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705333, "uuid": "9654a117-50db-421c-b5ab-274414691a14", "comment": "Malware payload (XWorm)", "value": "9f5edd6bea5ac7578108f2ebe7af4053775ff179e8e7d040bbc2d2bf37d7aec702287a5d304fba05ff4dd8e024f88233", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705333, "uuid": "23402baa-55b0-4ee1-a4cb-0b01a2532f72", "value": "T1BDF0305396FC4200F1FB6B147E7421EA07B37AAA9D38C20D42900C0E49E1754D9B57FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705333, "uuid": "16ebc20b-0fb7-4e6f-ad9b-f75ab77cfdff", "value": "12:Q270+FTYFlghvlprhHTU7fOlprd0H3AB9If8fjS51Ilpr+TYlO15N:Q270pF6hvH1U7WHd9ef8fjS5iHyYlO1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705333, "uuid": "67ebb2ed-a75a-4355-95cb-01e37cf29a05", "value": 584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705333, "uuid": "3c25632b-66e0-47b8-90b7-f99da7cc9032", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705333, "uuid": "18b1245d-5801-4a15-8e9a-22efa4be7812", "value": "662891928.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb04f3a-d24f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CyberGate)", "timestamp": 1708694803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694803, "uuid": "18988ce2-4c89-401f-8d00-0d85bcf3cf74", "comment": "Malware payload (CyberGate)", "value": "2a5699f8028941834a2f84b2fb7b9f86", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694803, "uuid": "27875d7f-5e4f-4c6b-8b1c-cc842fbaecd5", "comment": "Malware payload (CyberGate)", "value": "4849a87ca8fad6688bd6a58e0d8e2adb6a5964f73f6e75e93e449b2bd20b0be1", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694803, "uuid": "9319cd91-ad21-486e-bfd9-4091a9a1b4f5", "comment": "Malware payload (CyberGate)", "value": "34c12a4281648b29f4a5decca5ed4bc0b88f5cc6", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694803, "uuid": "cfbe4e09-9168-4a6e-9845-797b95db4a73", "comment": "Malware payload (CyberGate)", "value": "c92a8c4c1c08fc0dc43587f35bdf11f2a2bd0af3abd138d37329f0262abca1db93f250914865c2281e80a69d5a7bb220", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694803, "uuid": "216f83f1-3fed-4851-b510-f94c7b69fbfe", "value": "T1AAE42318F3EAEF97C565B9F690627B952374AC509223E32354B831AC5D32397CE9180D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694803, "uuid": "ddd3d082-71d1-48d7-8391-02e1f1ad7a2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694803, "uuid": "6d3d208a-8c92-4c03-afcb-5d11ff28b0a8", "value": "12288:8z5B+X2EIbleCe6PFg7ebWhrHe6UnS2mfdIDV5S9hv3F15vqhqMFJMM07alWaYnf:8zPeVCleCnPFg7ebWpepmfdv95375Qqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708694803, "uuid": "b401bb53-eabd-422b-bf95-d7d9003e95bb", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708694803, "uuid": "b25e29d8-92a3-4478-8a85-c1bcd22557fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694803, "uuid": "7c190543-94d1-4957-829c-ccd72a785e87", "value": "SecuriteInfo.com.BackDoor.Siggen.49176.4839.14034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed770630-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708705859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705859, "uuid": "dfa1844d-e881-4bcd-8aaf-db31f8b5ae8a", "comment": "Malware payload", "value": "d86dacf50eda06626864e76a376601b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705859, "uuid": "3baa6edc-ff4e-455c-a23e-445d0308fcab", "comment": "Malware payload", "value": "48f88b3063aa938003a897be5131dd090bfbc915eaeece2b80b90db7b61d8a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705859, "uuid": "9a9e5808-2239-427a-b5fe-d91b227df374", "comment": "Malware payload", "value": "ce7082e7768d22a7c4d34b113cd0a646b248b260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705859, "uuid": "ecf5b79c-31d9-4cb4-b5be-c24cb5c33039", "comment": "Malware payload", "value": "d17e528970544b2e7d00e3d048a03f68f9e333ced5b731d0585e50216db16d377d2e2877130411e9efe8eccc62acf49f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705859, "uuid": "b1d6d4b6-14c5-4d90-9223-baed077a365b", "value": "T16D5633D3239668CAFE708B7A2D12F4845113796D998B2729B07F4FF605BDE0F2B02564", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705859, "uuid": "97f0988f-0d5e-43f5-b37e-b1b6be86ecbf", "value": "39389b46d0fc73ab23c0909b184bbcf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705859, "uuid": "bd7ec081-a2af-44f9-a252-bad01cda0e18", "value": "196608:b5TWbrwNXRARN7GeH693J6427v/bgg885u:b5W0NXC7B693J8v/s58u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705859, "uuid": "92c7a7ec-7381-4010-abc1-4ea761c5d50a", "value": 6465040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705859, "uuid": "3977dd5e-9c3d-4937-bbd4-7511f1deb4e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705859, "uuid": "38b4f218-1d68-4a7a-a03a-9e4aef4d244a", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95c5d9b-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708677828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677828, "uuid": "ac8a9d4e-b167-46da-a5ad-1976e0f787ae", "comment": "Malware payload (AgentTesla)", "value": "72b14801621eb5aaee0715dfc65d8b72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677828, "uuid": "dafa98a3-bb2f-4abe-9c2c-adcd4bf96145", "comment": "Malware payload (AgentTesla)", "value": "49022d920d3b36c58eba1f941352a936a71aaac99cdacf65a925e0dc655bd232", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677828, "uuid": "b3f4a978-6792-402f-8d20-8de074f1b054", "comment": "Malware payload (AgentTesla)", "value": "2f4b2859fa8d1db18bc639622dddc5025af07c60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677828, "uuid": "1e572494-d16e-4299-8e58-1707d033e2ad", "comment": "Malware payload (AgentTesla)", "value": "71e0d6e401d41c43cb048c16288bb760f386f96ab8e60482f3b2ffa280a0d8f554489d69e2382c4b5c1c9e2a24cc552e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677828, "uuid": "0f8c022f-5960-4e52-a16b-ae819cff3864", "value": "T187037C41B7DC867BEDBF13BDA87221124731D317A282DB5D5E99809D2857BC80323BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677828, "uuid": "b0d43d17-d4d2-4e5c-8752-e6baf5fa0b5f", "value": "768:Ie/nw7Mz9fldvI8rOessjPTInb69EyvWWgv5n:/UMz9fldgYOFsjPTIb69E4gv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677828, "uuid": "6c77475e-151c-4fbb-b2ca-5e7fab5f23cc", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677828, "uuid": "800f41e4-cf08-4931-af3b-76f182cd761d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677828, "uuid": "a8b9ead4-2edf-417d-922f-2b3922c15cab", "value": "n1KVzXM8Wk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9eefa43-d20d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708666662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666662, "uuid": "f6c58b06-cca0-41f7-9d1a-6789c73f8f49", "comment": "Malware payload (Gafgyt)", "value": "b76d2a900441054d1ad6074ba3306287", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666662, "uuid": "5cdbbbc4-3f95-4e67-bb8c-47d31cbabec3", "comment": "Malware payload (Gafgyt)", "value": "4a545d429f86ca156d68939970886cdeaa7d0c1ebd424dde8501dae00ea50b02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666662, "uuid": "472e9439-701c-4f00-9cd4-a0b43fa52fb5", "comment": "Malware payload (Gafgyt)", "value": "b849bb2a71400970c462c82e62eb5e66938c40da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666662, "uuid": "6717bd0c-344a-4547-ab53-3b9bbad43b07", "comment": "Malware payload (Gafgyt)", "value": "d1d5dd2ab43c6bac1a5080dec181e18a9327272e283be0b45eb627f1a52e0e5f250de8cab4ea449a3a9bd5f5cfb9139b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666662, "uuid": "c5892c2a-4adb-43bc-af0d-4071139167f6", "value": "T1FD831A46D3A2C5B3C4831BF605EBD72B0231F9174B2A9F0AE35DAEF46B12584719A317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666662, "uuid": "a52b74fc-4f79-4e3c-87d3-3ca8c96447c8", "value": "1536:73ovA5aSOzS5EERf1SmycEwf5vxMLpi3F6+m5CsNFPVYLf0:TwA5aS7mU9SncxxJMUF7mwsN1VYLf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666662, "uuid": "2b34c063-7f09-4beb-9a7a-5ddb6ad0f14a", "value": 87461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666662, "uuid": "07c2f1be-2c9e-4e1d-afa4-1a201ec3c0c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666662, "uuid": "54ad3321-9816-4e01-878c-2deeb87d1951", "value": "b76d2a900441054d1ad6074ba3306287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd66d96-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677751, "uuid": "681e5802-464a-4496-abd0-e28e6ef286ff", "comment": "Malware payload (Mirai)", "value": "6455a1b420be3668d33c87b24396fd28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677751, "uuid": "49ff43f9-98d3-4ea9-b2ce-281c45b1d81b", "comment": "Malware payload (Mirai)", "value": "4acd4ec682625f41905b479a8e4f486bed5fd06d09fcac0bdbfbde7dec35908c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677751, "uuid": "a1a9a7a0-52a0-4722-adef-92b0b162ba02", "comment": "Malware payload (Mirai)", "value": "6a7c5da01a0570749b6e9030fcc103535a4974f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677751, "uuid": "ab3bb542-8be4-46cd-8d89-fdc12b2780da", "comment": "Malware payload (Mirai)", "value": "eabe125b7c0164d0d64afe3f2fa9fd33f34edb92d1dfb80c9e9378abdd452135822938a25e19119b972af6c52bfa729d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677751, "uuid": "fdf5ad48-caae-470e-95c4-58d2d8af33c3", "value": "T18C337C36E8265E68D04941B179248FB51F23E0C083175EBB25AAC3B16843E9CF909FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677751, "uuid": "f94ef18c-c100-41ce-8866-87745e551893", "value": "768:2Uv2UkL7m5gegIDCMKSmKT8i0Qb/aeoHY+ncBCzF9vasfUyBwEw7I:2y2UkvWDGdKT8iHihH9cBCzsyB+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677751, "uuid": "3d147f9a-f8e5-4b20-928f-66f6cedd75ae", "value": 55032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677751, "uuid": "7d5543d5-ee1d-48d3-a11a-fda92cff718a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677751, "uuid": "7f2a3da5-5615-49cd-819b-f694acaa045c", "value": "6455a1b420be3668d33c87b24396fd28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2053ac7-d25b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708700230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700230, "uuid": "59bf7d56-df66-4fb5-8757-68047ef94f51", "comment": "Malware payload (RiseProStealer)", "value": "ae958708e0be8f0c0911e450cf71dc52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700230, "uuid": "73ad4cb9-b4bf-46ba-beb6-796ee3a80ea4", "comment": "Malware payload (RiseProStealer)", "value": "4b44ce9da2d83d7fbd6238e6350ab35ec8a49b7a286c5270a299aaf41a5568dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700230, "uuid": "2a82e2d0-f8b7-439b-b699-e850df2de4bc", "comment": "Malware payload (RiseProStealer)", "value": "1a8911253a58c87f88292cf3345d292838ef8eab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700230, "uuid": "2719fccb-08e3-4b9b-be57-fddf134b517c", "comment": "Malware payload (RiseProStealer)", "value": "1b18165e7101230b8ac14881c8d2a510d3573c784c8490e58f2987d651fe107c64d1a1c063ba242587e5c1910319bcb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700230, "uuid": "d0911dde-62c2-494a-863c-dc5436f69afc", "value": "T1149533AFBE858A91C159CD30184EE386E3172C46DDDD5E2FBA52836EC61F337068492D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700230, "uuid": "6325adbf-143b-49c5-9efc-4bbea56c8df6", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700230, "uuid": "e1d7ec33-d044-412f-864d-8410d7e34be6", "value": "24576:CNl8jdsS/zt0irzPPos/NdV17PW59ZN2mh4LIndj2wUtVzC2K/jODet4FZj5u5Fi:DjeS7t0goK17O55h4LwKwEK/jl2ovyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708700230, "uuid": "bfc551eb-74ee-44af-b606-46b4ab130a8f", "value": 1911296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708700230, "uuid": "9617399d-d897-4bda-af07-88b916bed9e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700230, "uuid": "0d1b586f-613b-408d-8f54-0842a23b2a01", "value": "ae958708e0be8f0c0911e450cf71dc52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4643354-d264-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708704099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704099, "uuid": "ef2aaf9b-5f7a-4f46-bc7b-833c4b3eb80e", "comment": "Malware payload", "value": "5c7736509cf1cc99d06d2f9ada099a75", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nuget", "colour": "#9F019B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704099, "uuid": "c78c4ffb-17c1-4151-bcef-ea1690c07f0f", "comment": "Malware payload", "value": "4b8d7e016ac84d73d5747cc84847f4cc0583b185fe636e3ccd3e1f713650425d", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nuget", "colour": "#9F019B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704099, "uuid": "e1ea2faa-622e-40e9-bef0-65c6bca54638", "comment": "Malware payload", "value": "52c58a9c7cc5c0a52327f0f84b43e3984aa54135", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nuget", "colour": "#9F019B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704099, "uuid": "aef4c441-cae5-41b7-94b8-71efddf8beab", "comment": "Malware payload", "value": "689a39557bd05fd37a472aef7d088e745de8838210bda14d9c5a49d97dd40bf50682f4fa4ec537719944eccf65055078", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nuget", "colour": "#9F019B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704099, "uuid": "bfcefdc4-dc29-4e05-934c-70050503ba0f", "value": "T149647C1A76A814B9E873C53DC8575902FBF678060365C6EF0395872B2E273D1AA3FB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704099, "uuid": "cc5e75e1-aec1-466e-b5a0-c4d162f5212d", "value": "dff34869bcf58e230758f2b7b4f22420", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704099, "uuid": "b7caec0c-7aca-40bf-8e98-6be5f39ccb90", "value": "6144:WYtMdcvXGRDeyNF203FDpUaXCtohlikEt2U:WYtIRDflDpYos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708704099, "uuid": "421a6981-dada-405b-9f55-f3abf8f9d762", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708704099, "uuid": "c73c391e-7403-4511-b813-96c22c8dabc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704099, "uuid": "232c94c7-10bc-4add-81ab-b10af556a022", "value": "MpClient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e9b455-d25b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1708700235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700235, "uuid": "27ef0792-696d-4cea-a16d-a6bd0f31ddde", "comment": "Malware payload (Smoke Loader)", "value": "9f034c7e35bd5ac25923a93605d516cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700235, "uuid": "32d55e1a-2c7f-4f1b-90d4-78b94bc58c84", "comment": "Malware payload (Smoke Loader)", "value": "4ba5c87a94c9929e51c3c8c09b45d8a70fda5e1518691c979b770d64bec3cf4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700235, "uuid": "1bbde1ec-5b6c-4d86-acb6-226cc7115688", "comment": "Malware payload (Smoke Loader)", "value": "57f6639214c0585ac2ca94c1fe4ec9dd7c42267d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700235, "uuid": "169a71c8-fb47-4c42-b9e9-d68c7cafe38b", "comment": "Malware payload (Smoke Loader)", "value": "f2a3685f60f55d54e77bee890b200fd353add469343207a881965afec4f224e5e7b088c0c822ec1d8980a0b435662830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700235, "uuid": "65e961eb-85af-4780-ac96-0df12fac1be4", "value": "T13C444A1392E17D91EB668B729E2EC6F8369EF5704F59776B22188E2F04B4173C223711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700235, "uuid": "9528e25d-fde9-48ee-8c30-702b99931d9e", "value": "eece28fa725ed1cdfebc98e3f9f15000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700235, "uuid": "fb4760f2-1287-4bc5-a7ea-74fc3be40850", "value": "3072:LKKN3V681HJ6hLz1elSSUfaZ99u9wHxa+cty1FFxofkKaqUjlg5bAZ8:W69A5ek847+1Zx4kKy+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708700235, "uuid": "10ea18fa-00de-4a8d-a8dd-5701e7556a02", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708700235, "uuid": "6f82d9fe-817e-4d5c-aa71-a66280f741e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700235, "uuid": "38142a50-7c17-47e8-8f60-d1d91b5c1ed3", "value": "9f034c7e35bd5ac25923a93605d516cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfaeb33-d289-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708719950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708719950, "uuid": "81b7059c-95eb-4590-a808-7063675e43db", "comment": "Malware payload (Formbook)", "value": "dfafc703ba16fa2dd6989169eea78527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708719950, "uuid": "218aa17a-260b-45b5-82db-b60e3fa8c1e3", "comment": "Malware payload (Formbook)", "value": "4c8efb2c7d2516b6253a3008e5f4dd5a0efb6b9752c76642491d9f6bfd9df6d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708719950, "uuid": "ca11eee9-1bb3-4554-8e80-3ec7e75d9486", "comment": "Malware payload (Formbook)", "value": "80af23bb93aac46677909f7275d0afe05af2ed57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708719950, "uuid": "3c79024c-bd87-44c1-8be2-6bf9ee86d5ff", "comment": "Malware payload (Formbook)", "value": "156a30dc59727d08c97f36f953c1c6af0ddae1276c2de8484940826274fc0314a5ff84665727bdd12a35d3899cd6f1cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708719950, "uuid": "77c58d4a-e4f0-446b-a39f-a8b5f163e4d6", "value": "T1FCF4CF4D93214393F1482B75DA7D3E1902201C7C78D5E7D4FAA97A5BEEE1BA6183302B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708719950, "uuid": "ac92567e-a25f-482d-9279-26602eafec9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708719950, "uuid": "7a2cbab9-708a-45f3-b92c-f5f704b16d9c", "value": "12288:lOJ67iJqP9XRz+5EJqOYu0iQVROhjuAZsKelXXex87+2LzBh3:lOJ67iJqPpRz+yJqK0bVwhjuBFex8i2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708719950, "uuid": "0a84578c-0392-4877-b8ff-3972617b718b", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708719950, "uuid": "72b1db0e-6079-4d84-bf93-b6aac37bc81c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708719950, "uuid": "58698663-7b4e-426d-b3c4-5b24343777cd", "value": "SecuriteInfo.com.Win32.PWSX-gen.13520.16236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a1dc86-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677741, "uuid": "49b1efce-ce11-4a4a-978a-2e22d5706b9c", "comment": "Malware payload (Mirai)", "value": "1c23abbdf97f80aafaa17f93c8c5d7a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677741, "uuid": "e121dd32-f87f-4591-8652-55761bad2844", "comment": "Malware payload (Mirai)", "value": "5051132e93ebe2bf666bcad8d7cc4746238d36b2d275e7e10308fc7b592407c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677741, "uuid": "4ea5ad77-69f2-4618-84f8-1b6f9be7b13a", "comment": "Malware payload (Mirai)", "value": "5dd0487d3ada7d891c9767a4635903f5b1873587", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677741, "uuid": "c2c2a148-7949-40df-a9f6-4abdfafdd90e", "comment": "Malware payload (Mirai)", "value": "52d918e77b625d602dea861211945c447508e52ea1f69efbed949968252c266f3a86addef6a24d06cb17ed4016156b76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677741, "uuid": "b3c96ae3-8156-48cb-863a-27efe4871c1d", "value": "T193433A02B30C0A17C1A35AB43A3F1BD197FEB5C122E4F684355E9B999672E331586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677741, "uuid": "95a2ff89-0765-4e89-8db2-df6cd0818587", "value": "768:ZyVRdYlhR8UxDnoqsCbZLirZrTdXCDHTdYQ9nvVeto5sptiTInET4F82t80ZUwr5:e0KqdLirldXIJYSngqG4TIETx2hDr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677741, "uuid": "23ccdfac-39a2-4a4e-90cd-3e33d0ef1d6b", "value": 60388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677741, "uuid": "306b7f6a-7678-4b43-997f-ad7ee18c8fc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677741, "uuid": "53c62607-60db-457c-ba51-ce94c4eb36d1", "value": "1c23abbdf97f80aafaa17f93c8c5d7a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0d3b98-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708708833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708833, "uuid": "2f558acc-4cb6-4f85-96c2-0d84686df179", "comment": "Malware payload", "value": "54a3a3eb46f4eb5dede87218e5b262f2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708833, "uuid": "b16e1ddb-358a-4813-ac0b-ba0b59204c60", "comment": "Malware payload", "value": "50798e5f883e4c0884918c73e59daf1803fa0ca10ebf5ead8fc8c1367a431cc8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708833, "uuid": "80ccba3c-c2a7-4324-90c9-422f96029258", "comment": "Malware payload", "value": "aecd121b32283578c45733d855f983c6ba6fffd6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708833, "uuid": "8749a5b6-3745-4d4e-a28d-529e0020ca94", "comment": "Malware payload", "value": "5527cc9d7dc1d83b15cf7358a79e89179a2a0cecbb7bc5d9d9c994cfd70f2781b0adff3eef91da7eb8946a057528dd95", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708833, "uuid": "9ece87ce-97e0-4dc7-b55a-dfdddf44c8a6", "value": "T11263152EE30F0965DF55E67B435A4B4A09FCB33D728500A179BC9338376D82E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708833, "uuid": "dd087d48-6b27-4ff3-bfb2-2d3597306b8f", "value": "1536:Z9PNkkU1LqpLt1ZrRucV1tFUi0OIfVugfMcGh7EcOSn/J6F:Z9PDRrj1tuO+VugkcGZEcOqJ6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708833, "uuid": "4135c0f9-1083-46f4-ae35-2ea197b3bc56", "value": 71933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708833, "uuid": "af793bb4-80c7-43f8-aa1a-05afca139f8c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708833, "uuid": "b7f7dca3-0663-49d9-9208-830d223383b8", "value": "54a3a3eb46f4eb5dede87218e5b262f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af31aa1-d22d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Latrodectus)", "timestamp": 1708680381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680381, "uuid": "f9b0509c-0086-4e82-81a7-a93a4e3979da", "comment": "Malware payload (Latrodectus)", "value": "6ec4144a4adc7c5f6efae8fbfd46999e", "object_relation": "md5", "Tag": [ { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680381, "uuid": "fc40c084-eb3b-484b-85a9-a7be4a3dc7f3", "comment": "Malware payload (Latrodectus)", "value": "513e17579b0b155256d134940ea03d8ab7a0d1f71ebe188954e2450cdc6b7d99", "object_relation": "sha256", "Tag": [ { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680381, "uuid": "94f87b87-d54d-4253-aa7c-8514efb01f18", "comment": "Malware payload (Latrodectus)", "value": "c437c27f55f7b34dd7bd964ec48b0df6ffee985f", "object_relation": "sha1", "Tag": [ { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680381, "uuid": "132165b0-b93d-4138-83ec-246f2d57118d", "comment": "Malware payload (Latrodectus)", "value": "489e5d8a679250ce4255fd1575eb1c12801947f1d7652f5525d6139b20beff17bca52b2f6f5cafce6e790b2ee8659f96", "object_relation": "sha3-384", "Tag": [ { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680381, "uuid": "7bf22ccb-9cdd-48c1-8d89-121d87f37da9", "value": "T1E9A5F1227386C537C96E01303A2AD76B5179FDB74B3140D7A3C8292EAE744C16639FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680381, "uuid": "0320f9ea-acb7-4049-98b4-fc596d9af5a7", "value": "49152:OGLvYpW8zBQSc0ZnSKeZKumZr7A7ySO3AqFXX+PFebm:lYQ0ZncK/AGSKFXX+de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708680381, "uuid": "64508c19-6705-4182-bab9-86a1e43a47a3", "value": 2127872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708680381, "uuid": "84692ff6-ba7b-441d-b9be-d4a2b7b18d0e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680381, "uuid": "e3ec1f2b-6215-486a-a31b-7c8df3b7a627", "value": "SecuriteInfo.com.Trojan-Banker.Win64.IcedID.er.29654.2537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a3b25a-d226-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677389, "uuid": "d42f65ae-47a8-45da-b441-306ed1c6cae1", "comment": "Malware payload (Mirai)", "value": "86876da62f2fd7c6cd41a29d711d3481", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677389, "uuid": "280edeeb-4525-43ea-a2fb-848ead8e5463", "comment": "Malware payload (Mirai)", "value": "51b8082bfde653346ad85671301fe0aa76a900689ab8603649d9ad44daac814a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677389, "uuid": "f1eab4bc-de5b-4c81-bf67-41cb452712f2", "comment": "Malware payload (Mirai)", "value": "d6ddbd2dd39b0697ee363a96ed57674f451fd1be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677389, "uuid": "d5626a61-8f08-4ab3-bd14-eb5b15920bb7", "comment": "Malware payload (Mirai)", "value": "81cfc3fce9ff1d99d9e34a3f28879e6380c8c8aa2d1d71e8533e977eb6aa6151a4728301679bbc5f6db3468541f56ed8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677389, "uuid": "3bfc9b89-1c83-469a-aae5-161622ffdcee", "value": "T10263189AF401CD7DF80FD77B84570909B671A3D112831F3A27ABB967BC721A51823E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677389, "uuid": "c2198702-559a-42ac-8f7a-75429e29da57", "value": "1536:hm+ofbKhow/shCQz87kfDGSNHcrs7dTXeFEgGEYEw:hfojKeeshCQgWTHosh8eEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677389, "uuid": "957de518-944a-45de-bab7-78cff4b9c929", "value": 68356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677389, "uuid": "0c126071-7123-4a91-ab5b-b7d7125d9fc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677389, "uuid": "e8360fa6-3a44-4a9c-bf89-7775eba21922", "value": "86876da62f2fd7c6cd41a29d711d3481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad76b13-d245-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708690608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708690608, "uuid": "23e22d06-f08e-46db-b521-78555ec063ca", "comment": "Malware payload (Moobot)", "value": "935bef21805992ae65d767e294b6bda3", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708690608, "uuid": "f4f6f1da-9d57-49e8-b8a0-aecf947e9e07", "comment": "Malware payload (Moobot)", "value": "51ce997fc8c2f90ae0e6a16f48db708bc6f387051225d9ef2b47b50099ad702c", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708690608, "uuid": "56d34fdb-6236-4022-926c-dc7ba8c6cfc4", "comment": "Malware payload (Moobot)", "value": "eb5e20dc292be5a4eb7cc4f2c68b87156525f9e5", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708690608, "uuid": "9721175b-0e3f-4c97-acec-936efa9a97fd", "comment": "Malware payload (Moobot)", "value": "75fbef068cd12e941723a70e22488ff3cdc9f13e68bc54b42d71d8525dad1d73f6cf87dd9286a04f0f291a761aaa1e11", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708690608, "uuid": "29757b73-4f7f-4fdd-a83e-e284c3ad32ba", "value": "T139E32B56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679E0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708690608, "uuid": "b821aeec-088e-4c7c-9839-eaa92a1b0709", "value": "3072:5J0cPOi4Th7ta9dFrRk9689TAJPii2OXkkTM/9OY:5J0cUlta9dFrRkY89oh2OXkYM/9OY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708690608, "uuid": "7550d227-9054-42c5-b5e5-8631d4493f33", "value": 150794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708690608, "uuid": "f8b8232e-5fba-49af-9f46-961eb6a9fdd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708690608, "uuid": "a3c2db0e-271c-4eac-9e61-8a26c7f0d540", "value": "arm7-20240223-1216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf136a1-d1e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708647819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708647819, "uuid": "17178ec0-bd54-4998-ae99-d92031209015", "comment": "Malware payload", "value": "29d60632115bb0dc152389b295d1a06d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708647819, "uuid": "9759bf45-3737-42c3-ad6f-c60a8463455b", "comment": "Malware payload", "value": "536c279ea2d854fd8f7fad3d4db59328fb99fd6c416460bc455b2449cf4a5abe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708647819, "uuid": "c6a86474-9139-42ff-92ba-84cc97f0a788", "comment": "Malware payload", "value": "a770220311199d0da36e64ed09fb4e189bdb3157", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708647819, "uuid": "53e4d95e-aeaf-4ac8-82e3-ccafde9de677", "comment": "Malware payload", "value": "6e212f3ccf35125dd5509484c7402789e035ba1f493f0cab12da2a1079052fbf7ea312750012639a70d7bc27fd6d36db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708647819, "uuid": "b2dc5eb9-1782-43ff-930d-0a862923f734", "value": "T161667D87B8918646C4E43776ACBE81C433636EB99B9723576D04FE3D3ABE1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708647819, "uuid": "6c8f3785-55a4-41fe-8618-9dc084a58a94", "value": "98304:j3nKtFeHs+5ZFKb4S6v6/yvu3T8D8IdbNQO:j3nKQZbSaHvu3T8oIdbNQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708647819, "uuid": "193d4617-628d-43f1-be4e-dc625bab54a3", "value": 6707998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708647819, "uuid": "1fa7c120-35ee-49b1-a5c0-6a74ddbfefa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708647819, "uuid": "645f1535-f20e-4d36-9e59-1fd775f494c3", "value": "SecuriteInfo.com.ELF.Miner-LU.1699.872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285676e2-d21f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1708674175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674175, "uuid": "50a78073-58b6-419a-9a2b-fda5a1a6d2b4", "comment": "Malware payload (RemcosRAT)", "value": "421be0c5e144b6f0945b421839ce8841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674175, "uuid": "fdb50286-83d2-45bd-a07e-a5371334a6e9", "comment": "Malware payload (RemcosRAT)", "value": "53c00aee40c92375daef04e2cb894f532c3c0eac1d8d53f0315c8d981ba3c883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674175, "uuid": "591af5ea-9635-4603-9770-72e893e30569", "comment": "Malware payload (RemcosRAT)", "value": "8ff552d574e4f581cd776c6c58fd0f735be4a085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674175, "uuid": "6e5f62b9-2631-4e52-a138-c74b22bc79db", "comment": "Malware payload (RemcosRAT)", "value": "1e1ef4e2da92ddaa5115861c1bddad3b0ab95fa1b3a8bca902a8f0764d56ca91d708f485518285826a5bf312d0ee2e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674175, "uuid": "d3dccb04-2279-4f8a-8a38-c57737c3ccab", "value": "T15725D017725C29ADF4B75C3B2025D30F6523CFACEF078B93672E8B2454348D8A796A61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674175, "uuid": "5c838058-3d9c-44cd-95ed-89ba9753a7e5", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674175, "uuid": "7acd3dfa-9fa5-4bc3-b31b-98025a95037c", "value": "24576:EiUmSB/o5d1ubcvhjLtp8L1FrPIAyvkJK4wQtmD4y:E/mU/ohubcvhjm11POvixj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674175, "uuid": "00777f60-22f4-4afc-8d86-406456f79795", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674175, "uuid": "72e86d98-c9db-451f-8f1d-6d7cca5be0a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674175, "uuid": "be93782a-7514-43e1-b2e1-611b7e28b323", "value": "459120568.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fcd320-d28e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1708722013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708722013, "uuid": "9e0d61a2-1f2a-463d-a6a6-8c1b73b6edd5", "comment": "Malware payload (njrat)", "value": "4834daaa2464378474669c26607f8c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708722013, "uuid": "8a98bd66-2357-4768-80e8-900795726713", "comment": "Malware payload (njrat)", "value": "559d282b0ba15515ba2b906da3d68f60ec4bcb0934d07d7e922f34909a378707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708722013, "uuid": "04c7bab3-5a70-42d3-9383-6207af62936a", "comment": "Malware payload (njrat)", "value": "0798e7d96aaaa629c232ad4398a307e25013d585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708722013, "uuid": "d30dd996-273f-402e-a4f0-1f6b6f8768aa", "comment": "Malware payload (njrat)", "value": "247cdf23a9668f09abdb075bfb9ba2a78ea1ac6153e728b6df12bed882ded94956228c68e4a00d96f47c196363befbeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708722013, "uuid": "6d8c687e-15c0-45d3-a509-4626e6048f0c", "value": "T135B21A4E3FA98856C5AC1B7496A6965003B091470423EE3FCCC554CBAFB36DA2D48EF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708722013, "uuid": "5431b6b2-37ee-4d6d-9239-ea4c8be6935e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708722013, "uuid": "cf1e5958-e71a-4f37-b757-18fa23f3f5ae", "value": "384:tY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3tVmRvR6JZlbw8hqIusZzZo69:CL2s+tRdRpcnudG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708722013, "uuid": "2800ff36-508e-4ac2-995c-045fa8087ab4", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708722013, "uuid": "1f04c8fb-47f4-4be5-a656-7ad4e7ae880f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708722013, "uuid": "dd70f7bb-9326-4dac-9950-ac1025781d76", "value": "4834DAAA2464378474669C26607F8C55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e810b222-d220-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708674926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674926, "uuid": "26068fc8-f1c3-4204-b1ab-a38d5dcb2e8d", "comment": "Malware payload", "value": "0007f615f4bdd376267d4f6d3bdd991c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674926, "uuid": "4320d15c-3ccc-4e06-9efc-c3a09dc5bba6", "comment": "Malware payload", "value": "56eba56abe3474c05fc2b1aa592f198523b80aac22ac72c7c403664589f11bbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674926, "uuid": "3c3e1dcc-dc3a-44a0-a12d-eb6a97e76d36", "comment": "Malware payload", "value": "8d9be08441d904a90b130eee7cfaf8b884e2e85d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674926, "uuid": "3719e5eb-6995-40b4-adf0-fde0cfaa0987", "comment": "Malware payload", "value": "ba1247f45344f277c67b1b4486a7531f36ea43377aea9b6c93fc5a355373ea8ec39fc84793ebf956e03bc29eb1b99e7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674926, "uuid": "4bb93420-fbb0-43c1-981f-58375b75ad6e", "value": "T15221EF7BFBBB8B16C864913A0E6363147660CC8C0015D279AF616A1EDC126516F962F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674926, "uuid": "323f4984-dcfe-47ae-b2b1-9ffeb5fa649d", "value": "24:3jvDq3N0yTKaM9kxR8MDXQZP/hCrjSkvySJ9lBlNTawqFk:XWVTCQR8MDS0DvB9PlNuPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674926, "uuid": "0334904a-48cf-4cc1-b003-a02523024f75", "value": 1272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674926, "uuid": "bdff281f-8b80-4a34-864e-983bb6411252", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674926, "uuid": "829d81d3-6815-4fd1-9be1-0b2418f2fc17", "value": "0007f615f4bdd376267d4f6d3bdd991c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a745d4-d221-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708674973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674973, "uuid": "e20d0059-a336-4e79-b57d-325b4029c63e", "comment": "Malware payload (AgentTesla)", "value": "09b8cf2fe768c953afb3b91c614d768a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674973, "uuid": "10d82074-5f74-44fb-b15c-b75836fc0b8e", "comment": "Malware payload (AgentTesla)", "value": "578c1acc4c0889c7cb7be5bd4cf95130c75ab9be19f5af576fc73d89e9322eec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674973, "uuid": "8f7f49d2-be72-45e3-8a70-23d37899daed", "comment": "Malware payload (AgentTesla)", "value": "c912a526eeec75d34cfbd2d181c0c486cae8a309", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674973, "uuid": "4e8bf13f-899c-42c3-9f8a-b140b7a951c4", "comment": "Malware payload (AgentTesla)", "value": "d0b81f9dbcd38dbeaa7fe38e70445e0959bad3d6cfc504227fe60f4256b898f7b8102c15a3734a9c2d9e87b36a5dac74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674973, "uuid": "d78be2bc-d194-40fd-94cd-2376407e2a5c", "value": "T19D25F1A2A6109AA3E1F3063341D7F45135BA1C30770F54A66292FAF571B2BF0D99EF48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674973, "uuid": "62d89d03-0809-4267-827d-8ef6031389c3", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674973, "uuid": "13e56386-9ea1-48eb-89d8-2a196262d21e", "value": "24576:UcsoodltQHwa2KpnUHctqBFPmfsdvIUQXXCJUg:MdAHwa28UHctqnDdvXmXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674973, "uuid": "f91ce647-99d5-47c3-b62c-398566e4e863", "value": 1032472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674973, "uuid": "a1feff20-2cab-4493-9835-f0279468797d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674973, "uuid": "58f80e20-38a6-4ef6-b9b8-8a1a1f15864f", "value": "2214TheneworderaboutPO#PW23C05LRL.LSLof24AW1203A5592NDENRxls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3318185a-d260-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708702111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702111, "uuid": "dad81e8f-d53d-4d99-bf03-1b6544680200", "comment": "Malware payload (AgentTesla)", "value": "fa9c5a7ad1631bc290f8d8452a85c136", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702111, "uuid": "fb95fcfd-2ea7-4fe5-afe6-1621127f904c", "comment": "Malware payload (AgentTesla)", "value": "5996710a9365b9abba29c8640afaf2e8f2e18270f782319265e8e5a16e8c28af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702111, "uuid": "42238fe3-9424-482c-b893-2ea39443f670", "comment": "Malware payload (AgentTesla)", "value": "275c21d8c914d7b73b56e7e87e7d9c9796221661", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702111, "uuid": "00aaa19a-aff6-4a4e-a5d1-b835c5405aad", "comment": "Malware payload (AgentTesla)", "value": "b03084fa62501df7adc4373daa90e80779e9701bcd45d027441fec89477dc77d07dd4849efe1aa444aae334f49c9c30f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702111, "uuid": "4508e369-99f4-452a-a08d-6043062babf7", "value": "T188E4230413A9CF76EFAE1B7B61A255018770AE92E126F78A3FDD74D728237411E43983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702111, "uuid": "bf196e90-1904-49b8-96b6-429b86f12017", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702111, "uuid": "2fa882d3-73ff-4f17-8466-3c8fa8376480", "value": "12288:4NMFsdJo4l0BsHMR/QXNDSQpTG4dKYNzsJYok87df7ehmorYCd25HzBh3:4NMFsWDR/tQpKCnsfdumadSNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702111, "uuid": "ed85b557-b3d0-4e49-be6d-adda8026a344", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702111, "uuid": "666821ad-b722-4759-bb74-cffc415c5733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702111, "uuid": "e9c4254f-8383-4b72-ac4e-3569cf856346", "value": "SecuriteInfo.com.Win32.PWSX-gen.12874.2736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbdebd0-d234-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708683254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683254, "uuid": "9963a9ac-ac50-4d9b-b47d-edc7838d306d", "comment": "Malware payload (Moobot)", "value": "27717ee59958be48c4f33d1346887911", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683254, "uuid": "3a640805-9c35-4af0-9579-136620fa4812", "comment": "Malware payload (Moobot)", "value": "5a782528fe8a373898169b98677e80aacb92e35a72ae071facc5b39c373f3933", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683254, "uuid": "4e4bf8cb-5ff3-4a4e-9ea4-b2fef4fec36f", "comment": "Malware payload (Moobot)", "value": "e17c5c3635477228dce51b6f9494988a67356c23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683254, "uuid": "1d631e48-8643-414e-95ab-74b845584835", "comment": "Malware payload (Moobot)", "value": "7cc18377733cca945f60406c236c040761f61d98665439fe424d2335b25901775d297654bc4c9e994a9bd00bc2196c27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683254, "uuid": "ad869c19-c873-4664-8b6e-3a1d8888a272", "value": "T10D53B70E6E219FACFBAC833547B74E25964833D626E1C545D16CEA001EB034E746FBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683254, "uuid": "9a6ac3bf-e609-4b88-adae-b9ab7ee782be", "value": "1536:MP5gEBXMVKz3gz3igz35w2Ks2RaYyuPGjxEQqK4Vj:IgEBXy8ExEQqRVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683254, "uuid": "4ae131b9-e3df-4209-85ba-528f8b69ecb4", "value": 62128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683254, "uuid": "23cd949a-de11-4f62-a72b-c3ae684608f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683254, "uuid": "bfc88315-4ea0-493f-b53e-da3c60b14272", "value": "27717ee59958be48c4f33d1346887911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca18bfd-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708705724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705724, "uuid": "36f982ba-e5c9-477e-b8eb-e49c7200c03a", "comment": "Malware payload", "value": "6a940e8b424bf0324a7e1a4da4aa37b2", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705724, "uuid": "a9544b31-402f-4cc6-a36a-5f3e9e12787b", "comment": "Malware payload", "value": "5bb5432cba450c63bf368a7f3a184e89d15593e44760c379b727535869dfbb62", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705724, "uuid": "83f5a664-8dc8-4bae-851c-e7dbadef31dc", "comment": "Malware payload", "value": "1b3ea3c037b90e3806315deddb84526f0d430217", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705724, "uuid": "d7c6a79b-5b74-49cc-893d-f85c4caed131", "comment": "Malware payload", "value": "c8d04d23c07c47bda2199e078faaf765e1df256e6ff976e0a50dc16b2470003efdaae85091a864fb23e86c622e6d5ddd", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705724, "uuid": "219f6c9b-d814-45b7-adf6-63e634a54ad9", "value": "T18442CF29CE021216D6714ABFE45C2ECD787C4A4A6817A38EE9C8D02107DC12F03CFBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705724, "uuid": "7924fa88-af98-46a7-a1b9-1439d2f56d2c", "value": "384:dXPfNkt7C67mE4oKWnzjrIdbV6RIXTYRpmy:VPF87mEBh0dLAmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705724, "uuid": "395f188f-b418-4cde-b0b2-4df261bdf229", "value": 13023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705724, "uuid": "e97b35bb-cfaa-4c34-ba4d-8d3c1dc6c74f", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705724, "uuid": "80c55ec5-165e-4188-b264-cd65693dae7d", "value": "Reserva Detalhes.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516df1b9-d234-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708683264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683264, "uuid": "bd1c5f33-2a23-4783-8336-f568ce58a26e", "comment": "Malware payload (Mirai)", "value": "5674684c7780226d7f3dfec9cbbfad0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683264, "uuid": "16ee189c-aba1-4ca6-8612-01f823f8b725", "comment": "Malware payload (Mirai)", "value": "5bc29449f512fe50c209b0c35c4a9fb43f8f5770e73c9afdf45c12975191b2b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683264, "uuid": "f64d1011-be5c-435c-ba00-ef245bd9ea15", "comment": "Malware payload (Mirai)", "value": "e9db80df344296b3944a0344d427013dbc9838eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683264, "uuid": "5adf1515-29bf-4f14-9525-dd27d846e5ae", "comment": "Malware payload (Mirai)", "value": "969b4ef5226830cdfae5b6af0919e0612730999905449de027ec563fe8653696dda61b209021e8e3c39d379cd4e0a14d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683264, "uuid": "00a0d09e-8f05-4318-90e2-c6ee2281108a", "value": "T1CD331881BCD19A16C9E423BBFA2E418D372563A8E1DF33079D216F157BC682F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683264, "uuid": "294bc3c9-a8b0-447c-8120-b9c806dc4154", "value": "768:BuE8Uj/maIr2k+FR38I2TsMrUEwbou+cPejMlve51I8G2u/NOatdbLvq:x8UTm5rER3B2TsMrbwxNeNqbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683264, "uuid": "df84ca65-0ccb-4f9f-892a-463a3a360606", "value": 50876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683264, "uuid": "3ff0f471-95e8-4f42-8ba6-99b573be5a73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683264, "uuid": "67c7c276-7d07-4a48-94c1-baaf3ff851b3", "value": "5674684c7780226d7f3dfec9cbbfad0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a537db39-d260-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1708702302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702302, "uuid": "8e5337ba-d772-40c2-8241-e0e8c7167a10", "comment": "Malware payload (SnakeKeylogger)", "value": "00ad0301b4173f6d289b072bdb0d261f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702302, "uuid": "4f74e29c-59f1-45a2-96a9-6c0e8cd88f7f", "comment": "Malware payload (SnakeKeylogger)", "value": "5bed20739f13f9e82e3ea63a13440fc71a94fbd38ec7c23c72839f16ef2a16c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702302, "uuid": "f8f2067d-8fee-4eac-bc34-3138c3220cd5", "comment": "Malware payload (SnakeKeylogger)", "value": "4eda33721659de787974694cceba304e65b3ac78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702302, "uuid": "1ac50ced-5c48-4e88-9c11-5ddf01f0e3d0", "comment": "Malware payload (SnakeKeylogger)", "value": "693145953e608567a6321dd43e9f7ae50964b2aa16fc7e05673b9142593cbe85434e281b08cefff5c5a9a97d75a7149a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702302, "uuid": "5dc7075f-97e8-489c-bd8d-8aee0721abf1", "value": "T1F194E119B3FC0B15F6FE96B7BCB448554937FA2BA822C39D4859010E1932F90CA91F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702302, "uuid": "f0f3d4e2-82bd-40d1-b843-23f8b821178d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702302, "uuid": "944d79ff-c215-499b-97d2-74bcc11e3af5", "value": "12288:XiXG+aKCj7IFFfaUtUC7K2uz3UeXz6AmeMOPVk2:+GHVj7wfaUtpuzXzAaPVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702302, "uuid": "e86214ae-76a2-4a94-9415-979eb6aa080c", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702302, "uuid": "1be3f9c7-21b1-4d59-8431-35482325b1f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702302, "uuid": "42398fcd-3292-4257-a1ac-4bf821ea9238", "value": "MT Ramona Particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedb34c4-d264-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708704063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704063, "uuid": "3e515ae4-3ee2-4839-8269-9f1699e9df06", "comment": "Malware payload", "value": "e47199818cf4fcdcf33aedb8b7a8aaa0", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "nuget", "colour": "#9F019B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704063, "uuid": "0eb4252e-e55e-475c-bf2f-fb37b64609ac", "comment": "Malware payload", "value": "5c19a1e48f56e05944cd05738db9c0fbe2e5ee575aec442bb63a4b433d7b9776", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "nuget", "colour": "#9F019B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704063, "uuid": "43a1888b-d384-4a34-9569-16a172176551", "comment": "Malware payload", "value": "62fa5ee01c48bd6a95f67dc1893ae9711e03d439", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "nuget", "colour": "#9F019B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704063, "uuid": "3de60161-6c94-4f14-adc1-a3076fb90bbc", "comment": "Malware payload", "value": "2ba6624cd43f82f9c71d7c16fff9e46c6eaaf5e423d142d8d9cba8ad3b44ba7edd94175b281eca92b7f3d64dd72af07a", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "nuget", "colour": "#9F019B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704063, "uuid": "4e3b1419-e7e2-4e64-a43c-5db70fec4a28", "value": "T1FC953341D239F045C0A5F02693BF60D1182EEB33984EE9A4E4BA45B937155ABDDC0FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704063, "uuid": "76217cc7-8461-4709-adec-46956ee6f75e", "value": "49152:IbSXANE1IZUt3CD2k3vuwGS8jZXIGs25chVmkYTNSlH:IeaU62k3vu48jRIGbc7fYgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708704063, "uuid": "0bb7b392-f48e-49f4-ba67-26852829c4b2", "value": 2046081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708704063, "uuid": "638cbcc5-6a13-4b7c-83a3-fd9ee25ab359", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704063, "uuid": "c7cebd4c-33ac-4280-a010-761371b7ee24", "value": "5c19a1e48f56e05944cd05738db9c0fbe2e5ee575aec442bb63a4b433d7b9776.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938b9679-d247-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708691535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691535, "uuid": "b331c29c-5b1f-4303-9db3-617ff1f69933", "comment": "Malware payload", "value": "c3590c59f5427d0dc7759e75f2adcc0e", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691535, "uuid": "63d89d6a-d352-4126-846f-366de8675650", "comment": "Malware payload", "value": "5d06e4da82933890d79f0828e24ca254633989bc8981a53b2b4552c8b1b21a06", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691535, "uuid": "990adc12-d3a6-4004-a843-5cae384082ea", "comment": "Malware payload", "value": "521ed51c0c6a5159bace173b4fd33c1826ffc089", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691535, "uuid": "315aaa38-0285-42e1-b3cd-58a851b1feb0", "comment": "Malware payload", "value": "3cd4580276998dc53195df28697c7ad04dc25b68c7a8e8a5867b0eaf18bdd828b202b02bb0175682235e2e48d09d6441", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691535, "uuid": "7871d6de-aac5-42b4-8a65-e78cace46330", "value": "T18245AD5197540462F2B6273946A02320ABF5FC0337B68A5B376D131C0FADAD18D76B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691535, "uuid": "6d319469-9015-4d44-81e4-7b6488fbc4df", "value": "48:5dro9HVDxnUgjJH+Gn0SS+hybDhUK8f8fcDhcr0i:5drOHznUoJHBnZyCf8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708691535, "uuid": "b5d83b1a-18fa-4f8e-ba2d-ea5da11a3cff", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708691535, "uuid": "edb90312-4e4f-48e5-a6c1-dd50f6c79fc9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691535, "uuid": "32ee7f3d-a74e-4299-bb03-1b5d952d05fc", "value": "Docs.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab4017c-d1f3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708655335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655335, "uuid": "6f924168-ee98-413d-9b26-c09b7b43d6ea", "comment": "Malware payload", "value": "260439c8b740662d7a288adbca6e5ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655335, "uuid": "74c47dfd-ba04-4b1a-9c89-8ceae6a4bd9e", "comment": "Malware payload", "value": "5e74026ddc198eefd54e41250440d582090012c6d05b1e6098385ab593e91f43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655335, "uuid": "3aec1ce9-2a18-418a-98f5-7625551d7d74", "comment": "Malware payload", "value": "1aa3d259c408b3fa1a3db463eeaf87965d5c21cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655335, "uuid": "52c61fc9-6d88-4099-a099-9887d8f58a53", "comment": "Malware payload", "value": "9d86d3eccc5e3b58281a44065678df5d0a4835b542e6bfaf82523342c4299d61b1a073569f016a3d239db03a755fe96a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655335, "uuid": "659d4efe-22d0-434f-99d6-d1628b73bb90", "value": "T1AB72082CE3E9020FD95049B52923BBE11CDDED14622367EA6E446FEABA120961E45CF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655335, "uuid": "08a604e3-aaea-4ba8-8617-9c4980971f70", "value": "e214f95f7f3a3181be62d978fbf0219c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655335, "uuid": "88e226f6-187d-4a82-b282-1230b1e1e04f", "value": "96:MVj94nPTTyTvMXmVTTtOU1RQJWHKdt1hHP1E+eq+0QCp3kucrh7ptO67Qo:oVLMwgMKd5m+epA3k7btz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708655335, "uuid": "61931a97-25c2-4fd7-9658-433caa9c1fb3", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708655335, "uuid": "229fa352-5160-47e2-a3de-490bb5f925ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655335, "uuid": "e31a039e-7c0a-49c6-9d29-2d79e52f6f39", "value": "SecuriteInfo.com.FileRepMalware.7367.7013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7c4152-d239-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1708685646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685646, "uuid": "05bf6550-db86-4e5c-a0cc-9ca8a003fc19", "comment": "Malware payload (LummaStealer)", "value": "61a91b085e29fb1f3a72409fda124002", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685646, "uuid": "cbfb59ad-7797-4124-9a8a-e7331374a0b2", "comment": "Malware payload (LummaStealer)", "value": "5eb26112676483926c974f8476725ddd096deb692bf4f3f13153d4f21304877c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685646, "uuid": "3118336a-60b1-4e5c-bd8a-bbcf547d309d", "comment": "Malware payload (LummaStealer)", "value": "36f93a58b633b4eb81e5671ab135884d0c21776d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685646, "uuid": "c117713a-6389-425d-bb5e-43ae47e48e5e", "comment": "Malware payload (LummaStealer)", "value": "aa39efe3494d717d124490eec5b660773b52f9078ac5d5d8fb4b61a19b75cbc4bc90c8e3bc5b4351285821f3e8c8d90e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685646, "uuid": "e288b1a5-fe40-4d51-8eca-983b67958881", "value": "T164765B07F99145F8C0AED634866692627A31BC480B302BE72B90F7782F76FD06E79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685646, "uuid": "7edd3067-897d-438f-a4c1-8b865d726981", "value": "fa5b31b69e4bd15d7cbb806512d7d0db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685646, "uuid": "cb9dca46-1afb-4974-93e6-380aef9440f5", "value": "98304:uRe6MZW1+M22N7G+tSi5mEpHJJSak5vhsn:ucW1+M2P+YWDppYCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708685646, "uuid": "bad115aa-7d28-4883-b1e7-2f354ee833b4", "value": 7265792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708685646, "uuid": "02ae6c52-bdaa-45f1-b5f7-66b00cf63cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685646, "uuid": "d0ab291f-b85e-47c0-940d-f6b879009325", "value": "61a91b085e29fb1f3a72409fda124002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95819d74-d247-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708691538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691538, "uuid": "28e05f18-197b-405a-bd4e-3d24a776b5ea", "comment": "Malware payload", "value": "315bb131a981069ab9f2161d2ec3e89c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691538, "uuid": "6b2a3044-b0f9-4aaa-88e0-aeca17e63f13", "comment": "Malware payload", "value": "5ed2df66488419190056cf275bc29d42cc061c4fad5c1042ea05de8ba2f013fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691538, "uuid": "eaf88319-ec8a-4261-8bf0-436002c7d2de", "comment": "Malware payload", "value": "14302de9ea21a7454ab36b4936b70230cb8a8248", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691538, "uuid": "94778bb1-7ce6-4fdd-967f-3db70a589bf9", "comment": "Malware payload", "value": "89f0dd0fb7c776ae7edf3d270b7dd18b92a56efab0111299a9148921cb27f89e8fa6601f94254e670dd214bea0933959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691538, "uuid": "146bb11f-0956-4dac-aff4-20800cba4732", "value": "T153778C03FA4556DACA559539C9AA03953734FC846F2AEBC76B04F63CACB32C95E74380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691538, "uuid": "07b3c122-12e5-4d17-a41f-e19402c91f2f", "value": "dc05acdcc54c50d47242f7a0055fc73d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691538, "uuid": "37cca0f2-d872-407b-99ad-8e0e39aa2c16", "value": "393216:F/GfF7B3Zdp1uPGiSPWw1JbVg8oOo6dUhbNvME7R31G4hhk4:4fF7Vfp1uVS+w1xFo3k6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708691538, "uuid": "2cf6fd98-b173-4040-a41c-140272db8664", "value": 33201210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708691538, "uuid": "2cfbd819-f077-4f2b-814f-b7ae02c7f5fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691538, "uuid": "ed15f132-72b7-4533-a126-0484031a9ced", "value": "SecuriteInfo.com.W32.Agent.UM.tr.13931.31409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66516a5-d239-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708685661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685661, "uuid": "4e8dfa60-253d-4867-b8b6-71532e99af9c", "comment": "Malware payload", "value": "09a3c2f43b2a9cf1c5086e0cbb808f5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685661, "uuid": "997f74da-1b91-419e-8e62-720426f6c0c3", "comment": "Malware payload", "value": "5f500705ace8f232a58003a3bd5a176516f418f84580b4906a7d0c4a20b85a0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685661, "uuid": "9a288dc7-3be5-467b-ba93-f565033c73bc", "comment": "Malware payload", "value": "07b78900eb4dfac9440cbfd05c8917de88e30f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685661, "uuid": "116302f4-6c6f-4bf4-aba8-642e2abc8704", "comment": "Malware payload", "value": "5565b53ab1d8282558f97d56c5c6ff6f13a06b3726a09ba4edd5dcfafecd707a165c4c8a2e3cc9504801dae831263751", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685661, "uuid": "0297e476-dc57-424a-8d37-4fbbe0e63a50", "value": "T1F4729210436D83EEF66EBAB4C525BC7725D544BC928FA23FF394480A44A8BC485F0B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685661, "uuid": "4bba60e2-ff47-4f82-95f0-7ef8b2b2a2b2", "value": "384:cA66adBAMA6TQzO9ynpubZmuTFxRbqeOWWBx:cV64AO0WmQse92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708685661, "uuid": "2c05f784-7909-48c6-b976-8009f8f2f56f", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708685661, "uuid": "08b14c0b-85dc-4289-97b7-77ea7f7a515f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685661, "uuid": "962ddee6-0ec3-48c6-afef-8d6193621970", "value": "09a3c2f43b2a9cf1c5086e0cbb808f5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4be77be-d22e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1708680880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680880, "uuid": "c213b0fe-db66-4c5a-9355-e86bd6cfd759", "comment": "Malware payload (QuasarRAT)", "value": "7334140f069dad6624414ba158cc0421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680880, "uuid": "f817e019-a807-4b24-824e-9aa797e523bd", "comment": "Malware payload (QuasarRAT)", "value": "5ff11acec7be64be449991b8de232e98ad63c54c8c253868b900f95119e52207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680880, "uuid": "f37f3411-fa88-430e-9cf5-3948c680cf1d", "comment": "Malware payload (QuasarRAT)", "value": "07fa089268ff9d0579b3d72722238f55b2d7e134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680880, "uuid": "9ee94202-d42c-49d3-bda5-8c13dac4aa20", "comment": "Malware payload (QuasarRAT)", "value": "fd966af8c04a88f1e814720744d72468a6523c5055be37b06a630187924b8e3fa1d54dc53565dd2eadf53393281ae46d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680880, "uuid": "c049f4eb-35c3-47ea-8817-fe99f394caa2", "value": "T1A8E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680880, "uuid": "fccda353-a8f2-44b8-a0b0-407ea5e92c90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680880, "uuid": "f8111651-62b9-4021-9960-f4516f226661", "value": "49152:mvPlL26AaNeWgPhlmVqvMQ7XSKwiRJ61bR3LoGdKpTHHB72eh2NT:mvdL26AaNeWgPhlmVqkQ7XSKwiRJ6Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708680880, "uuid": "e318c761-50e7-4d0a-9951-c6062e87143c", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708680880, "uuid": "a26f8aef-1bfe-4706-9c19-8bf75ab43731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680880, "uuid": "89f13140-39c0-4c56-a18d-7ac3018f305d", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c401a31-d234-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708683201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683201, "uuid": "8405b51a-d5ea-48ab-9963-39f5632f066c", "comment": "Malware payload", "value": "cd1a32d372f1391f4054f317284d3118", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683201, "uuid": "5d4365fa-b4ed-4e3f-99b6-4f997f93eeac", "comment": "Malware payload", "value": "6172792669e6903a48d91f18089e1fb8bff72f49a6d3cdd92a605b706b8660b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683201, "uuid": "27874289-3aac-415e-9825-0d4e33039a4a", "comment": "Malware payload", "value": "ff939d4c4666f402dd3457d1d077fa7b27bce7f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683201, "uuid": "1f931d0a-abd3-4168-b9d5-01c9894d5fdc", "comment": "Malware payload", "value": "5a215ceabe24e045e539a85b2a85ef94be1d5284e55929536c17e66605c28f497c32208333af565a1b4273690ca05b58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683201, "uuid": "732f2ae0-33e3-4025-9b8b-8c29c50a7ca4", "value": "T1B113F287BA08F126C5F17C75DCBC4CC7AADAFFB8D6AB410A698461E4F66610282F4102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683201, "uuid": "be662110-d812-41a6-ba53-85be1c71533f", "value": "768:SPHNiBA+E767/D7FT//b2RVbj3/Lt2Hq3UIRiLnqELEdq0vhCu:SPp+is/D7Frb2RVbj3jtzO/LEdzvMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683201, "uuid": "1ef9d29c-758c-4104-80dd-085d4782b104", "value": 45020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683201, "uuid": "eb8d438f-a00f-49f5-921a-90bc2f7664ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683201, "uuid": "de93c722-f231-407b-b6e2-0b09c0665980", "value": "cd1a32d372f1391f4054f317284d3118", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74459ae-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708708828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708828, "uuid": "c43624f2-5a50-426e-aa23-e7d041d65896", "comment": "Malware payload (Mirai)", "value": "bea1bf2ac325430b000e2edf4241b4e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708828, "uuid": "6f88becf-605f-4d82-9e0f-0e34e7e29a18", "comment": "Malware payload (Mirai)", "value": "62166a634fcac6ddc1ec4781af057298efd182ac82a73b20f2c076caa7442fa5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708828, "uuid": "660703d5-6e17-4793-9bf4-9537c6a4f6c5", "comment": "Malware payload (Mirai)", "value": "45891591f5062bdaec775d69cf22d505a808620d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708828, "uuid": "286f2d6f-e532-48ce-8998-c98d202dd808", "comment": "Malware payload (Mirai)", "value": "0d655e1e4403d0e61142907c7ac612ab952652a0ba8aa659d0a006374de652fd1c6255fb4ad7b6a0d3d87423b03cd627", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708828, "uuid": "c746b929-1d2e-4932-9bd7-3385c9b44286", "value": "T120C30872B804DF66F00AD6B604D78B227E30BFA70E6316A2731739669D331D52867F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708828, "uuid": "ff6ef8eb-df39-4353-a712-c380cf09f34a", "value": "3072:7+QJSpmIOBuiV0LEvlQMP7kMPywmE2mm/QcuLB126DNb:7oUJoLEvlQMLywr2mm/QcuLB126DNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708828, "uuid": "d3326dec-9d1c-4b76-bb07-5b80cbb229fe", "value": 118315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708828, "uuid": "b73871df-ef55-41e6-8ea2-6c1cc3b98b4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708828, "uuid": "7b43a1f0-626e-442f-bf14-73dbf40d3f1f", "value": "bea1bf2ac325430b000e2edf4241b4e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93913ca-d26a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708706711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708706711, "uuid": "bd739cd9-49db-495f-91e4-a1be58415e7d", "comment": "Malware payload (AgentTesla)", "value": "168d0e943005972c49d37789f723680c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708706711, "uuid": "4d5f1418-01cb-445d-8075-d2c1a2c9e219", "comment": "Malware payload (AgentTesla)", "value": "6262a2af64ffe825409bcc421ee49d5059c119f31e1aecadeb54224d732b6f66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708706711, "uuid": "39921fc5-afaa-4d10-85da-3450a9021e36", "comment": "Malware payload (AgentTesla)", "value": "e912328392ead4004760e28b629026e2e89dae52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708706711, "uuid": "faae9533-f051-4d76-9d14-89e1a2e09111", "comment": "Malware payload (AgentTesla)", "value": "36330d7c2245f389381bd6c34db5ae19513ed98c576eb83cf1230c27a8f6b5be348e2392015a4727fa77aa6db1123e92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708706711, "uuid": "dbc9a767-4d1f-4096-b733-caf6eb0f1232", "value": "T150340F037E88EB15E1A97D3782EF2C2413B2B4C71633860FAF49AF9524516526C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708706711, "uuid": "f5aa2b6b-bf11-4f70-82fc-a8630b9fa343", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708706711, "uuid": "033607e1-664f-4ad3-8cfa-d27c0f4a170e", "value": "3072:iJl23x1ZVB0a1tVHNgS/RhnFQYWMVtwhK5MARxhY3:eex1ZVBh1DyS/TTdVtwhORP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708706711, "uuid": "78c2b7cf-f473-4458-af41-afedd5b03eaa", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708706711, "uuid": "f31a2331-855d-4d4b-b0a5-9ea8d523927b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708706711, "uuid": "04313f59-1140-4e22-b0a6-f5dec8b80df6", "value": "170870671031091d9447b50a39b69eae51a7dc661a68793cddb0153b1cfd373c412dcbc5fb559.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb17684f-d20c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708666342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666342, "uuid": "b230daca-6020-4f79-a844-dea7636cb77c", "comment": "Malware payload (Gafgyt)", "value": "9835019023baddb2c9d42b351e0e7f75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666342, "uuid": "4475b28e-308e-4493-bca1-7e07f8162125", "comment": "Malware payload (Gafgyt)", "value": "62cbfa1dbe818320cf4e15afbc5a055eb3d95e7025daf64d19c256b9491286f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666342, "uuid": "ad1095b5-4e07-4f20-9943-80f59ceb335e", "comment": "Malware payload (Gafgyt)", "value": "81c42f10f6b0dad209f09a02922124a608e9b0b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666342, "uuid": "cb66cc41-5f7e-4c55-9ede-9bb16799ed61", "comment": "Malware payload (Gafgyt)", "value": "3e5e0f931457b18e6a0584ed3413565181bc488ade18dea91a029a96a46aa9b72eca7648cfac2c706c973941f6c83fd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666342, "uuid": "47c37297-0206-4151-986c-858fa05f0530", "value": "T1AEE34909D7408B57C1E2277AEBDB424933339B54A3D733099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666342, "uuid": "81684dda-a5ea-4705-bed5-788a04978c70", "value": "3072:ut8iFDKEfFN+Fa+1sWgh7n1erM/9pUMbmQwfCMQiGW:s8iFDLf/+FaNRh7nsrM/9p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666342, "uuid": "736fb209-85d1-46ae-9550-12439d27c7f5", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666342, "uuid": "17465ba3-bf89-4954-b6cc-14f7c2945499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666342, "uuid": "b7d77607-2fbb-4170-8333-e95ce786db41", "value": "9835019023baddb2c9d42b351e0e7f75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971291fc-d247-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708691541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691541, "uuid": "432ac0f9-eadf-4447-a9f4-4e83a34b1e15", "comment": "Malware payload", "value": "dcb25595e98555b779dcc5081151a740", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691541, "uuid": "227e9775-53de-4346-b854-7567acdd1df4", "comment": "Malware payload", "value": "6398c3d4160a8b3b9851ffd38ad54a6e5a228fa2bba169041ecc90c98fd9635f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691541, "uuid": "6f7aa8d2-a215-4f10-b7d1-fac48397eea4", "comment": "Malware payload", "value": "e2b20cf6ca21285776e6fced3ee5c701593c04f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691541, "uuid": "f93194ba-b46c-467b-b170-edea8d34b6c2", "comment": "Malware payload", "value": "d1756f8dc512f30de379d09296e2317543daea206e2533b95d81e73b36d384a2b842d48a3b60e2fa8b0eafdc42f579c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691541, "uuid": "191bc089-4ca9-483a-86a0-63746aada6f3", "value": "T148C67D16B288A03BD1771A7B4827A684683EF3702A15DC5B37B44F4C6F3AB917927347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691541, "uuid": "f755c81f-595c-41d2-ada9-29e41d9b936e", "value": "ecd8af0af767aa2485ede0d01dcd8eb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691541, "uuid": "c84b7869-2def-4c6a-aaaa-a4728632b6d8", "value": "196608:FyP+YYw6a55x0yTq0vCqTvTAf3mpvg0V5cWwyG/8gFE:FeCw6a55x0yTq0vCovg0V5cWwyGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708691541, "uuid": "ae10ca25-ddbf-48cf-a441-de72438de108", "value": 11838464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708691541, "uuid": "b526d8c8-c7bf-4b7c-977f-ce10ca4b02c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691541, "uuid": "cde4d16b-7b98-48d6-835f-1d80893369fc", "value": "SecuriteInfo.com.Win32.SpywareX-gen.29536.7811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43956a8-d220-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1708674920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674920, "uuid": "34aa4e04-4bf1-4e0b-8d30-1642a1abddad", "comment": "Malware payload (Amadey)", "value": "b1e43539944a87a10286e608cd944c25", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674920, "uuid": "304630ca-efe0-4cd7-9520-9a888a5e3693", "comment": "Malware payload (Amadey)", "value": "6440f350d25dfd6a60448097b6996e23c99439705befd01ce6383dbe62551fee", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674920, "uuid": "56cc1e89-966c-4104-962c-831480725a5a", "comment": "Malware payload (Amadey)", "value": "21ef60ca0bb63141e515a4c1f35ca156d83b7ba8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674920, "uuid": "b87c2f88-c74b-455c-b8f3-490a678dbe05", "comment": "Malware payload (Amadey)", "value": "062223401c18d5ff66882c45e8e786e4656141406c89d19caa3fef4c4a84fd905ff3d4d3e7352bd3379bf02c56d676d4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674920, "uuid": "ca4a55ec-3f40-4607-825a-d0890001b019", "value": "T15E557C0FA26541BCD4BBA1789A135947F775700603709AEB07E446AA3F53BF1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674920, "uuid": "3f25546b-fa02-442b-8330-8fe0fe146fe6", "value": "3eb70f83441fc8632e81bd6eb89f424d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674920, "uuid": "69483aa6-0462-4785-bdfa-ce364a75997e", "value": "24576:dvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dgglO+yC7:dsMPSYcS5wPi095PbgwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674920, "uuid": "9da4e5bd-c4e3-48d5-b31f-87bfe22ecd8b", "value": 1285632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674920, "uuid": "a08f8b81-e567-4ff3-b330-70da807d0ce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674920, "uuid": "62abce0f-a814-40e9-8007-4e01a673b695", "value": "b1e43539944a87a10286e608cd944c25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96f3e7e-d299-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708726817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708726817, "uuid": "15571511-60b6-4033-92a1-7927636b212a", "comment": "Malware payload", "value": "bae9a139a2062c3e3b42c9c6845ce252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708726817, "uuid": "53070291-2563-460c-ad98-1c96b86db89a", "comment": "Malware payload", "value": "6456be4321465dbd715568ca4bda48c1c7674c08ad291b18c1cb0c183f63e028", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708726817, "uuid": "ac5e4bef-5aa1-4bef-99ad-30651a3fb568", "comment": "Malware payload", "value": "d8996c034c02759b858affb432ffb6f4c9ef759a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708726817, "uuid": "d4d37cdb-c2e6-4dad-8a1f-15ca68fa9a45", "comment": "Malware payload", "value": "521488e5fa122363780957d40523681e98920ff893f480e70866163bd665495a7a5f953c695d29b765f2d3b9a8d28a83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708726817, "uuid": "03fa7562-7154-4f1a-b6e8-b0beca177ebd", "value": "T16A068D7267A2867FF47246F06A3C9D6E5439B5300774B4CBD6984C6A18B8AC20D35F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708726817, "uuid": "74c30c85-49de-4248-911c-84f37031321b", "value": "4a3373f64999adc95eeb1061dfb317d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708726817, "uuid": "8f5a5de3-51e9-4c2c-a2e9-320996251333", "value": "49152:+fisGyCc38nMKTBoeANyvTDNpwP/T0hS1idvMd81XWrWC7WA94UQX:XsKc33ydwTv0F1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708726817, "uuid": "dad0b41a-c8a5-4ad1-96c9-1a6103c7c668", "value": 3962696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708726817, "uuid": "3228640c-3624-49d0-9e35-fb2d2bf1b50a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708726817, "uuid": "ca102b99-190b-429f-b923-cd7f340192d5", "value": "SecuriteInfo.com.Trojan-Downloader.Win64.Rugmi.15694.558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf62af0b-d220-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708674885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674885, "uuid": "a41b8efd-7b38-423d-88b8-781ec6376dd1", "comment": "Malware payload", "value": "74925465eb3fb23d4ffa373ea04acefd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674885, "uuid": "7aa5be97-c1d5-43ad-a1f4-273dd26d5b9f", "comment": "Malware payload", "value": "6540f71d7d1ba5fe2869e4e55ddb11bd8a0c3a7d7d0f3b3ed2f79dec7a996b2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674885, "uuid": "bc7639b8-cae0-42c2-aff7-85d5f941daa8", "comment": "Malware payload", "value": "284e3270ec9dfe433bd30ca81a523d8c13c8590b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674885, "uuid": "d8ac728b-6c4b-4460-808c-6df909566071", "comment": "Malware payload", "value": "be8924f91463c7add4ed82e196d9ac8a0c272ba75106b80ab0619b592684d7f033e1111910a574d13e763bc50f86498d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674885, "uuid": "2a4ed389-6119-49bb-b8fa-f8ce0136588b", "value": "T15A4114591FD01F33DD66CC36454B2B513ACC842BA16B33965274D960BD3FA04E7D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674885, "uuid": "e35cc5a5-950c-4676-93e8-1a89e20a319c", "value": "24:mNBj3HsSimpHsWixZuDa9mCt52JL4mmlZ9bpe4g+/qc+UTK8WKUlu/eTJWvwFLCf:EQ2OnuDW326df9++SMTLWPkeTE4FWXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674885, "uuid": "bf92130c-eee5-415c-b98c-3236684ffb1c", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674885, "uuid": "0e1893be-81a1-4323-a632-588c742ded04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674885, "uuid": "c309dfb1-c5c1-4817-8b84-7cfef9d318d8", "value": "74925465eb3fb23d4ffa373ea04acefd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658f1baa-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677714, "uuid": "b925a7e3-40c4-43dc-b4d5-63e25d1aa7f6", "comment": "Malware payload (Mirai)", "value": "394ea9ec72035c1199c97b9ec082d320", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677714, "uuid": "34e45378-3c12-46a9-91a1-44f104659d1c", "comment": "Malware payload (Mirai)", "value": "656ad35ff3df2223dd7ea57c3f01d502b2671703a03d00f72215fb2c8fb11a48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677714, "uuid": "8736fe7a-9c12-415a-8e8c-20977bc37503", "comment": "Malware payload (Mirai)", "value": "d4445b875f6b35660b2f7065faf8139ef924f905", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677714, "uuid": "4254d247-05f4-4524-8fd9-842a607e483e", "comment": "Malware payload (Mirai)", "value": "fa1a4d1ac1ff7cd6b32975e163a58450583f962820b80e08f4d7afa8a583ca10e509d6f87ec07eb803f022eefe5aa2ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677714, "uuid": "dbb00cde-32b0-4186-97ce-0aebbea99506", "value": "T1BDE32A02B30D0A47D1632DF43A3F2BD193EFEAC121E4F644655FAA8A9171E325586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677714, "uuid": "f19fa2cf-bc69-411f-85f0-cf26b4741ae0", "value": "1536:NqasIyRlSuRkVjxpuvT0sNjvDUqgQA6GVpSKzDPzqvAoYLmo9ovzt77iqnD:HsqVjxc7xvi6yScnoUqnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677714, "uuid": "c80a898d-572a-4602-b85d-4258dd0d3fed", "value": 150392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677714, "uuid": "17ee0c19-d904-4136-bf30-269f7ffa2173", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677714, "uuid": "f4efa694-a7e7-4f56-8809-bf756039dc3f", "value": "394ea9ec72035c1199c97b9ec082d320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f759f29-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708705299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705299, "uuid": "c81b4b4c-7263-401f-b6db-f2f2280a8227", "comment": "Malware payload", "value": "dcc8804d7623f704daba1fa9774f618e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705299, "uuid": "bfbaed83-0cfc-48ed-973a-ce7dcc500002", "comment": "Malware payload", "value": "678bd2b75691474e5ea1c25f713481381f1a814cdb4d28fea01b6c0e192acc87", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705299, "uuid": "ca3f512a-5db3-449a-8424-69b20b2dbb97", "comment": "Malware payload", "value": "df42a094bd9ca7c50039cfb0711e20532d0f2301", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705299, "uuid": "33c72082-d5f1-452e-86de-9683894c1f54", "comment": "Malware payload", "value": "757b0f7c4e356439a8b1baf614506a2abb9ead7548d38e8e03ccba5c24920bf46931bbbd083cb87e9878b916d1425fb1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705299, "uuid": "6b4bcf8a-8e26-4fb6-916c-3535949e14d0", "value": "T15753014F8DBFADA39F79818188130CDC159B312BFEF91E367945270F957A450A80350E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705299, "uuid": "cbae5cce-4219-4cca-8f3e-a722399b117b", "value": "24:wKAg5yyyhFeDSrqEQaeD5/69JrD5W269Zpn767ZDttA9:wzPqIqEQa469Jk2697ED89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705299, "uuid": "9a4ada66-20ba-43a5-9940-766fc412cf11", "value": 66679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705299, "uuid": "6a4fddd1-7847-45f4-85e4-e8767dec7668", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705299, "uuid": "1aec8e3a-8f0a-4037-9fa5-fbb290f7f217", "value": "ETMN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76892c2-d20c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708666282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666282, "uuid": "db4370c2-c45c-4c48-a009-874ff7cf54d2", "comment": "Malware payload (Gafgyt)", "value": "ef1aafedfddd35bd23e2b08a56d32ffb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666282, "uuid": "f68eee3a-20cb-41b9-902d-ce6c4c0ea7fb", "comment": "Malware payload (Gafgyt)", "value": "67934812c3dd7beee3d6dafb796574c7709d0dd57e049d3d948f5a0155e3b724", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666282, "uuid": "3c64363d-629c-4e0b-bf7a-c223756d140d", "comment": "Malware payload (Gafgyt)", "value": "9fec7b2881396e55e91017825bc2394e38819b34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666282, "uuid": "c42d6aa1-fec1-42fb-96dd-d1e59a0152a0", "comment": "Malware payload (Gafgyt)", "value": "4f5d4e402bcf631fadbf77b024466d135d2be6a3c0a8cda7adf3eeea00385f07b280979e714eea6c66afa6f7c120f3d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666282, "uuid": "aa8c627e-8297-4975-834e-ba6cf9737bd0", "value": "T1D3E34905D7408B57C1E2277AFADB424933339B54A3DB33099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666282, "uuid": "1ca75c44-042f-4121-b5d6-86848396fe09", "value": "3072:it8iFDKEfFN+Fa+1sWgh7rz0JH/WbUMbmQwfCMQiGW:g8iFDLf/+FaNRh7rz0JH/Wb5mQwfCDi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666282, "uuid": "672d2749-3ab5-4872-9dce-b9bdba02d522", "value": 150077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666282, "uuid": "7ecbff2c-7fde-4afc-bcab-747ae24b42e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666282, "uuid": "0861c0b1-40f7-4e99-90ee-be01a92a93f0", "value": "ef1aafedfddd35bd23e2b08a56d32ffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c090d456-d220-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708674860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674860, "uuid": "dc47338a-00a8-47a9-9563-4c52b9825b9e", "comment": "Malware payload (Gafgyt)", "value": "fd700d079a2accf3255b03c70baad27d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674860, "uuid": "4f397b46-9adb-4e21-b249-3dcf385f725d", "comment": "Malware payload (Gafgyt)", "value": "68cb5823bf68b6e56e46cbbc8251b79782292e6874530835e61c49e4cb843cc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674860, "uuid": "ab22b998-ecca-42fd-8369-155bc48a3692", "comment": "Malware payload (Gafgyt)", "value": "8e36b2f2057b6b2d10fca6305b1c82d43b8af7be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674860, "uuid": "5c86eab3-a60d-4286-becd-1eb081287702", "comment": "Malware payload (Gafgyt)", "value": "b3419b681ea2609c9b159ca9533552026a4df61297f297ba1526f1e4a139fa4cbdd864f9f7df611644f3a4f7ef96e7e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674860, "uuid": "3b97fc1d-56a0-4018-b539-11be775265c1", "value": "T19C31CDD1A7D05DB9C4A411BE9E6B4314B3699F84E0C67622920CA3286D2FF785D26486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674860, "uuid": "64bdce9f-2a19-48e0-aed7-1ae059270614", "value": "24:uAlKGpa7Urz/jlf+pdAXK1h2Vev3gRGH9i1BBuLlWWI9gSO:uAlKGpa7UrLZy/1z2BuTI9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674860, "uuid": "9d2fe86c-5644-48ae-9339-b0e50478acd8", "value": 1492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674860, "uuid": "5cece0e3-c594-42a5-b032-2cf09b9d1ab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674860, "uuid": "1a89b34f-e8da-4538-b5b5-90ae0457d16d", "value": "fd700d079a2accf3255b03c70baad27d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498a7aa6-d23a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708685827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685827, "uuid": "3c01e2b4-6554-4041-a37b-e26ef5f3f2f6", "comment": "Malware payload", "value": "106ae76b4fc6af126c498b6ddb5c3638", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685827, "uuid": "d6268eed-70b0-4e0c-b7e9-ee351f9403c7", "comment": "Malware payload", "value": "695c1ff840d7cfa5ce31a56422f8419e6970143267c2bad1cfa7799a0e2266c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685827, "uuid": "4302fc92-ee75-401c-aa97-85fd7364ea32", "comment": "Malware payload", "value": "fd42d93f9dfc23ba9aebab7e9b5afd0190a0addd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685827, "uuid": "91601928-83cc-4fc2-a3bf-d0bea6fab3a6", "comment": "Malware payload", "value": "ac2c112d230af6573945e06778edf6e4e9d72ff818beeecf84b425e25a44e11feef6743b1d87f94b39830fdd019b73a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685827, "uuid": "5d7cbcfb-6a7d-49b5-9c5d-9b0fa380a2b3", "value": "T1A56514046E08823DCD6142B21EF9DFB1443E6D55AA50719BE3FEBD9B77F00A33621299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685827, "uuid": "07a4c805-4fe3-4ee4-8870-147c3fb45c8c", "value": "8f4a922e25604bc6fa92bdf9805a991e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685827, "uuid": "292403cc-a7ea-4db3-9ce6-f56f6c245e7b", "value": "24576:9yzl7+m0Osynv2BC0H9cb5u8fR6L7bn15rQdVK56PO:4z5d06nv2BC82b5u8fRAV5roK82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708685827, "uuid": "80d567e8-7658-4dcd-befc-ab59733aceac", "value": 1475168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708685827, "uuid": "4583495b-e082-4cb5-ab29-58bcb8318910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685827, "uuid": "2fd6ee5a-13cf-4ab8-9718-c00eb1e91126", "value": "106ae76b4fc6af126c498b6ddb5c3638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e817a5a-d234-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708683259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683259, "uuid": "3469740a-b2d9-489f-8373-2c61a2d6d297", "comment": "Malware payload (Moobot)", "value": "1bbe3fbcb752001abf77f738b453f417", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683259, "uuid": "a70ee5d7-4374-4959-9f10-f1c3d9a851bd", "comment": "Malware payload (Moobot)", "value": "6c77a5c20f394b1c1c930f28cded4784e299f7c6b9429851e140886a9c632172", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683259, "uuid": "93dc5675-2280-48d5-a11b-b2b4d6775b52", "comment": "Malware payload (Moobot)", "value": "167de6092bee30d30d790d33088a471da7781dcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683259, "uuid": "b072df17-cdcd-4ca7-8365-b4eebe19d23b", "comment": "Malware payload (Moobot)", "value": "a85a07dc67c69924d0fa341a2cd685fa4ca6e7f3ac74089a086a4c4a941f3291da1431aa13b1b5fd50f72e341b25b3d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683259, "uuid": "d156a000-4965-4db9-b5a1-3034785d90b0", "value": "T15EC33B46EB418B13C4D61775BAAF42493323EB54D3DB33069A185FB83F867AE4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683259, "uuid": "a5144970-ae42-4578-963b-41387a2771f7", "value": "3072:YslGp1lgHiEhxAJA67WPr50QGiF31M/9MD2:YslE1lmDAJA67IrgiFFM/9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683259, "uuid": "2aed0cc8-5bb7-4376-92a1-eb06aa4def14", "value": 120661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683259, "uuid": "dc24af5c-647b-49b4-b807-f6d08ceef640", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683259, "uuid": "5c8472c6-1795-46ee-98aa-ee95cfa61b11", "value": "1bbe3fbcb752001abf77f738b453f417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae13cde-d28b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1708720511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708720511, "uuid": "7899529c-fdb7-4c71-9d62-b32d36673515", "comment": "Malware payload (njrat)", "value": "31d526f2a0555e904ed31ec797e8151f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708720511, "uuid": "ac61422d-b892-4ed1-8f7d-adbbc1cdafca", "comment": "Malware payload (njrat)", "value": "6d4056dce7464a436ab92a94702d79b48f861daa8f97d29c30b26c3461f3f0a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708720511, "uuid": "7ceccfb2-e87a-47a4-914b-5da30cad4e67", "comment": "Malware payload (njrat)", "value": "742d84337a209d151eace5f6ab3aea0f3c1fac16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708720511, "uuid": "d614582c-2d2c-44ea-a2ac-f8f0698d91b4", "comment": "Malware payload (njrat)", "value": "90fd122aa0be2c2bef34a848fa8db97e555b8a3406fc20c9e4a488049b58002ea29fbdf32efa970cf9210256ddedbd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708720511, "uuid": "0aa0a712-b252-40ac-9aac-4d7d7c720d3b", "value": "T1EE3533A016C56952F74870F01391CBEA728BC30393FA7EF66632ED5E048DE970672E56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708720511, "uuid": "de921078-0e8a-486f-a131-ba0d03fb230a", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708720511, "uuid": "d50c3e5d-3e9b-4994-b83b-a62097f3d0fe", "value": "24576:1ffWAsmm6oDJksQSeW0maMjxc7RKm95rkwbfPH1CKUXpdIDFoas9:1ffWGoasOdM+gm95gOfPHnb+aC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708720511, "uuid": "949ef0ec-2ec9-46b5-bf89-e82c27b36ac4", "value": 1131520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708720511, "uuid": "c3f4e3ce-a217-465b-92de-8a9379437254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708720511, "uuid": "581e5eab-8501-4664-ae40-5eb18d6ba33b", "value": "31D526F2A0555E904ED31EC797E8151F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61c71a2-d260-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708702304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702304, "uuid": "0e4cb356-6e99-4d29-a563-032263d0626f", "comment": "Malware payload (Mirai)", "value": "7a21aa041c41a10516d21b89d2401610", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702304, "uuid": "dfcefd66-661a-47d7-bde5-ac1aa7460b32", "comment": "Malware payload (Mirai)", "value": "6fe2e9690814974a3a98a7bd310a4d5444af97e193cf425e41970b2efea1678f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702304, "uuid": "90267b9c-6b58-43f6-a53a-d7e2e0016761", "comment": "Malware payload (Mirai)", "value": "82de075fe98012b49099c7507b48f831ca4a2f72", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702304, "uuid": "46e679ec-24ee-42b0-bd0c-8636e22d0c74", "comment": "Malware payload (Mirai)", "value": "cbdb1317cddee280dfaae73a61466fdbcf182562fb16cda69777ba785fddcf59217a45beea497ac9d0e2d948d11301cf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702304, "uuid": "1e70b07d-3cc8-4ac2-bac1-0b3b5770e0f8", "value": "T1E403F851BC829A77C6E0137AB66E4A8D376063E8D2CF7217ED204B247AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702304, "uuid": "f72920af-df2e-430b-bb3d-4180cef8b9c8", "value": "768:vgOWCbfsG5f0OSnlUlTOiF8AAwATb96YWULv+bA6F7rAkXoTU/NLwy8:v5bUG5fklUlyoMdsmv+JikDWy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702304, "uuid": "6c5a1df8-5aa6-4ebb-ac6f-aeeb5094deb1", "value": 40948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702304, "uuid": "2eef31d5-49dd-4ec3-9ecc-ebb3b18b5637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702304, "uuid": "b8511134-2a09-43a2-90e6-f5de0528676b", "value": "arm5-20240223-1531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae36c87-d238-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708684890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708684890, "uuid": "86af53e3-3366-4082-bb5f-a3c012247b44", "comment": "Malware payload (RiseProStealer)", "value": "c1523fd4b7d3722231a86986a61f2b06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708684890, "uuid": "6514c50e-5095-4f01-aa5d-25066912b686", "comment": "Malware payload (RiseProStealer)", "value": "71908b715c7895e39959bf1f7e5f68d3901ba857da8685d5b7bbf9e667c9223e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708684890, "uuid": "542c49df-4295-4105-9646-be9ca0d05337", "comment": "Malware payload (RiseProStealer)", "value": "09411ed89f4959e3a21a1752f50c6b0c855bc2de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708684890, "uuid": "a73a729c-3293-4ecb-a225-b51e5c0c3990", "comment": "Malware payload (RiseProStealer)", "value": "c1627983d7632a31faed42be1d67596e8bb15252caf54794dae4bcb3ab952b7c58b769e402b9374f93176b9a67b182e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708684890, "uuid": "044d1547-56a6-4e1b-95c1-c81f1360ef83", "value": "T13D56336A3FD224D5C88762745502FD3DB6B4AF670921AF29E321B3E7D8D36A80531732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708684890, "uuid": "e4687895-6d2b-4347-82db-b9cb0af4de9d", "value": "d716233fa9e0a1b9e5f58fbed8dcbfa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708684890, "uuid": "8849c6be-b509-488b-bcb4-88ad13d46d57", "value": "196608:mN9OclaMjiLI7rjk3r6zugcBPRvPLPAk3qjh/2eju:mN9Dyirjk76zuRRnUk3qFOe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708684890, "uuid": "83e76f58-c9b7-42c5-9bf6-bf4576e5e339", "value": 6370904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708684890, "uuid": "1df58664-52ad-4995-a5c0-1682af990b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708684890, "uuid": "0da42504-ed4f-4fd9-8061-da317ec47163", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4996ab-d266-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708704789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704789, "uuid": "1cae3a3f-97ad-4d73-b7fb-852acc307343", "comment": "Malware payload (Mirai)", "value": "e923a0e20d2e9c6b63667b264a1c2a22", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704789, "uuid": "65670923-cd63-4901-a505-74d6609302cc", "comment": "Malware payload (Mirai)", "value": "7222a0dce5ac073f6f74e9e4ec353f27fd3e31eed138fd964d1588784974eed9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704789, "uuid": "89088030-06cb-453f-a5ba-1946816286fc", "comment": "Malware payload (Mirai)", "value": "ba6f15ff2a3f6ee20ecf806925bfae97efd02756", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704789, "uuid": "4521044f-2ec2-4e0e-885f-714647760778", "comment": "Malware payload (Mirai)", "value": "254a80aeddad3e84c54339c51406f51a84d4a7d9339bcc90d200f31ba3688f0f59833c5866f441e46a0682373e2924e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704789, "uuid": "aebeee69-1b41-4502-b26d-c1bb855abe9f", "value": "T1CBA36CD0F743D4F5EC8705B0207BEF365B32E4B9111AEA92C3785E32ACA1455D61AB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704789, "uuid": "5f032dba-be07-411d-ac44-d4d42199f56b", "value": "1536:Iobylwzk4Ad/7aDkgxunCJtfQkP7Iy6/Hj/L+HSOLZoYolcOCr1:3bylwzk4AUjxunMTPEH/Hz6yOqur1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708704789, "uuid": "7f2dc911-8d13-4dae-8adb-b0695cfd0f70", "value": 100808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708704789, "uuid": "a8528649-0f84-4824-bf90-6a0f7502d111", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704789, "uuid": "9194aeca-fb8f-4d27-adac-e69e11bd60ea", "value": "huhu.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e009da6f-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708705837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705837, "uuid": "e05669bf-e911-4b3f-962b-dd1b26d37c2a", "comment": "Malware payload (Formbook)", "value": "7eb83953d589aa92305e8fc291cbb417", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705837, "uuid": "d22f6b9a-2963-4c49-8592-3f2c8b381dc9", "comment": "Malware payload (Formbook)", "value": "7481a14de312bcebb97adee254982e5590c10d623f8d0d9002b23931f5e455d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705837, "uuid": "de35175a-6fb4-4ae3-9c25-2319e4ea692d", "comment": "Malware payload (Formbook)", "value": "e41e26068cbbd2d5b9953b85091deb43da90aef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705837, "uuid": "ea1f100b-f786-44fc-bdcf-08749990b0c5", "comment": "Malware payload (Formbook)", "value": "d97a0029a4d7a2dd775af0dd2d415c4d40a1cb303fc8703aa8d290aaec1711b2b138882a2eb74cb8cc66cc07ed7e9af3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705837, "uuid": "15998e9c-a8ca-4734-8adc-bb3ea981f7e0", "value": "T150F42319737A4A63ED6FAAB81435066007B377366092E7DC4EC979CE4096F08DFA0E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705837, "uuid": "08b55969-3365-4907-844d-e78817caf591", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705837, "uuid": "8d777178-acb3-4b41-91dd-3847de566db5", "value": "12288:RlW3vmzBh35PZOsDWh5O5XzHB4joVLwJV1xqUgWF97xTsLQ+AyA6:XByfhIXjB4QuV1tgWFpNspAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705837, "uuid": "86a7f095-5f6c-40da-8074-bb285d25df23", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705837, "uuid": "c8cd32d9-a15c-4992-aaf0-bc331f66e7c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705837, "uuid": "0489353c-a162-47f2-aa7e-f7caeb10aa82", "value": "\u5b87\u5cf0CR 2032 UN38.3 SUMMARY\u4e2d\u6027\u8bd5\u9a8c\u6982\u8981\u52a0\u9632\u541e\u54bd.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce55887-d21b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1708672572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708672572, "uuid": "3d1e9cef-56be-426d-b593-de608cab06d2", "comment": "Malware payload (XWorm)", "value": "613ef0d5bdae17ec18673ad3e2fc7190", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708672572, "uuid": "dcf40be0-0b25-460c-93b8-996ffd41fb2b", "comment": "Malware payload (XWorm)", "value": "76e5afc38b0b35b206dbb0cc598e264fe7cea0f0317d275e8e9594b61da6670a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708672572, "uuid": "36a0fcc0-def7-4cc2-9f0f-75b8d7429761", "comment": "Malware payload (XWorm)", "value": "5549e28396266df9ccef247e5b300faff690d0f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708672572, "uuid": "af8bd591-ae79-4c03-b51a-bd50303099ff", "comment": "Malware payload (XWorm)", "value": "27766b921590577d2ff1e9d2bb7f5621eb52d63fe3a702ce0faa410b6d667f3013a0a5c945af939da7df6633dfaa27b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708672572, "uuid": "0ab5eeb4-2e8b-4562-91b3-38d02765aee3", "value": "T17CB4120572996F23E1FE5BF21832E2425BB6B3E96A95E70C4DE060DB298574844F1F23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708672572, "uuid": "7d1f3599-b360-4799-b379-9a12d324d9a1", "value": "6144:dcOz7aacDL7yBXAE5hzEF21SucKg87j9THZBfaX+MuOZuBXPNA38L+/+k/ejIUeB:dcOz7a7DyLECSmDBRhU2+/5Y++NyQba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708672572, "uuid": "945572b9-b5da-4da3-9e6d-439909f9b6bd", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708672572, "uuid": "375ae195-fd65-46dd-ba3d-89c79ebaefba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708672572, "uuid": "abc4706f-43f5-4d24-990c-db16a42e6cef", "value": "Invoice + Packing List # PKCGP2410001 - 02-23-SO-J443 - LOAD 463722105.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f4ea3d-d247-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1708691532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691532, "uuid": "2c402c48-e0e6-4cb5-a309-f75f5e4745f4", "comment": "Malware payload (DBatLoader)", "value": "c854d0c5426aeec8345f5856abc84c29", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691532, "uuid": "046da891-a5ba-469c-9b61-b8d58c7bbefb", "comment": "Malware payload (DBatLoader)", "value": "770d33c521f6d3a4bcefff2e106a0f94472110105b57c17bff3cdd25b1dfc489", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691532, "uuid": "a83cfc6f-9128-47f4-ae4d-84ebfa91e55a", "comment": "Malware payload (DBatLoader)", "value": "9ac17474a7ec53dbb365b1e612be6b1e7c48eb7c", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691532, "uuid": "bb17cedc-7bd1-472a-9fc4-932a77b87918", "comment": "Malware payload (DBatLoader)", "value": "0110d33d09fa3c0b9324a32428a40313896ffd60f1a353e5b0deef0c60606a1ec734755d70fbaa78adf96077603e84df", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691532, "uuid": "b2ee107c-43f8-4edb-b728-bedb65f5a310", "value": "T16E85C0A3F1D0812AD123DBF5165799E4373F3D312E18678DE5E63B990A349E068E3623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691532, "uuid": "edbbb2e3-cd8a-427a-a8dc-0448ec15481e", "value": "e36cdb81e59d5a4701e323e960f1f7b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691532, "uuid": "6cbc4b1c-95eb-4cf4-b611-afd761ff055a", "value": "49152:2uLqn8Y6FlWZ0vH/k3mlXoQq7TuN5udi8ewnXZCz:2uZp/k3mlXoQq+N5uTXZCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708691532, "uuid": "7c3dc54e-c1d2-4bf1-bef4-f054418a8966", "value": 1800192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708691532, "uuid": "f9a59a7d-57fa-474f-94ed-8275c6a9b320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691532, "uuid": "0b6068dc-5b14-4791-ab00-22f86e0202aa", "value": "Bank Swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2e2af7-d266-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708704780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704780, "uuid": "b4149419-0cdd-4132-9433-7648455dfd4a", "comment": "Malware payload (Mirai)", "value": "59142c87267a91b173d1aae09a209b6e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704780, "uuid": "f3f18d28-444b-4b47-a612-2d12cb614ac0", "comment": "Malware payload (Mirai)", "value": "78d8e9600a7c540af5a4fe71a9ea74f548b367f09b33545d82ca8b614187f6b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704780, "uuid": "41fe3fa4-ebf5-4d8a-9a70-3858f2d974f0", "comment": "Malware payload (Mirai)", "value": "7c7bd1a8be1bda55b7cfec7a52d522d98a7cd064", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704780, "uuid": "b9bac6a5-3865-4cd0-8365-932f3f9c6ef0", "comment": "Malware payload (Mirai)", "value": "b47eb6cceeb62bd5b12fa6def552267cd2b37dca05731d8577fb5aa833d4bc94b563ec5785da6ee099380caa33f54f3d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704780, "uuid": "8f26e906-f992-4816-a793-96a98e459be5", "value": "T15FE31945F8519B27C6C212BBFB5E428D3B2A57E8D3EE72039D215F24378A85B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704780, "uuid": "97b8e616-90b7-440b-8dc4-c0c1b150dbfd", "value": "3072:DZh7ROConcQldqFPIX42lbfCH95CwALvk/1:DZWIQa5442xfCHOwALvkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708704780, "uuid": "46af989e-1fd9-4dc3-9aa6-bd2dc96b3255", "value": 146272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708704780, "uuid": "367cd457-4fb8-4db8-9e70-80c6d30c722d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704780, "uuid": "1aecc9f3-b8c7-4320-8e37-17777feeaf37", "value": "huhu.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e195721d-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708705839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705839, "uuid": "1458f032-c9cb-4019-962a-64cb00a42e6e", "comment": "Malware payload (AgentTesla)", "value": "c134629c566048cd653ce119a6eadd9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705839, "uuid": "7909e0fb-7482-4930-b58e-31b18ee2290e", "comment": "Malware payload (AgentTesla)", "value": "78dac565314a7e69e1a85d90cc4955ea39164608fe9a89b7876cf0939e6e7596", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705839, "uuid": "48655ee0-e4b2-422f-b44d-1420450bfa14", "comment": "Malware payload (AgentTesla)", "value": "52121fde6fe179fc90a6e15caf9858a01a316165", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705839, "uuid": "a98e09bd-824d-4e2b-9233-1542ea691c13", "comment": "Malware payload (AgentTesla)", "value": "d0fee7deb9e59f52c2b530fd029380023fe7dc62158d73c887b42e06b9f3b59ea3b595cd8d42fb48f7c4fdbb56936165", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705839, "uuid": "31062b6b-8bc1-412b-a6db-d203b41502b2", "value": "T13C238F01EA1CC33BEC6E0278985221C27779D341B3D7FB798E56409A694379472B1FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705839, "uuid": "673dceba-3b27-46d6-9021-4fc407dea515", "value": "768:wVyuvE72jc0SQxsBGVQum77NkAdltI7qLU/Md2spNpyYboJRDe5uw:wsBVQxsBGVQuCGATtI7q4/bcboDeYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705839, "uuid": "2b61c9d5-d3e2-44e1-95bc-3a522f5ee694", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705839, "uuid": "7c75128e-ac0d-4043-87dc-7f6357c8015b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705839, "uuid": "f6df0882-04f7-4dc0-995f-2e3ea25c2b16", "value": "cotizaci\u00f3n1345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b429370-d24f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708694796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694796, "uuid": "493bcbe6-ebcf-4d1e-9881-0262be6dfa29", "comment": "Malware payload", "value": "b8fb829a0ab3036c55e8d410ee626c83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694796, "uuid": "734bee2d-29ac-409b-a587-1c5a7166bd5e", "comment": "Malware payload", "value": "78fe0cb96e30c69c3e81eb715ed811faf25cc7b258935e3b8ddce6f2b7b550b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694796, "uuid": "e06e5fa5-44e0-40f1-b826-ac96d78b7d1c", "comment": "Malware payload", "value": "008efa7d2f463471528dc8710d76a7077282b9fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694796, "uuid": "0affadf6-9d5f-4e99-b95c-80347bd90ba3", "comment": "Malware payload", "value": "5cb50cacf08ca44da8895c8851f26cb50f9d0cf1bd7ee3443463c350db57061ba079d9f8eea83de164561d15011406ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694796, "uuid": "0033afb1-7315-4256-8e69-7aa6e4524b36", "value": "T13CB38D42B5E2C053D441837281A80B7A2B37F9F01BB579CFAAEC5D8E76544B1872BB17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694796, "uuid": "66bcf905-c8cb-4f0f-b9cd-dbe8c36aa3f7", "value": "1536:u02MAnqfyOedz42ZBwl/Ysk5JUK9/8SIm8PF58Hk:+jnqfypVZql7k5d8jRFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708694796, "uuid": "73885194-62dc-4048-91b0-43190961a7ec", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708694796, "uuid": "7f58d5ab-466a-4451-a6dc-3a8be5bcbb24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694796, "uuid": "9e90bc4c-27dd-4999-a709-8d0ed860571a", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.10852.10312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4040b9-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708708807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708807, "uuid": "5f8b8e92-0231-4486-bce9-75055d3f747f", "comment": "Malware payload (Mirai)", "value": "c86b97364184147f33b0cc3397c052a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708807, "uuid": "7852d0a2-73b1-4fae-a4eb-d9c98c1e7df5", "comment": "Malware payload (Mirai)", "value": "78feb78ec4feac93d1ddadb7deb187fee83c87e81a588ff005ca83f4adc9d6cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708807, "uuid": "09c28c7b-5642-43ab-93f8-21e52f2ebb13", "comment": "Malware payload (Mirai)", "value": "b2711b4902f995ed4239c1f1e6e14af3e4638532", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708807, "uuid": "10538293-4cc9-476d-8cf9-72555a254000", "comment": "Malware payload (Mirai)", "value": "3e8beb79ad8940dc43e95e392c7070f92e7ca24b1439023b7f106aaecc87cb34edfa5c9b02a03d8c317f54875af3e2d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708807, "uuid": "5dc5c01b-0550-4626-bf59-74ce3d4066d5", "value": "T16F03F162B0DF6DEBC6E1FC7309E8E7D823E13ECF15164BD50599CA84970AA24AF049C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708807, "uuid": "58b7f078-b0fd-471b-a080-2493feee1562", "value": "768:719F01tWgeoNdBE1YNKWwLisY0qEj7Eaptc1fNT4uVcqgw0993WJ1J0YEN:etr2xW4OBei1fR4u+qgw0993WJX/EN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708807, "uuid": "dfffa7bd-5e91-401a-8828-266769fdfa33", "value": 40904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708807, "uuid": "e62a4b76-34aa-463f-844c-564f6d25e82f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708807, "uuid": "661a6cb7-768b-46a5-bb93-6f1f58c62514", "value": "c86b97364184147f33b0cc3397c052a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dbbf11-d2a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708730601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708730601, "uuid": "560c2b02-d6c6-467d-a96e-b1b0955a4ca3", "comment": "Malware payload", "value": "4d20a6ffca88ed572b65e1985d5c2ebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708730601, "uuid": "71c7002a-d173-4ec7-bad8-0ed827f045e6", "comment": "Malware payload", "value": "79387765db9c062051dab54350b34490c0677844564ee016e63e63c8c7743331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708730601, "uuid": "0fc59486-e594-4bc7-b2f2-5cace2f70308", "comment": "Malware payload", "value": "1ff872089638ec6c627183d2958af45a2e3d70ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708730601, "uuid": "c83f5d85-b8ef-40df-9a89-656a76a57e26", "comment": "Malware payload", "value": "c39902a6b0d2f4230356761abf2be1d6d8fe1e88bb066adc8afa59d16aa28182497569a8c35f3a3ac535f6a57ec99a96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708730601, "uuid": "5d312db2-fa7a-498b-a59a-d47389b30932", "value": "T1C3B79D0273E601A8E1B7D138CAA75507EBB3B8161730D6DF729C02652F77AE09D7A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708730601, "uuid": "5e6a5f3c-d824-4d78-b8c1-998f53c1dc9c", "value": "60119ed42f111b2c92d08284871fdfb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708730601, "uuid": "8463b5a6-3c3c-4764-95c7-b646a167c1a8", "value": "393216:dRbRum8Fe9U7y3Nr8Cw+V2UqNuNbTWs+VsaMzQu58EISEhoIaE2FShi9jkwdPuA1:du3sxQxhBAzU9NFbrsBOPACwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708730601, "uuid": "80f7c073-3a37-4a75-a5ad-81ccec5bf87b", "value": 49801894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708730601, "uuid": "bd94fe61-6edc-4245-a032-1509858a2c7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708730601, "uuid": "d4af48c1-9fee-4879-aaa8-22a835eca531", "value": "SecuriteInfo.com.FileRepMalware.16650.28080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3043e2b-d20c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708666274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666274, "uuid": "90535b6b-0eac-4e0b-bcb8-6b2ba7fd2a24", "comment": "Malware payload (Mirai)", "value": "d37a91d476be584ced0eb5725f76b1f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666274, "uuid": "1d59d049-8e64-4ead-8569-ff448b6ae8fb", "comment": "Malware payload (Mirai)", "value": "79a072baa909fe0b4515c66ff520537e2ae5a0d4d47e8fdac9b2856fb9910513", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666274, "uuid": "4aad957d-bc1d-4c82-9fe6-b6ccca52ed67", "comment": "Malware payload (Mirai)", "value": "dbaa097f68129d2f5f5e8983ebcc1a4b3eabfe48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666274, "uuid": "1814cd23-c06a-4eac-a51d-76f04f0f56e0", "comment": "Malware payload (Mirai)", "value": "a06a9d1dd2ae8bc68ad46ca6c3cdf33f7e048399f0d65756f57bbf3408155d56403a79e6ec3e44efa1da0e23ac0d714f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666274, "uuid": "234eb280-b11b-4f7c-a4d6-24e5d40e2bf9", "value": "T1A1336C36E029DED4C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666274, "uuid": "0fee9151-1edb-46a3-8914-25cce040711d", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666274, "uuid": "0c08f3cf-71a1-4099-b4cb-0b512595f02d", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666274, "uuid": "2d89e335-ea70-4bfc-8c05-2ad2c3065825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666274, "uuid": "5092d116-f7de-4295-8c28-80150afe6224", "value": "d37a91d476be584ced0eb5725f76b1f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cba915-d234-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708683222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683222, "uuid": "8fa4051c-84da-4503-8033-18c1185ab50c", "comment": "Malware payload (Mirai)", "value": "eea5a0aa94fa77a3f41e7cc909de5fdd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683222, "uuid": "20114804-7235-45dc-8505-0c7620291aac", "comment": "Malware payload (Mirai)", "value": "7b06786bca741e0e51db5a32fa869e03c10dbec164d67645795e88a4a86f41ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683222, "uuid": "b03dcff2-0cbe-43fd-bdbe-650fadbdf401", "comment": "Malware payload (Mirai)", "value": "533959c090d8326d2fd36dd65e410e69c0dd4243", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683222, "uuid": "6f7cdbcb-960f-4f7d-9ce0-ae8e2a36ca0a", "comment": "Malware payload (Mirai)", "value": "7515cc6f503d73af354104afa0abce754959392836fafae92b44b69007f69a8a26a19ae3ec37f01228ff212d8d532fea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683222, "uuid": "68ff6aa7-1bbe-4269-be62-285dea82dc55", "value": "T17B235D42B21C0A4BD1675EB4393F17E093BFED9011E4F5C8691E9B8A8235E371186F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683222, "uuid": "38318279-a092-4c13-8238-cd335f99b82a", "value": "768:r8RNjpR7CABGu/gr+vgMF8cLJAcSoVe0nKnSbgsfo:oNtzGuSOpF8elFenSbRfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683222, "uuid": "e3758885-a144-4a3a-bc1e-15c7826ed58a", "value": 46876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683222, "uuid": "8fa40c37-63ee-49b9-834e-a44d9bdc70e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683222, "uuid": "79c91c57-6996-48b1-8195-5ca25ce61fea", "value": "eea5a0aa94fa77a3f41e7cc909de5fdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdc8293-d226-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677404, "uuid": "89c7c708-4303-4891-bec4-1647f9642129", "comment": "Malware payload (Mirai)", "value": "673b7b320fa8d7599c809b6658cf0166", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677404, "uuid": "52804144-12a5-40d2-81e4-4d24afdd4df0", "comment": "Malware payload (Mirai)", "value": "7b3df135c0968332e1e92b3a2d563869d26e011e5dd4adadb189b21dca224eb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677404, "uuid": "4f966090-57af-4532-8429-294fd868d311", "comment": "Malware payload (Mirai)", "value": "068e17a20782dc7c5ab2891803d57ee66e8d1a38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677404, "uuid": "bf31e2f5-895a-4f83-af70-7734ee32c07c", "comment": "Malware payload (Mirai)", "value": "73c1245acbe32aa746a7b2f2843c36d5ba0d3deef29bfe9e9f63198e96d456c7c78929ca76fecdf9d8bc387f2ce9ef9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677404, "uuid": "712672da-a965-4e55-8309-7dada6614ef7", "value": "T172F329D7F800DDBAF80AE33748570906B130B7E155925B376257397BEC3A1D90867E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677404, "uuid": "e9a15d9e-529c-4c8a-a89a-806f7f67aaaa", "value": "3072:iURFBm7nDVAbPqU+LDuC6kpmsCmxLd9SVcjbi0L/5PPg+Dyxf6kx:VzODNWChpn1d9XL/5PByxykx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677404, "uuid": "ab6e2972-fca5-430d-9258-50617e7174e1", "value": 169312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677404, "uuid": "623cbf54-973b-4a49-be17-86c618a7a78a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677404, "uuid": "d5596590-7848-4d22-82c3-c618e9bcb878", "value": "673b7b320fa8d7599c809b6658cf0166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935d48db-d261-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708702702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702702, "uuid": "0eea093c-fd4f-4d77-b403-fe66a4a9e442", "comment": "Malware payload (AgentTesla)", "value": "7394bb81fdfc9bfb8152c08fe67d6ebf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702702, "uuid": "062ac5a3-9f53-446d-8dd1-34d30bb37547", "comment": "Malware payload (AgentTesla)", "value": "7bafa813f159b438a71e66807044f9f606ab45f5aca3e6d29209e6083d4fc5e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702702, "uuid": "bdf016cb-aaab-4ac6-90a7-c222d07b4827", "comment": "Malware payload (AgentTesla)", "value": "079a70b1456b83edaf1113b2f4f3279194728579", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702702, "uuid": "a6de76ec-2663-4a6c-9324-8c4fcf2e6cbc", "comment": "Malware payload (AgentTesla)", "value": "a68ad9ab3702b2546f77d8ae23bfbddcaf4de41f567ccb7a5e2702e2d7756ccf27cada63e5e0fc3aa233398eccf310bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702702, "uuid": "f771f684-b0f2-46d4-b41c-a4e47093faea", "value": "T10FF4129962E8EF63F1BEABFA14A0610513F4657A7472F7082EF300D56972F148B45B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702702, "uuid": "85bf3728-8353-4c93-9a29-f8fd4c32ed2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702702, "uuid": "78937cd5-8bfd-4309-866f-e1f3a8e10bb6", "value": "12288:42nQCy5Ujd53LlvCZjiVLrdVKhxbNtJ+7kFYT4FIJCyDT7SMiahk:42nMKYZ8LrdVcJH5Fiq3yDi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702702, "uuid": "d4b367c6-a1df-431b-88cc-4842e47abdfa", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702702, "uuid": "0e94912d-e2dd-4ddb-80f1-14b1d3eaaba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702702, "uuid": "668e541c-9d47-4147-90af-4687d830cc11", "value": "z646s6yeP6w9bbWjXY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9cc4aa-d20c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708666289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666289, "uuid": "416c3a79-6c79-4dbd-abdc-5676a7bf4248", "comment": "Malware payload (Gafgyt)", "value": "293530589c58adcfb1480262f4a766a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666289, "uuid": "87a37762-3147-47c8-8481-3eb6079679fb", "comment": "Malware payload (Gafgyt)", "value": "7c6a91e4a44cea23809aae9c136f8641224ec7d982d4c149d50e5594d0d97cb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666289, "uuid": "21c44faf-cde1-4a9d-89bf-a16928f67576", "comment": "Malware payload (Gafgyt)", "value": "b19d93043d95a5fd8b26fd1cc064bf466c7e0d4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666289, "uuid": "c8e29481-8d64-4089-99e6-ff08303554e1", "comment": "Malware payload (Gafgyt)", "value": "8be059cc72e148fabfb2a164f047080b18dc828c4899df7f00d939aca723d8577f8068ce534c2577064b5af5313a346b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666289, "uuid": "d53c5dd9-6f37-45cd-94ba-12e01875c2d6", "value": "T12FA35B53532D0A87C98B9AF02DFB27F187AAECA012B25644950EBFC41773BB41056F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666289, "uuid": "0e3bf817-926c-4d8d-bc13-cf9a5957e074", "value": "1536:DEg/+165BDtuS5Xap3SQuqomJd28C40W2tknAJfmsCskFw3DW:DXa65GSA6q7JdjomDski3DW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666289, "uuid": "c6c6e832-e14e-46cb-bee7-4bc6efa40b99", "value": 103588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666289, "uuid": "931e58c4-d81b-4fa4-a74d-534ce5c5cb2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666289, "uuid": "5ae0249f-f8e7-4127-9e48-9fe6087b4b25", "value": "293530589c58adcfb1480262f4a766a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a18b9b0-d261-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708702606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702606, "uuid": "c2bf03f1-9cfb-4828-8caa-f2bed72113a2", "comment": "Malware payload (AgentTesla)", "value": "55eb96655d53c5aac87f147f77822f69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702606, "uuid": "793a772a-a0f2-4358-8a54-6dbdb316c874", "comment": "Malware payload (AgentTesla)", "value": "7db939f103732a9f11c55ba54b8b7aaaa35309cfda3eec039dd71d6bd9d331da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702606, "uuid": "3821c03b-dcfc-4e59-973d-feb7c3c10352", "comment": "Malware payload (AgentTesla)", "value": "cf59e73f8f9b46051c04070cf657414a77e6f5f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702606, "uuid": "761521cb-46ca-449d-95ad-e2282c872785", "comment": "Malware payload (AgentTesla)", "value": "3dbd9c6353038da85260189b4a72afa59b7ebb067d063b943a16ac38b1b772df56ba139d5757c617ea0c28f8b16ca672", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702606, "uuid": "462abe78-da98-4909-9fee-690578ed2cfd", "value": "T156F4126873D8EFAAF07E67F85460610003F9A47A6AB6F3085ED750D518B1F24DE94B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702606, "uuid": "18d77115-c804-493c-96e9-c1584133f01c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702606, "uuid": "35c810a9-dde5-4e70-ad2c-95708fbe74d5", "value": "12288:H2nSNq5Ujd53LlvMmWvWxerOstDqPnJUKLbaRqRudRoq2wm2//69u:H2n7Kmm2WMSstDqPnqKXaqvqNmK69u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702606, "uuid": "2adcdcf2-b87c-428e-aa2a-690fdb1e25ff", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702606, "uuid": "83acb465-338a-47cf-a950-b3b347e5c600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702606, "uuid": "6a9c718e-4978-45e2-809c-f55ecaca5a12", "value": "rScaned_Product_Attached_Document.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1790a374-d1fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708659974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708659974, "uuid": "cc411421-0261-4134-a950-df658068ddda", "comment": "Malware payload", "value": "1ad6822ff5afc410b41328b7c53ddd07", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708659974, "uuid": "ab8cc6c3-435b-49ec-b089-46a0cdc177f4", "comment": "Malware payload", "value": "7dbe5f108b59263c9036f16b472ba3c224e12b8fa49343fec15ac4a4066f0622", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708659974, "uuid": "d03013f2-68cd-48ee-9b59-4951792c9f78", "comment": "Malware payload", "value": "fbfb17f93b750f0977f77c18e8a9b1ef3ea6e6c1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708659974, "uuid": "e5d8a0b3-2aad-425a-8899-9f3233ef535d", "comment": "Malware payload", "value": "e89757a756122111cc0ca620f40cb267003de70175c095e7b337c68b02b86637c623a0de8221abe092d4964a6db610a7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708659974, "uuid": "01f8e15d-8492-4a84-9967-655e4c151f44", "value": "T1614533F281CF6E16F3DA043D80DA21E660D8B586D57DC12767A64B38E86C336DED9432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708659974, "uuid": "f6f07f9b-50e2-4d8e-b72d-3a11aeed6609", "value": "24576:kFxUzFfPk/olcPHhOc195M0wNjzikAGpf4t+QhnBZkFTLmF8dfAz2B6Vw:CxiPwolSYW5M4jsfsMdmYi2Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708659974, "uuid": "16055f91-b967-4d4e-9af2-48d125bfd275", "value": 1255282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708659974, "uuid": "8f773bad-5343-41b2-b6b2-acee9c7d9d07", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708659974, "uuid": "717beaf3-f2e3-4650-90c6-694950078808", "value": "SYSIDEX Sheet-001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49898724-d1f3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708655333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655333, "uuid": "83c49787-fb03-47e2-abbb-992d98ec9e97", "comment": "Malware payload", "value": "cda63c168545f0b95f5b99d2237bba4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655333, "uuid": "d1e765bf-cf74-452f-b334-015e313b263f", "comment": "Malware payload", "value": "7dcd230a8bad9ab5c782278d016516ea0901fda4bb40accb7501ccee4046633c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655333, "uuid": "0ec22c2b-c741-437f-a28e-9fcfefec9679", "comment": "Malware payload", "value": "a06f897c1e6c0c7571c77e1b7b61494a19b4ca84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655333, "uuid": "b9016ae1-5bd9-4874-93b1-bd4c2d74dfab", "comment": "Malware payload", "value": "9598b8f537ecce52e34dd0a008ae7768473f99dba23068388f2e0e8c7c212d3d9d5efce79e686df4d9f9476048d970af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655333, "uuid": "303c43df-7588-478a-9e9c-79848de1197f", "value": "T19CC4234624137AA4E5CB7972216E909CE2BE7F813EDB04489DCB7AF8C7043C78794A4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655333, "uuid": "eea4e5e6-83cc-4150-aa0d-15b0cd4a910b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655333, "uuid": "e9a267e8-5527-4c70-9b6e-b36e2492b432", "value": "12288:fewtLvTPt7wIzl06Sjq3k1KKH62hR/sJe75xn/HUHD4+9VbM+:W2vb5dzeMk4Ka2f/sI75BHUnVbM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708655333, "uuid": "35b35def-c168-40ba-a7fe-837fe4dc5e7b", "value": 564448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708655333, "uuid": "08e867b4-1fb5-4783-abd9-c7360e0f6f9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655333, "uuid": "0df45426-2eb3-4d1a-8c5d-29176e222db9", "value": "SecuriteInfo.com.Variant.MSILHeracles.67264.11118.11751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd09a06-d234-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708683207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683207, "uuid": "63cc83ab-d883-4774-81b4-2d74177e55ec", "comment": "Malware payload (Moobot)", "value": "b5acd27fc9c302131fc0b556a37396aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683207, "uuid": "9bd9adab-8a2d-432c-ba6a-4992cdc63cda", "comment": "Malware payload (Moobot)", "value": "7f082808f2c7aa9a3c374d8931fdb23e6ef243c62684c0011bc2fdc6a817c09e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683207, "uuid": "b33af782-4810-4ae2-aaf2-9c89ef0ca395", "comment": "Malware payload (Moobot)", "value": "135c15bd3f23186d1484f2b5610b13958768d380", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683207, "uuid": "04f49b2d-4386-496f-9c29-13a56d2fcdd5", "comment": "Malware payload (Moobot)", "value": "32e8b616966b7187f7adf307be61b04c17fab00b48011b9c0f6162f01f4bad8f8453c4c0bc71212c4dd4841a58529b5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683207, "uuid": "1deeaa07-2939-4e58-8c11-5486d7043dba", "value": "T1AB53A309BF610FBBEC5FDD3749A91B0135CC641A21993B3A7D34D818F35B61A1AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683207, "uuid": "607bed9d-9f68-42a9-bb62-790f58480c0e", "value": "1536:U4BBdlwSEmcePAb3CHGIz3C55irqtF87M:U1e8mqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683207, "uuid": "09a7d9a4-18d0-422b-a7c4-510f2c1f1b70", "value": 64320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683207, "uuid": "67e11a39-42f4-4fd6-95fb-592e88df49bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683207, "uuid": "28386ae6-46b2-4201-b2c0-d6db8cc7dbed", "value": "b5acd27fc9c302131fc0b556a37396aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adccd916-d260-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708702316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702316, "uuid": "5e3c5490-a111-4f8a-a5c2-d0f1c9514173", "comment": "Malware payload (Moobot)", "value": "2c7f8c4259c1a4b87f9104c878aed7f5", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702316, "uuid": "42f9b047-9973-48fb-8cbf-34fc08352fdd", "comment": "Malware payload (Moobot)", "value": "7f68a8b2105d0f0a8e9f9130df29d54ea95454b53dc5458a4561729efc295209", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702316, "uuid": "738c6e9a-4960-46e7-ade1-b74122c65d98", "comment": "Malware payload (Moobot)", "value": "dfb1d56cd7e8c237ced32daa103198110c3afb57", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702316, "uuid": "bbbcf7bb-c7ea-40b8-a2f2-3faf73fcf9b4", "comment": "Malware payload (Moobot)", "value": "d22fbdaed5e79167fc07c97ce69b177beccbe97d211c9174ba0b5d888958000c5ac24a4659a9954e891fd8d75e5e7951", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702316, "uuid": "9042cde7-e7a5-4546-bce1-df79b8e79dd4", "value": "T1C983D606BB510FF7DC6FCD370AE91702348C594A22A87B367634D868F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702316, "uuid": "031dfa67-29de-49da-bc60-593b0e8b968c", "value": "1536:5M7CfNKlekQp2trzA2Qje2EZorzRUZkMYtyk:5M7CfsGOrzdQj1EUUUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702316, "uuid": "e53cbb15-b83f-44fa-84a3-d2d6fdcb3e36", "value": 84828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702316, "uuid": "31937c72-135c-4811-a8a3-5d1980666010", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702316, "uuid": "f0136e6a-43d8-48c5-ab68-14b5da01222d", "value": "mpsl-20240223-1531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf38785-d231-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708682125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708682125, "uuid": "782b0eed-f381-47e0-867a-0f2c0951d171", "comment": "Malware payload", "value": "02e98c71545c8345d28920fbc4f99c28", "object_relation": "md5", "Tag": [ { "name": "gimp-pc-com", "colour": "#E4B56E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708682125, "uuid": "eb16f2b5-c647-4654-a585-1c6c0e858276", "comment": "Malware payload", "value": "864d7bcd96f8cf35b9e372b6508bc6ef1a704eaaa03c34bd79577b057aebec5b", "object_relation": "sha256", "Tag": [ { "name": "gimp-pc-com", "colour": "#E4B56E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708682125, "uuid": "abc0d817-39d1-49e9-aa21-2c4ffa8e3cf7", "comment": "Malware payload", "value": "a09e2b273c4cb323d4ea424ae456d9dbc9fc43f0", "object_relation": "sha1", "Tag": [ { "name": "gimp-pc-com", "colour": "#E4B56E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708682125, "uuid": "172b8fcd-1394-4664-9a5a-2717ede8a091", "comment": "Malware payload", "value": "5876f73a61987828edb642a865a02b2ddcd5f0af852f9db9367fa7454d83cc4d81a5341798085712265eb38b21fc472f", "object_relation": "sha3-384", "Tag": [ { "name": "gimp-pc-com", "colour": "#E4B56E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708682125, "uuid": "a7890e5e-1d34-4389-ab0c-4a1c32283706", "value": "T1A7038EFCB5185D96372F462BCA96A5DD03762B328EC794C94178A78306E3393FF52805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708682125, "uuid": "5bd1b329-6ceb-4e67-a9a8-8a97c006d8fd", "value": "768:Jkcso0KfNBqjxvcG4DRINIUBqKENI1gJkOpvUBL6GYJ5jHQES8Z80foQy2aCrhX:ueNB40xbUBqKEix2vLzwES8Z80foQ9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708682125, "uuid": "fccb7cb4-6a66-43b5-8d45-bc396b3edeee", "value": 39268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708682125, "uuid": "0f7850e3-f926-4b57-87dc-84104bd40af4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708682125, "uuid": "5ff66f28-0afe-48f5-b910-b0b046bb330c", "value": "html.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c740c0d8-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708708802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708802, "uuid": "af78d8af-1549-43ee-aa08-92305f589c91", "comment": "Malware payload (Mirai)", "value": "dcb16e9fe570ea00d92ee8b056cd43eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708802, "uuid": "b26c09ed-e678-4225-9c8c-2ef0d15a40bc", "comment": "Malware payload (Mirai)", "value": "881bd201386f12a55a6d056c8126bbf07cc6cab8979c7c5bd1ce2d6a3644d238", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708802, "uuid": "ddd5aa31-9959-4992-b9af-1cb1190bad0a", "comment": "Malware payload (Mirai)", "value": "52d6bbd67a4e1f5265ff894b28e622ad71d39c87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708802, "uuid": "bab9506c-702e-4d69-aeb9-9d03ed2f704c", "comment": "Malware payload (Mirai)", "value": "e171cd0aef4df81b730252fe14118c906d51e08e904effa41434773205334b44c69ec1e80d79685b658ca3b6172e69c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708802, "uuid": "37d6198d-672e-44fb-8999-dbd13c18894b", "value": "T186D3C73B27170E23C0C550B101E34332AEB5DE9B34B952D7AAA07D686F37A843956BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708802, "uuid": "7f41ce04-5f57-4af3-ae98-68be96d07abe", "value": "3072:nv8G4ZNBdT5CNPR6WQo9w+BJHVImm/QMurB12CGNb:BO0lhJimm/QMurB12CGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708802, "uuid": "d30cbc3e-f3d8-472f-a172-e5b2e762199d", "value": 130105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708802, "uuid": "682e9d39-c0fb-4b63-a773-a7596615a19a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708802, "uuid": "9e35dd20-9ffe-40f4-835f-7c7fa61eee4d", "value": "dcb16e9fe570ea00d92ee8b056cd43eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b682df31-d202-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708661958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708661958, "uuid": "85515614-feb6-4bd5-86b9-28eb38571748", "comment": "Malware payload (AgentTesla)", "value": "b477e6e2fa66c557e4a309f05cb0da8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708661958, "uuid": "48c5e7d6-991a-4b44-bdcd-97980ff0e017", "comment": "Malware payload (AgentTesla)", "value": "892c90d3d322d4b0aafbeca9f9599686f6d9234f8b553847ec9459989b2f0973", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708661958, "uuid": "05025b9e-6ffc-4eb7-b6d4-6db76c3b5087", "comment": "Malware payload (AgentTesla)", "value": "2d7b22270e20ca7b65e869009a7ff0563df5b7f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708661958, "uuid": "ac88bf0e-df8e-4a96-993a-13461753b174", "comment": "Malware payload (AgentTesla)", "value": "3cf468b5887aa673db7dd7be03d05c58b53cfe3d579784f398997dc61c3fee6b502b435dc0024d396f664c27476e6b1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708661958, "uuid": "20723ee3-921e-492a-be9b-0baf684b7f38", "value": "T11FE4231D36B5C6A3CDBBC3B40011566547B2227E645AEEDD4CC535DA8AFAB04EE01F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708661958, "uuid": "6b1a643e-cb6a-4cea-8de2-e6e91f6f8971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708661958, "uuid": "95fc86d2-caf0-4747-89c0-e898696201ef", "value": "12288:VlW37mzBh35VgIMVdGrEecEcvU/4mgtVTJ11fNUpnI6BlZ+pkFiGr:nB4jVdGrBF/4mgtlBWP8pkFiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708661958, "uuid": "0d39eb09-66d6-4c22-89ca-23c890a44b1d", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708661958, "uuid": "a08b312b-dbf9-4c53-bfd2-a82bf40caf1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708661958, "uuid": "9124c4a1-e4db-439c-bde0-65a0cedd922f", "value": "SecuriteInfo.com.Win32.MalwareX-gen.170.29118", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40d7d11-d20d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708666706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666706, "uuid": "0969d6b5-60be-416b-8b8d-c1a20e870992", "comment": "Malware payload (Mirai)", "value": "94666452044ff2e04b169e3f60777b5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666706, "uuid": "9d1914c8-aad0-478a-b04b-3c00b96ddf30", "comment": "Malware payload (Mirai)", "value": "8a8ca3777c7edb1356b6fad87b4ce6318b7d05463884476938b83745b3eed3a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666706, "uuid": "482a5bb1-9c03-4a56-a7c1-a113ab15222b", "comment": "Malware payload (Mirai)", "value": "8346e519f032420bd7a9a297f2ca2157f5a2cd7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666706, "uuid": "830441ba-2737-40db-acac-203f144e525f", "comment": "Malware payload (Mirai)", "value": "316c03b7e2012d8255976fc95f7a106a4b3a005c7ae30396ce743fbf722608ff760b786f527827f6544c1d8f2a4b2973", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666706, "uuid": "1fd60e13-cc29-4eeb-9dde-ad04340f8904", "value": "T167B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666706, "uuid": "c28609b3-2e82-4942-ae4c-0d133c7818af", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1n/LWy:c9sSyzz36YaWWgg1nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666706, "uuid": "8cc152b7-1875-4d68-b1ab-105529c72799", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666706, "uuid": "655d7e63-75d9-4aef-850b-c7174895545a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666706, "uuid": "bbdfe020-ecbb-4f16-9d7d-c713aa33f453", "value": "94666452044ff2e04b169e3f60777b5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efe58ce-d24f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708694802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694802, "uuid": "77436d50-e033-4346-899d-350726615b01", "comment": "Malware payload", "value": "9e4ff1597892b0549cdbd7ef8aea5f22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694802, "uuid": "405b2f07-18e1-4164-9ec4-b414ddd97c5d", "comment": "Malware payload", "value": "8abaab9eb197f196e3c4adcf9c3e3d62489b7fe9e29349abfd1d278c73df5e6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694802, "uuid": "f48689a5-3249-4041-9796-da0c19ff50da", "comment": "Malware payload", "value": "562506e9f4decd5714c2eeaa02f8db0908d5d03d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694802, "uuid": "bb295c41-fed9-44e7-9151-2229c380a588", "comment": "Malware payload", "value": "a9c10877f8d5834b7c3cfb2a9d72c4acddd15b264b10d34b8033154faced916151d67688d11fd4825671e25a88b97fb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694802, "uuid": "4f2f5b9c-ce35-4105-875e-8930019c9543", "value": "T19F469E13B284643EC27B1A3B1D37E254993F7A29279A8C7B5BF01C4C8E755823D39687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694802, "uuid": "76c5e111-121b-40af-aafc-c77d2b6ed7a6", "value": "f545fcdece2bc824fa983917aff4d4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694802, "uuid": "c3bc4fe7-93fd-4b1e-9d95-f43f1ec479ae", "value": "49152:Blhvq8/gQE8tQENFWSestSeJ56gJRk1o9HoUYyHwxbzE4uVTpuVswW4sdPAtDHOd:5q8/nKwiskyAJxbzjguah4Yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708694802, "uuid": "005dc41e-0848-451a-a687-9dd02129aaa4", "value": 5481840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708694802, "uuid": "e2d78fdf-a8b8-41b8-8063-e565135df4ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694802, "uuid": "cf2b5065-8ebf-479b-9b62-51bd918fd489", "value": "SecuriteInfo.com.TScope.Trojan.Delf.20255.19917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc5ff0d-d258-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1708698612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708698612, "uuid": "958fc3ca-10a0-4a11-8645-49daaac7aeea", "comment": "Malware payload (RecordBreaker)", "value": "f4d52951fc8094515a9e103892247e8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708698612, "uuid": "bd1216c5-d47f-4e09-a107-b16efcadd940", "comment": "Malware payload (RecordBreaker)", "value": "8ac262e42dc9b061481f38467e202f22271f204cf595b610eb0ad4f5bbcd560b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708698612, "uuid": "dffe25e1-9580-42df-b6a0-a72969070517", "comment": "Malware payload (RecordBreaker)", "value": "5e7ac04c02e77a06412c6f46e1266d74543a2e20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708698612, "uuid": "1901ebf9-069d-455f-9887-396c0273406c", "comment": "Malware payload (RecordBreaker)", "value": "5621cb871689d9fe3be68f66e8492d4f95cc434d382116b955a537b9afab407c27962ffdfe74a4d97678bf51b28abd47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708698612, "uuid": "5064158a-6f6c-4b1c-9159-3b1ab124f66e", "value": "T18B0512327994C233D2B747306CD8B6746AFDB96106B742473B9C065A6F326D2CA2C357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708698612, "uuid": "0174920f-91c5-410d-9b7d-a842b1948e7a", "value": "2e838409987529c95afc2990bcd62f7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708698612, "uuid": "c21749ca-0f54-41c4-8dd2-0238c65b9ac6", "value": "12288:hX9RHpKhSBauYX8z4FESjS4UOx6YgwiJ2mYKdp2hFZTysoKVbJBdXzKv5CfaemkE:ous8z4jVUOJgwk2sp12bdhmkJ3EZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708698612, "uuid": "37f6f7bb-2ea7-453a-98ad-78f92894602b", "value": 839511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708698612, "uuid": "491027dc-442c-487c-b2f9-622e32ae6d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708698612, "uuid": "509c4066-0485-480e-b613-91809117cb0c", "value": "F4D52951FC8094515A9E103892247E8E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f75648a-d1eb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708651988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708651988, "uuid": "6d9f5bcb-21b3-40a5-868f-89b7f16743a6", "comment": "Malware payload", "value": "f45b523695d78eee9281416c44dcd6ea", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708651988, "uuid": "d7215d2c-a2b2-44be-859c-3900adfc8a44", "comment": "Malware payload", "value": "8b1aef450db12bcbc77bb71c05c1bfc9cfa15284e548e87e793e617a7f869ff9", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708651988, "uuid": "d3f2d53a-d31a-430d-a109-f1a672f66c61", "comment": "Malware payload", "value": "7bcdf4e0cc4eaeea30c56e35e2da1f27b5d775f9", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708651988, "uuid": "88c580c7-2ed6-4dfb-9403-5c2d3c44adbc", "comment": "Malware payload", "value": "f2dbd97e78f3265914b989f46c70c3be201d5e76d6b9b9cca8babf1576e5bacf13fd669da95eae2acbd02cbd1f2caefc", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708651988, "uuid": "51b89d48-7b15-4820-865a-04a40818312d", "value": "T1DB052ACAD6081623ECE835056E38D0BB4F14CDE534A482D6DF6AA7DEC529D973CE740A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708651988, "uuid": "98814bf1-585a-4ad1-9b56-2ecff078bad1", "value": "6144:aSrPGb6pFz+J6dCcfOMcXLtEGYKM29+9oPyv1LIpc1JRqSYT:0EGd79UoPyOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708651988, "uuid": "4df4685e-337b-487b-a0b5-d0dabe54cdef", "value": 838802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708651988, "uuid": "79aa25fe-efae-4253-8ce8-29da9d66c713", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708651988, "uuid": "d9a99bb7-57fb-4f36-b698-3cf7fae0e88d", "value": "message-new.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd85d19-d1f3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Riskware.Generic)", "timestamp": 1708655339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655339, "uuid": "e8b8e0ec-7aac-4e50-b358-01d623a47444", "comment": "Malware payload (Riskware.Generic)", "value": "6b949b4676fd839cc5e35cbe1b2fa664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655339, "uuid": "0418ad1c-9fcc-4742-92a8-22e149d7f657", "comment": "Malware payload (Riskware.Generic)", "value": "8b9738d3ff39584aa202210060e953f273624b322b4092880743b1cd8531b89c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655339, "uuid": "79743917-6daf-49b3-bd83-cd6470c2184f", "comment": "Malware payload (Riskware.Generic)", "value": "358c4c6131c09d561580241258e674b81f063d6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655339, "uuid": "6736993f-6a2d-48fb-b784-722181cc19c1", "comment": "Malware payload (Riskware.Generic)", "value": "27663a55380f17fa6aefddd11d2e0a0fe88f8dfcfba9df8335f8e5dc4eef4a1afc086871ffb882f1e6ae60aebe9b06db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655339, "uuid": "910c851d-61e8-4d5f-8016-c093bef4a68f", "value": "T111158C12B683A0FED625253008AA67B5BA35DE560B29EFC3D3B5DE3C1D72350DC27219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655339, "uuid": "df16c9e5-a4c3-4f76-9433-58c89e01780c", "value": "0d00c1c9a569ab4be2fe65e874319841", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655339, "uuid": "a173b6eb-44fb-4992-8f67-d9ec03f3705f", "value": "12288:yf1hyuFvl6jpIb++ZWdwRoDwF6WHVaOOF1Yw8g:ybyuFOIK+0dwRoDwFbafF1b8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708655339, "uuid": "9f755dd8-94ae-430f-b4ca-1a5edadcadfa", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708655339, "uuid": "0f4abf6e-351a-47d8-869f-4670c0688a9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655339, "uuid": "fbbe064a-d57c-46cf-97e9-a511453e61f7", "value": "SecuriteInfo.com.Win32.Trojan.PSE.11SCEUB.7077.7785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d07a41-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708705247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705247, "uuid": "49b8949e-8f3f-4599-8d70-df1f21e78518", "comment": "Malware payload (AgentTesla)", "value": "cf4df839f062b23f0501e0340ec93cf9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705247, "uuid": "48349f73-b3a6-4387-ac3b-92fbb66d123a", "comment": "Malware payload (AgentTesla)", "value": "8c74fd246a4efacbc9add07f57c100cfc856cf9ec12d6887a4aed8d40db84cf5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705247, "uuid": "1f516a8b-c6ce-4e95-896f-23b2c9da9292", "comment": "Malware payload (AgentTesla)", "value": "916ab3a1b346bff18aa764f75b2d8dea0a89fd5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705247, "uuid": "c73e2618-7c65-484a-b99a-4fcac4a91bad", "comment": "Malware payload (AgentTesla)", "value": "06d0adaaefd26573e518df3e4fc312cf531edd25c11189eed22c5718a03dca47bc2e6cd45f264fadd546e541f44d5cb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705247, "uuid": "e3d4bed7-212b-45f1-bc22-54d532e533cd", "value": "T1C1B40210328DAA8FC28756F24B9F398E7119BC22BAC5D617367CF74E07747A6861350B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705247, "uuid": "84bbc47d-a7bf-44a1-b3e5-22fa0fd061d8", "value": "12288:oTki/KI8bCfgRUpjpozwjTueAlbrYRWgA8NW:y/KIiCfgRMKWaTJr76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705247, "uuid": "919c07dc-9e65-4888-9f34-8d82d92eaf19", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705247, "uuid": "c46af773-cc43-42bd-bb49-b7a4412799d2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705247, "uuid": "b44a8793-63ae-4adf-aad8-b8409a8e329d", "value": "PO OC 1000055113.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7e3d66-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708705702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705702, "uuid": "2422ba64-d5fa-41ee-9836-d73b6c0e4a05", "comment": "Malware payload (AgentTesla)", "value": "77d965dd6195cc14fbfdbbbf7a86b7ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705702, "uuid": "484cf636-1f81-4b20-ba92-a4c3665f0a66", "comment": "Malware payload (AgentTesla)", "value": "8d131fafbcc174ab6d33a73b0e7cbb72060a403cac403234578acfa762cef7b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705702, "uuid": "b42d2fa6-8c42-4b51-b8d7-5ebbbfdd7047", "comment": "Malware payload (AgentTesla)", "value": "7e796af62e94214f14a7630abfba485187b3c7de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705702, "uuid": "288453ba-e6f0-45b8-9a87-c4ea460a372c", "comment": "Malware payload (AgentTesla)", "value": "94012a5ca865361d878e00c1493f886bf667d9cc0487a52f1f8dc24a09141c788b40735c7efa6e1ac8808925b0a210b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705702, "uuid": "78340b1e-35f4-4da9-aad8-6d5e604eee5f", "value": "T10D7412693226E612C297BC754FC0C1D71212FC909F41AD1FB8E8B76E0B79B805BB259D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705702, "uuid": "268aa7ee-104f-44a9-8ccf-15f592d14c4b", "value": "6144:FVqYskzvCp4sJgDF1bqGHBMixiMK6G+ZFrTLOCii/D8Ug5PXYy9:FMYxbCfgD/bqEpozwjTLOC7D8DX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705702, "uuid": "206a7773-9833-4cfc-8e97-995c369ab1a4", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705702, "uuid": "79cddfb3-e538-4c02-9085-00a2a5b6d370", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705702, "uuid": "1e3df8e9-ae87-4c54-8ffb-85179d4a0149", "value": "entregar confirmaci\u00f3n de direcci\u00f3n.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c4cffb-d248-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708692027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708692027, "uuid": "f756b94e-93f4-4fcb-83b6-0bce1467f9fa", "comment": "Malware payload (RiseProStealer)", "value": "c34cb581ee2b6abc9e5295e4ced7a28e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708692027, "uuid": "4174dc1b-92c1-4596-bfdf-827df67856f1", "comment": "Malware payload (RiseProStealer)", "value": "8d8572292b3fd893ee12b7b5284b4eae6daac99433e477745361f968fe52b348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708692027, "uuid": "f9efa026-5b62-4469-bcd8-01a5ebcf64a3", "comment": "Malware payload (RiseProStealer)", "value": "bffef3b6b3b523c0abd6a04ca018547753596337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708692027, "uuid": "1e9c63a2-c45a-4e6a-946b-df97ae5125d8", "comment": "Malware payload (RiseProStealer)", "value": "dc34dfe955bd49a2365389cfd06e7f7ea3272f0eca52159a47bc634ae228285fe9350459edf5000b8791cb2787a5671c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708692027, "uuid": "b6b539d8-084c-45e9-8b85-b5674602b3a7", "value": "T11E5633666BD2505CD8DB21F40247F12EB9B73E7699B18C1E688939DCF9F1B2329F6100", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708692027, "uuid": "4ab64686-f43c-4dda-b20c-daa35ef0e8a2", "value": "e7ba9cf649be312a3cf12f22936d3f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708692027, "uuid": "355eb93c-4667-4bf0-80be-b1c97674fb51", "value": "98304:5c3o5nF2lZODQJ6wgsucxwlaCSBgUK9NWmrZZqwXkHPu2MySiMcjIFtVX5h8jFRN:00mucxbCr5NWmvqwXWPu2MCMDfVphaFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708692027, "uuid": "cd4ff37d-1097-4c6b-b1bd-718d112fa2f3", "value": 6286336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708692027, "uuid": "d48bd76e-478a-416d-8cf5-b78c11f9114f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708692027, "uuid": "67f63136-c62d-4b49-85ac-3f79a900c3ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5760531a-d261-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708702601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702601, "uuid": "172182a8-62c4-4c5f-800b-d4269df77426", "comment": "Malware payload (AgentTesla)", "value": "e41d40b2dc58ae89716397aab8a9f2f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702601, "uuid": "6f7cfa9e-0ad3-4314-9835-934cd4adf32c", "comment": "Malware payload (AgentTesla)", "value": "8e3de041f324beda2f12323a1370ff9dcad5d120bfd62ff4e583cbaad8e83406", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702601, "uuid": "6cd30f6f-15a2-4e62-9521-a37079f45c63", "comment": "Malware payload (AgentTesla)", "value": "e15267665c999becaf9ced32766a1c90e8df6c7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702601, "uuid": "37fc9430-eee0-41fe-ac91-7d5a6ce9d6a2", "comment": "Malware payload (AgentTesla)", "value": "91546671f9e43ee93e943b0428416b4dd1de178f057e37b82cd78ad2a76d0e7c3a0dde0a1008439a68f6cf3974b87867", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702601, "uuid": "1804625d-c15b-4146-b719-3b77ba18bd5c", "value": "T160E4239D58F3F7C1873057A697AEC62CF8A6A19C3A59E429DB128803DC391532DFC742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702601, "uuid": "99b4e8d0-7cbc-4c62-8ccb-4c138efeb314", "value": "12288:02wbOaGBVOVzxUnmkmnSVvDNYA9x2GzrHpYyexcD8o3rvjy8OkzmVLm:0hvVzxUmkbVGA9x2Nyex0jys+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702601, "uuid": "20274d48-a0de-4e24-937c-4d11ea5bd8cf", "value": 704886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702601, "uuid": "e7220c51-a710-4ee4-86c5-fd2c265a25f2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702601, "uuid": "9d892f63-c4b8-49fd-a58d-e546e29fef9c", "value": "nScaned_Product_Attached_Document.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafb9f3e-d220-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708674904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674904, "uuid": "519aba1b-e426-4b79-b5e6-8971e4f1139d", "comment": "Malware payload (Gafgyt)", "value": "5d03340a59e13bb5c2e8c40f0f7cbec7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674904, "uuid": "14918aa3-ef86-4a22-9ef5-ffedd93dd305", "comment": "Malware payload (Gafgyt)", "value": "8f84ca93b715ea23fe2468b9f83d2f72bf891e73543c9f68def31e0f7ae6378a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674904, "uuid": "6f53f4c8-1ba1-4181-8f6b-53fe34a0ee69", "comment": "Malware payload (Gafgyt)", "value": "6ac1d3655d708fa4642b159d06611e54d039738b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674904, "uuid": "b57b7c5a-4547-432e-b785-cf9816b3c2e2", "comment": "Malware payload (Gafgyt)", "value": "df941aae14f4aa408299d60db33210ac21c42f4c5cdbd9977b56badfeb78eb941e6091e36ce7c823b729dc874e4fe66d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674904, "uuid": "c167be58-9f22-4b55-a6ab-6d798aa086a2", "value": "T19F310C95A2D06DF9C89891BF9D520311B3649F84E0CB73A29208B725BD2EE785C26046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674904, "uuid": "cfb06678-95f1-431e-bfc9-f9d9311dcbab", "value": "24:lpKGpa7Urz/jlf+pdAXK1h2Vev3gRGH9iMPBBuk/W3lxrR+zHGS90t:/KGpa7UrLZy/1zpBuku3lxrsHGS90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674904, "uuid": "8b68ff6a-81af-4c2a-ab26-e9a51a9643e2", "value": 1448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674904, "uuid": "2a0fbaea-ea3a-4cf1-afe5-c40df2e0a57f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674904, "uuid": "dbb85ec1-88e2-4344-a0ef-617991599e31", "value": "5d03340a59e13bb5c2e8c40f0f7cbec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df1e9a5-d266-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708704786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704786, "uuid": "d39baa2f-c3fd-4987-8aee-291d2a90f036", "comment": "Malware payload (Mirai)", "value": "8a63857e54d50302048d37db31b6492d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704786, "uuid": "fd09aecc-c512-48a8-9592-86dc91f4e1e2", "comment": "Malware payload (Mirai)", "value": "8f8f01fa86d0ad7c6d40fdf195e4f6724a01d253a9490dad6f784fc361af00c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704786, "uuid": "efe1744f-68e2-477f-8e79-4936c93570ba", "comment": "Malware payload (Mirai)", "value": "3f717afb1b77233bd98cdc08452588d4e61e8dec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704786, "uuid": "70d8f982-6f76-4423-81ac-0da86ae83faa", "comment": "Malware payload (Mirai)", "value": "853c8893415e6cd588e77c127166408716d23e2ac1c608ec1f8a69847471d3f0b61cce2e72c27a02530552ab1eeb075c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704786, "uuid": "96bf3f45-a9fe-497d-8363-052be69188b5", "value": "T178E30A46F8819B12C5D111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704786, "uuid": "623bab22-3bd3-4d0e-b2c3-16dfbfe7b0b4", "value": "3072:lSoG8cPoUc8p4nXlsQNY+a4ZEtH9iCvr0AR/ku:goConznXyQNLabuOr0ARcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708704786, "uuid": "1ef6c4d7-6c7f-4f1d-ac04-e977195c190f", "value": 155036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708704786, "uuid": "8734bcd5-e81a-40f8-a599-194cca46419a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704786, "uuid": "675823c1-27eb-42d7-838f-661431967ec0", "value": "huhu.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580ae401-d281-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708716346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716346, "uuid": "4d210356-f277-423c-9ad9-bd86f3146be3", "comment": "Malware payload (Mirai)", "value": "b415c31fbb6c6de50e0569f09e528f6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716346, "uuid": "4bb6171b-3a32-4bc5-9abf-9dfbedd03f36", "comment": "Malware payload (Mirai)", "value": "9005f913933d0875836a36a110bafcb3d6a47c2d4ff53f90ceed1b199fec927d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716346, "uuid": "9888d545-7b74-48c5-acd2-d51caf363ddd", "comment": "Malware payload (Mirai)", "value": "08ddf9ad992f417cde3a8f924927c630fd2c9642", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716346, "uuid": "c0a69e79-0f6c-4a74-83c2-a1027bd06a92", "comment": "Malware payload (Mirai)", "value": "30a3a50f3bcdcb9bd1fdd74f5947c416c9c7a531a0314169c32b62d6b03e7c5ec3a84cbba6f563ffedaba1ed1b0cfd96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716346, "uuid": "deabae09-f3b0-417e-af85-edd3a00e3f28", "value": "T1C123F11D5BD83942CB2C593D42DE577E9C86A8B1F9CE8F0ED3754548A2BD19BB02C0AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716346, "uuid": "a7bee15b-aedb-4672-a0a3-f6e0d421255a", "value": "768:i2xuhkgg/KogX+Kp3SJ0bEmNHgruL+K1V5Psu6W/sfR5KWpQ2yAZU:iGuhkggC3X+KFSmImNgrExEu6W/sfTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708716346, "uuid": "104bc309-8051-4195-b905-7dee89b20019", "value": 45772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708716346, "uuid": "ea8da5a0-760f-4c90-a039-98a500971c65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716346, "uuid": "c47d764e-ba2b-408c-9be8-d6b6ae167c2c", "value": "SecuriteInfo.com.Linux.Siggen.9999.10347.8826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d152eb5-d282-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1708716784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716784, "uuid": "a7c467d7-bab3-4ee5-8c6e-2b07d7dddec2", "comment": "Malware payload (BlankGrabber)", "value": "5d580f3fb5b68dfac3d86b3bfff5e255", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716784, "uuid": "610b4732-12d2-4f2f-af7a-d1c876a7d3a3", "comment": "Malware payload (BlankGrabber)", "value": "90a41e2732bfbf53d5a8ef3efa4d22d5a04b28089886dd104966e491191e79f4", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716784, "uuid": "277b7a19-c971-4e0d-91d0-c60e1a45a75a", "comment": "Malware payload (BlankGrabber)", "value": "56322afde25ead27ab27bcc0427c569914c3010a", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716784, "uuid": "bfd6196a-4bd4-445a-a084-8ee83633edb0", "comment": "Malware payload (BlankGrabber)", "value": "fcafe7d3bee09716bfe16f25e9e8d9cf6b7e584dbf11654568272247f587737b285eae0e7367703fe8e8308998c74ba4", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716784, "uuid": "3d544ecd-d813-4e80-804b-1f9568c8c800", "value": "T17276334293D40DE5F873423D8166D89ADB77755913A0C6EF83E8462B1F03AE1993BF0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716784, "uuid": "aea447ef-60da-435d-8805-2afeba21680f", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716784, "uuid": "00811a6d-003b-4a27-a002-6e78f2c994a3", "value": "98304:FLMc/urErvz81LpWjjUlLkvzgXO9hAlaYrzzuJZYJ1JIuIHKU73bcgVowgt:F7urErvI9pWjgyvoaYrE41JIuIqoxkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708716784, "uuid": "b839f243-05ec-4a32-b15d-26ad648cd4a5", "value": 7726822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708716784, "uuid": "6a836f21-332d-4057-affc-ceaa511c4a1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716784, "uuid": "a1d5084f-c372-4bdb-981b-038bf49bf4b4", "value": "nslookup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f68f96-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677720, "uuid": "b1cf7bfe-1c80-4e50-aa03-4c3091cf8c81", "comment": "Malware payload (Mirai)", "value": "1c13d7526960df5b97aba977cfe28471", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677720, "uuid": "b5f6fab8-926c-4ae2-ab54-3fbacfb1786f", "comment": "Malware payload (Mirai)", "value": "90cbfa112b367a54b7f33f36746ee2d98f13322cad846f2eb36107f173bf84e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677720, "uuid": "52287930-b392-4537-bb00-947cb7918db3", "comment": "Malware payload (Mirai)", "value": "32b7eff7c4c1494e65bea93425514d37d0e001df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677720, "uuid": "f02d4c80-d4da-4fb6-91bb-57ca6652d939", "comment": "Malware payload (Mirai)", "value": "247ae8c285b687734ca03b8e1c998a4f250c32a781c42bc1c78f6d53e42870909ff2bb102182317eb8145b0d5b597a05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677720, "uuid": "50fd8242-680a-44b0-9eb4-89025e8f4218", "value": "T1DF83E605FB610FB7DC6FCC3706A91B0139DC554A22A97B3A7574D828FA5BA0B09E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677720, "uuid": "3e0f9856-135b-4594-a07e-1d9f7f5d638b", "value": "1536:FcSIdbhvjWCmYRK9eOTsoU2kS5ZuDniNg6ZB:Fc3cQGeesoU2k6hDZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677720, "uuid": "df4a126c-e294-4e32-9d6b-6bee46d8d50e", "value": 80944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677720, "uuid": "1470c9d8-51d7-496c-816e-734f992254c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677720, "uuid": "d62770b4-61cf-48c5-9741-7676b62fe285", "value": "1c13d7526960df5b97aba977cfe28471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7896acff-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677746, "uuid": "3e2d5082-ff36-4040-9c16-40475bc28df3", "comment": "Malware payload (Mirai)", "value": "d84d8691a3232f9080752730483fb147", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677746, "uuid": "52d92af0-b36b-45f4-addb-364a1256f8c9", "comment": "Malware payload (Mirai)", "value": "9151fd2c9be0c24de98cd74f692d9952be1d39d10a9197f6f01e5d4a6b70b76d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677746, "uuid": "723e8921-3dd7-46c8-9c96-b72a967abbd1", "comment": "Malware payload (Mirai)", "value": "6f9f2f66b3effd5828022c8bd5a3e42672c31ca4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677746, "uuid": "e93e35bc-a9c1-49e5-a0b1-5387e8ead1be", "comment": "Malware payload (Mirai)", "value": "633f5610d4de8aa8e88ec0159ac4045888f04457f4f3384ee21a56e4cd60216d312e7211c5f18812c354eb1cdadef6c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677746, "uuid": "ccbd8a26-775a-456c-bbba-8d4d972a5130", "value": "T193532951FC815623C6C1127BFA6E028D3B3A57E8E2DA72139D325F20379792B0D77A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677746, "uuid": "791d2c6f-59c4-47c1-81cc-27338c038ec1", "value": "768:4AcFQhGVSyc6tQEQdgYmdHf2aM/YfxQid3RcXMwHi5dd94tmU7zVfTaDvEw7I:YFPxcdXmdHfJp531wHiPMtxnJmDvl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677746, "uuid": "a8daee7a-5227-4130-94b6-e21696ee3531", "value": 65140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677746, "uuid": "7134aace-ca42-4026-812f-ead1a96fb3b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677746, "uuid": "170508c7-5fc5-4a96-bac4-753946a2b412", "value": "d84d8691a3232f9080752730483fb147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e41da33-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708677594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677594, "uuid": "5d1933e0-12a5-4deb-a143-da939e05b1d1", "comment": "Malware payload", "value": "d827d916e23e9a75a9bdfab942270bda", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677594, "uuid": "5b255ea0-aba1-42df-8037-c5d6c9f3a734", "comment": "Malware payload", "value": "9231dd1fc685c7c04d943a9078b346a2e53bbf30c3903776cd6ad1544fe6f27e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677594, "uuid": "914f86b9-3c6a-4368-a2a1-eb69d92298d5", "comment": "Malware payload", "value": "e62fc5b580e1d17a9444a457dbba24a57c9ad41d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677594, "uuid": "60184d60-4644-4031-8641-c2b384f4781f", "comment": "Malware payload", "value": "359c3aea0feadcd8e33c44cba4f5419cb8afa9c332955dea1cccbcbd0002da8e4d2532b464231602ed4d1278cc85294a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "batch", "colour": "#5941FF", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677594, "uuid": "9c23353a-25a1-4c75-be56-d67b06529bf6", "value": "T10D56123731497A2E897719CB4C30B9813DBC688F1A18CD74AC9B9D3766A5FD03C2D626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677594, "uuid": "b568de80-5d8c-4dab-aca4-7c03682e15cf", "value": "98304:39MQozqaAK1ySd0PvSHWnkLTd1otUppjWlWFonp3Bak:39MQozqaAK1ySd0PvSHWnkLTd1otUppa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677594, "uuid": "b417fec3-95c3-4d63-b931-8a68fe91540f", "value": 5931656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677594, "uuid": "7e20d425-46d9-4873-bd5f-3c6e8b6f5732", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677594, "uuid": "57f9f598-d791-4b14-9568-4aca5695a613", "value": "chromium_based_browsers.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f567b6-d234-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708683213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683213, "uuid": "d34e3880-019d-47d8-9a66-5adf790118c5", "comment": "Malware payload (Moobot)", "value": "80ff44820444599d40cbd1b56eb8ebc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683213, "uuid": "9b2cd532-c7f9-4ef4-8454-fb18a2f36dc1", "comment": "Malware payload (Moobot)", "value": "94042605f659e0b4c8927225bad9c813c7443ee160cec23d7038e14a03e26fec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683213, "uuid": "eacf6237-ea14-4e56-8da5-9f5f0c720e25", "comment": "Malware payload (Moobot)", "value": "3e893c1bfe94e3b969622d5a65aa73c842f3d0d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683213, "uuid": "43b7ab8f-af5b-4856-b058-3e2abd57c16a", "comment": "Malware payload (Moobot)", "value": "8393c8a3073556af4d5ae4c8231472e4682021fb4536363a5f3286f6f7386cf41bc2ca142e6669c874655494240e293b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683213, "uuid": "16832760-16f8-4722-8d59-4d4564b07691", "value": "T1AE231980F88B81F4D917493450A7FA3FCB31D9398070C5ADEF9ADF32DA77641921529A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683213, "uuid": "b7cd9109-63e0-42d3-9b0e-cd9d5b78ce46", "value": "768:VCMpXkdjbNIHMG2cF+7WbSCIbcX9eKWtw4nst4zJS1vdIcPxw:gMpXkdjbUMGDF+abSCVVewLOzo1vdI0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683213, "uuid": "aa61b4c2-db35-4366-ade5-e890510106af", "value": 48400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683213, "uuid": "2af0a97d-aa3b-44d7-a776-f5a65ae48c49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683213, "uuid": "89487b7a-0e7c-479a-b7bd-dffb89c4bfc9", "value": "80ff44820444599d40cbd1b56eb8ebc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fe3c10-d261-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1708702570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702570, "uuid": "7b31cff6-1ef2-4215-b350-c409076216ae", "comment": "Malware payload (GuLoader)", "value": "03da9c507e81c3d36e04dfd7358c8d45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702570, "uuid": "6663456f-7445-4a60-b283-8b5aa944cdeb", "comment": "Malware payload (GuLoader)", "value": "9560561872222a9c56c76e35463d224f228f43c8321ee17efa2e45028f0cd7c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702570, "uuid": "1eea6801-5731-4bab-8a28-0b9cf41afd68", "comment": "Malware payload (GuLoader)", "value": "0b41c26680384ff3dc4acd2f5ea7edcfc8305ad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702570, "uuid": "62d24205-d542-401c-b6cb-e6da2fac4359", "comment": "Malware payload (GuLoader)", "value": "0f070812932458d2c332a2c8d656ffacc6d009a269694049e0d2858dd68b3ca475e36d02f46ed7971ad924982ccf949d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702570, "uuid": "38b0bfea-452a-4a32-b446-cafba76b3413", "value": "T1E20502764F6BDE27DC4474B1A1AF4C8FB570A4315BAE49123136793FCA297038E2921B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702570, "uuid": "3631cb8e-3251-4d28-b2f3-d8c96b37b863", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702570, "uuid": "3f4d48ae-c22d-430b-9f00-8698fa5fc726", "value": "12288:xfL1NhjwlrWHGGhbFXE2bn4B1CXcQN21Uz5YSow+jwHKgfAeXUffBjFHWBzI4pxa:xfLR8lrs1FXLbn4DCdZvbCwHvf8xFqra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702570, "uuid": "6ccbdf1d-1b03-4f46-bd65-f811849e5e1f", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702570, "uuid": "b1e05e12-f315-4517-b9fa-9a03be2b596b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702570, "uuid": "bc29deed-a3b7-44dd-9811-bfa2bc89892d", "value": "rethnical.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3a341b-d235-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708683577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683577, "uuid": "d3b9867b-c8dc-4f09-ac25-494b038bd306", "comment": "Malware payload (Mirai)", "value": "50046e930a311eeeac42636f53d90789", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683577, "uuid": "6722f66d-d0f0-4b40-ab40-63eefc716a76", "comment": "Malware payload (Mirai)", "value": "964c5e36b1d5900f2a36d19bdc6327c1c466b72ba11ed9ceb83b8617729847b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683577, "uuid": "fc8552e1-07ac-462c-a014-72c86b6d9de9", "comment": "Malware payload (Mirai)", "value": "cf8f7fc3673195a7fe3f11eebe895e41d4afd33a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683577, "uuid": "fb701b39-88e4-48a3-bb57-74d4564db5a1", "comment": "Malware payload (Mirai)", "value": "b4a492494f8a4c6d452405e102a8587f2cf30a8d513054e27b1e2b280df057cc411a4b3aae60e7499b0679d24cc553dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683577, "uuid": "30d5477c-684a-4542-8fd5-49723c7497d4", "value": "T148134BC5A153D8F8EC1705712173DB328BB7F4BA2179DB87C79AD932AC91501E10E2AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683577, "uuid": "513de671-b142-4981-a7ce-cf855ee5eccc", "value": "768:xiM6uHBEx+zxDrZcxLt+Wft3Ofc3Zcsqg6J4wqkHxr7Mypq:xivkBEx+zxDryxx+Ot3O/JfqkHN7M0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683577, "uuid": "3af54b10-5e26-4678-aa14-49d063b0375c", "value": 43248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683577, "uuid": "a5c3d455-d1a5-438d-ac0e-56d59c4dccce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683577, "uuid": "0012cfc2-ca6d-4640-a06a-c133043780a5", "value": "50046e930a311eeeac42636f53d90789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f50ed2a-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708677811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677811, "uuid": "7b3ce460-56d3-404d-b17e-2a229f590771", "comment": "Malware payload", "value": "5511c74b4d4776519a351e062acd6a15", "object_relation": "md5", "Tag": [ { "name": "BiBi", "colour": "#30CAE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677811, "uuid": "00134bd9-f0c2-4e9d-8ac1-9b1706b8acd0", "comment": "Malware payload", "value": "96f3aee2040c2075440dcce39c16f90ea9f5649061a86f51fb9c5baff4c5333d", "object_relation": "sha256", "Tag": [ { "name": "BiBi", "colour": "#30CAE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677811, "uuid": "d096a9fd-c09c-4c14-87ee-c2b380810ed7", "comment": "Malware payload", "value": "af93e08a09d97ceb1717b783d2457681433f38ce", "object_relation": "sha1", "Tag": [ { "name": "BiBi", "colour": "#30CAE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677811, "uuid": "7b548b68-ea5e-43f5-97bc-ddf236bb1ff0", "comment": "Malware payload", "value": "0a4b4c7d0161090bb447bcd4385aff0eaa51947ae9f983befa1cee466db03423a73d305b8da8a56b6be5b338ae339f4b", "object_relation": "sha3-384", "Tag": [ { "name": "BiBi", "colour": "#30CAE3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISR", "colour": "#0148EB", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677811, "uuid": "66c86a5c-33e2-4b25-ad82-5d7068b718e9", "value": "T1C7647C5AB3A904F8E973C13CC8529A06E6B27C160771D7EF17A446672F236D09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677811, "uuid": "760c538f-22b6-4db0-9ec7-5324255fb263", "value": "09646d7676a6f7a47bea24466b8d22e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677811, "uuid": "7c9849d5-68fe-47f6-b07f-1cb57aa02602", "value": "6144:WOgdivlT5Rt+npv/0bs8z9dk/Qj0UP8EohrYIx/:XlIntaDllPNoRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677811, "uuid": "871bfffb-e34b-47b5-afce-cd821d2e2476", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677811, "uuid": "de6b363b-ca81-4667-925e-61cdc9aa92c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677811, "uuid": "0ed9147d-635b-488f-b139-8fc3328fc976", "value": "BB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca9f9ed-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677726, "uuid": "513f3c24-32d9-4098-a3c7-96fd5002f3a9", "comment": "Malware payload (Mirai)", "value": "d7469c750586fec927cce2b4db883303", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677726, "uuid": "49013e05-c0b4-443f-b287-51648673075f", "comment": "Malware payload (Mirai)", "value": "976f4b7849f73e76f4d1e32f6790d9bc1617163c6a237fadf39671db160e1bf7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677726, "uuid": "fca4fe04-a52d-4301-8913-a0dfc002ebf7", "comment": "Malware payload (Mirai)", "value": "e57a8589803be746a7187459f3d430e6666cc449", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677726, "uuid": "6f632989-fefc-4713-acb4-824c8df3ca4f", "comment": "Malware payload (Mirai)", "value": "c9dfa85e0ff7be0163e3a23d932fd9293c1a2b5e49b6bd2f3fa58f2174a34388a347237b2eed0390882522fa5e2c1c9d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677726, "uuid": "558ca439-7f2d-42ef-a7aa-d55fd74900f4", "value": "T15FE34B0BB5C184FDC8DAC1744BAEA537DD72F49C1238B26B37D4AA226E5DE211F5DA00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677726, "uuid": "4a634d26-236f-4556-aed2-6e07ab5265fd", "value": "3072:iVy/QHH/NtQLCb2hybaBcwkge1Q0/Sn2JH9lbu6uPTqMAt4:iVy/QHfNSCbhDMIuP1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677726, "uuid": "c485d06f-04e8-4d1f-a181-a962c1fe4931", "value": 155944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677726, "uuid": "d64a9137-410d-4367-99d0-a8bd327a0937", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677726, "uuid": "8f2d48e7-d3e3-4186-8bb2-6afbf50519b4", "value": "d7469c750586fec927cce2b4db883303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423c6e8c-d234-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708683238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683238, "uuid": "2a7efb8a-224f-442f-9c4b-8c324cb6fbf4", "comment": "Malware payload (Mirai)", "value": "4c2e352051e6a709079e51166548300e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683238, "uuid": "f0976a01-5a41-49d3-b991-4abdf7ae8283", "comment": "Malware payload (Mirai)", "value": "986ed134e47ce1e566f2de943aa029b8e7457b27c87bb877a894f6810796f664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683238, "uuid": "bf2e427b-8f37-49fd-b9c4-b00932787c00", "comment": "Malware payload (Mirai)", "value": "970e49538a69b20b5e3e5af1d1e40a926394aebf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683238, "uuid": "219a1138-886a-4b15-a712-4dafa596b614", "comment": "Malware payload (Mirai)", "value": "2e2ce4bc41f8130e1752f00640811d573d90a0a05571c860221039214a8778d03061d7cdba3d2b3f40f7a2103f19314c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683238, "uuid": "9a9f8278-fa7a-4dd9-9512-b2a7376e174d", "value": "T1CF334C4AD793D5F0DD4309B0116BFB3AA932AC322160EEBBC7D4F967BC72612944624C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683238, "uuid": "bec27336-cad6-45fa-a963-eabe425e616b", "value": "768:THJz1kSfNZUZmbCHaunJ/ZfcZVeYQAV87Sjr6DfdWK+cToM:1nf7UZmbCHzhYHG7SSBAc8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683238, "uuid": "150dc8e8-69de-4e6b-aa56-88a90fd9e6e3", "value": 50660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683238, "uuid": "44ed8eb7-cace-4465-9002-54ac3046b003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683238, "uuid": "70d05027-8ef2-4ece-a5fb-57d4f0641559", "value": "4c2e352051e6a709079e51166548300e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73904501-d266-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708704796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704796, "uuid": "2c807ae9-c0c7-446e-b7f1-c2abc1dd05cb", "comment": "Malware payload (Mirai)", "value": "34a0a5908fb10bff9c7fb6a75cf635ac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704796, "uuid": "69e32008-5d57-488b-95c3-4c40495050ba", "comment": "Malware payload (Mirai)", "value": "9a4bbdc6c8805bf7465e217df87e6fefc9bfb4f23809e533402277f35087caa8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704796, "uuid": "26525092-8af5-4cca-bd23-e0a8df490232", "comment": "Malware payload (Mirai)", "value": "7863e9f64bf3f1075946cb7059de5a28f370935e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704796, "uuid": "19da717e-33a1-4612-9368-7cfc8c10a740", "comment": "Malware payload (Mirai)", "value": "c21c4bbea26631ca1b5afe5401bd442baff81f90ad29fd31db647833f0a834c0435245264f5a7976b01680b7e826990d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704796, "uuid": "b2e1d3a8-49c5-4aba-9f27-d8e90c8e1655", "value": "T187D32945F8909F23C6C212BBFB5E428D372A17A9D3EE72039D216F25378685B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704796, "uuid": "4cb12c31-0307-4063-a2cf-9f4ead11890a", "value": "3072:tplIgzzYlPfo3Pj011qPoc38/24iOiHcR3S5mrK8Agkq/FS:tp9iowqv4igR3SAW8NkqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708704796, "uuid": "5992d5c9-430d-4e1e-a49d-664dbf45e4e7", "value": 142176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708704796, "uuid": "af40d664-0c8b-4d44-9b25-209106677728", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704796, "uuid": "0e0139ee-ee56-47d1-a12c-5c0ca749f7da", "value": "huhu.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19d7da6-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1708705786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705786, "uuid": "7bf7691e-1f60-4324-aceb-72df864c0fc7", "comment": "Malware payload (SnakeKeylogger)", "value": "7a9f52bf41ae0b6bb82828c1249f954d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705786, "uuid": "b35ea708-95bb-42a1-9a3d-3357f580017a", "comment": "Malware payload (SnakeKeylogger)", "value": "9bcda9f3c4d2080696f278d4a7cd828c652136925747983a5314ba0a2d991e77", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705786, "uuid": "b7c475f1-63b1-476a-a1c1-6ffd7819eb75", "comment": "Malware payload (SnakeKeylogger)", "value": "7a0755477f5523fce6c3333fff0c4f69902248e7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705786, "uuid": "a9a80c95-3329-42a2-bafe-65e3b1bd3a22", "comment": "Malware payload (SnakeKeylogger)", "value": "420794e27f8ec493a8dd8133f966157d9eeb59c1f7ab3eed8db44eada81ba342bf8d342054f6b4300d05a17ac9c8aa7b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705786, "uuid": "7c0d1ac9-d197-4ac5-95b1-5acfef8fcd55", "value": "T12B45238E8CDCA079AEB33FBBAE086671B438FE7A302C0562F91CB0454597C179395576", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705786, "uuid": "a5dcf402-979f-4dbb-9788-4c79edde8e19", "value": "24576:j7vOMeCeCtD+pJ5XSUPHXz9+CtD+pJ5XSUPHXz9r:jrO9CC5XRY5XRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705786, "uuid": "3c1821ec-caba-4d17-96a0-5375e8aed324", "value": 1257046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705786, "uuid": "b9fe1d6a-2bf3-4848-adfd-f652d0975954", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705786, "uuid": "be5419c9-d2ac-4379-a7a0-da8ab3d0b353", "value": "scan copy.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be39997-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1708705186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705186, "uuid": "b7af372f-1135-4e9e-a062-e6e4fa5b89d3", "comment": "Malware payload (DBatLoader)", "value": "0ca3ab2fcc924dca6f75e642608e7333", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705186, "uuid": "2702c709-b72a-40dc-8ad7-85941bb1e3ac", "comment": "Malware payload (DBatLoader)", "value": "9c4f07bf03072c9ad7574534308038647ce670fa94be0556da59560dbcb10acd", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705186, "uuid": "af160adf-b2c8-4a5c-bcb8-7c9ffbba76ca", "comment": "Malware payload (DBatLoader)", "value": "cb4bbfe04d6565ac0f209917829bacfad4f79b31", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705186, "uuid": "85aef3c2-4865-405e-9b23-3907d58adec6", "comment": "Malware payload (DBatLoader)", "value": "a420ebb6a4f884ed3e59275a2f94bf597e889844ed73fee0c1d6eb54f0e557ba25e8fa8ffa39ba747627fa6b85510a02", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705186, "uuid": "1993a87d-5b08-4d58-8987-abc8c341b175", "value": "T15AB40120719EAD9FC34226B14F4B789E311EBC31F6C49A1B366CF70D0B756A68A1345B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705186, "uuid": "e90010e2-bb47-4797-889f-66c7f4c151c5", "value": "12288:dkk4/KLUbCfgl2bjpozwjT4iumEarPEEty/tsnz9:6/KLKCfglWKWAmdrPEgyC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705186, "uuid": "3a7a414e-9230-4516-9a11-a3cce335d904", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705186, "uuid": "b7bec958-9bbb-49c9-9ba0-50f67e75d72f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705186, "uuid": "dd6ba975-eee7-4987-98a0-5301a0eba53e", "value": "Reports_Remit039928394.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e55f47-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1708705355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705355, "uuid": "b961762c-8a52-460d-a93d-68b15326b630", "comment": "Malware payload (RemcosRAT)", "value": "832794d02850ce3b1919c05f5f9b29fe", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705355, "uuid": "4c044f65-6a62-4385-949d-e2be92cf10ee", "comment": "Malware payload (RemcosRAT)", "value": "9e7fba7b5b34a130caab8a51221449e888a335e4c9503551b6bcf86823e4f8b0", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705355, "uuid": "f82a4cdb-6992-47f9-bb8c-5f622398c0a9", "comment": "Malware payload (RemcosRAT)", "value": "083c703bd0d2f39c192e880591e549327ff3da31", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705355, "uuid": "8f07143d-b0b3-4eb4-b125-1892df7614ab", "comment": "Malware payload (RemcosRAT)", "value": "4f527a3769f7472a56124f3efcfd28af51d5b31f7d18ec9dd52f37e0f8c3a5690088519ea498193dd8545c73cf539d1a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705355, "uuid": "9552b37a-f173-4d85-8c71-554bdd073eba", "value": "T128A1CF2123D300ACFFE237808B9558DDB80FF5E555FE668908C259D8DE62E488F92772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705355, "uuid": "4045b404-73c0-4e46-a120-fc10c48db799", "value": "96:u8jguluQpxnRl3rW9ilTzo+c5AvPWjF2GRbuHw2srfHuqKr5V:u8jguluQpxnRli9ilTsBevP+F5RbWsMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705355, "uuid": "753708d1-d4b3-4161-8fcd-cb683462dbfa", "value": 4714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705355, "uuid": "0e74822b-d6eb-403f-868c-9dccea927655", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705355, "uuid": "c8da599c-7ce6-454e-816c-910e3d96a418", "value": "INVOICES FOR PAYMENT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc197c2-d259-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708699417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708699417, "uuid": "cb807fd8-3d3d-42ca-9df1-d1ed19e35462", "comment": "Malware payload (AgentTesla)", "value": "53270c6f295520b4b048de2eeb85764a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708699417, "uuid": "e7cf679b-3d65-42bb-8f39-5c1e6092bbce", "comment": "Malware payload (AgentTesla)", "value": "9ed5245661ff83b3ac5baa844f3ead199d53bb2fb7f5d3df3ea204bc1bfa561e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708699417, "uuid": "93e84360-95e4-4f91-8e78-09821e6454ca", "comment": "Malware payload (AgentTesla)", "value": "938be131b0dbe2bcc76e21f6c69935e1004d9461", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708699417, "uuid": "c5e8fabe-d1d2-45e6-aa66-5697d8012bd9", "comment": "Malware payload (AgentTesla)", "value": "9de0b490d84f6c83e847535ec519f69baf9ab326d9efb29baf37ffc9ba9fffd65f5d30b272abf05f34c129ea4fba188a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708699417, "uuid": "7866751c-d7e0-48b8-8d99-eb70300cb2dd", "value": "T169E4231223EAD373CE5B4BBC15A863114B36B0496807FFE27F9860DE5967F124E12987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708699417, "uuid": "ceff06db-9c03-4ce6-8972-e7836118a5d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708699417, "uuid": "26c8afd9-80e8-4321-9967-504754d78109", "value": "12288:cXJibRzjuN58nVJaKSUzlpu/2htSgLrWWzPzwoptmvcvEmcQAKXV6kzBh33:cXJibRzj65MJaPUbHSgHjrrtkKEpwXVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708699417, "uuid": "cbce16c1-fb0d-4b5f-884c-dc0b3755b093", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708699417, "uuid": "5ebcfd59-4031-4518-b9be-bd1baaa1218e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708699417, "uuid": "05e3a538-4ddd-40c9-9349-57ec480731a2", "value": "rCompany_Profile.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7676a28-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708705795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705795, "uuid": "b6ddd58b-9ce2-443c-aca7-ce793d59d9b7", "comment": "Malware payload (Formbook)", "value": "21e50aac4c206237f792cf58d7a5da6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705795, "uuid": "27b67dc6-d4ca-47a7-b966-e6a68c744b09", "comment": "Malware payload (Formbook)", "value": "9ede0b2f911748543f03b8e7952d5295f9698dd89db7202273e6e0fcaded71ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705795, "uuid": "b8f5cdc4-921d-49ed-8f01-178992c5a4a1", "comment": "Malware payload (Formbook)", "value": "bc366ac6d23495998085ef289dd04f84d56c11dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705795, "uuid": "c6ab9090-c136-49b2-be83-8878147d0864", "comment": "Malware payload (Formbook)", "value": "be336b6935e46cfc2cc6ca00a3097477ec0149e0a05cf39e40228681666c2dbe3b14da6383a0b07f525d7e29156bee32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705795, "uuid": "d1eee869-e345-496b-ab76-73b888448f27", "value": "T13565CF027380E066FE5B54734E5AEB5047BD7E660027D61F23AD2A79B9F12A2013FB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705795, "uuid": "1f322f57-ee02-4f14-9b3f-dd5c835eafaf", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705795, "uuid": "384d9775-5bc2-4a2f-96cc-e064a49f326b", "value": "24576:KqDEvCTbMWu7rQYlBQcBiT6rprG8aIGctMPvk1nLMydOW8hO:KTvC/MTQYxsWR7aQMPcxIDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705795, "uuid": "08edad88-b5bc-40d9-93bd-85b02900965a", "value": 1424896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705795, "uuid": "aaa85135-b980-48f1-bf0d-33a2299717aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705795, "uuid": "a8187b59-d9d1-411c-993e-0d09d07e81ca", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60562c8-d20c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708666333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666333, "uuid": "cd836fd5-a668-4a10-9a0b-886a953bcc62", "comment": "Malware payload (Mirai)", "value": "13ef3819a8adb6cb90da5cd0aa1264b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666333, "uuid": "bd0e9a8a-e444-4142-a72d-14032d38d14a", "comment": "Malware payload (Mirai)", "value": "9f79e9bff2779e181e7fe43b1e98d183cebe2e9e70a886071795130d0d6b5c71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666333, "uuid": "bad63f49-0020-4876-9765-3a39830d108d", "comment": "Malware payload (Mirai)", "value": "f97c4590a8643079fd3d661251bce547f6b93546", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666333, "uuid": "5372e2c8-7935-4b6f-9663-230eecfb27d4", "comment": "Malware payload (Mirai)", "value": "7494e58b0b9d3acffcb9b70f56a6642c21537b8de6a849a9b29e056789fa4899788fdb799d9d42b58a19da72a8145cc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666333, "uuid": "6e9047d3-678c-4e07-ad16-c6a8a27e9cc0", "value": "T141B2C0CD61543088CA8D7C7C1B8D4A665F6CA1C0BAED9B26E354CD9873BAA4F385D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666333, "uuid": "03ca535d-2b2e-4544-b444-54f613941f4b", "value": "768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBpVa1Zq8WvZb:BQlS07FUXqIYSXQKqukLq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666333, "uuid": "ed826257-253b-44f4-a13f-d7d6c9d4a053", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666333, "uuid": "0c9dda13-c823-42fa-9a33-4f720759f44d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666333, "uuid": "98434207-a7a0-4da6-9398-e6f062e27418", "value": "13ef3819a8adb6cb90da5cd0aa1264b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17f921f-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1708705329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705329, "uuid": "177412c9-c08b-49d3-a1df-93213449e41d", "comment": "Malware payload (XWorm)", "value": "5c30c285370f257ff8ebd5a49ebfc9a0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705329, "uuid": "5063e7f0-cffa-45cf-8261-f7cdc50959ef", "comment": "Malware payload (XWorm)", "value": "a02974ca9099b0f4dd583673b7840c2749b69f4e832030ebaf09a9da0313c60a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705329, "uuid": "b630f50a-14ad-43ab-95bd-636787faf42a", "comment": "Malware payload (XWorm)", "value": "225dfd4cbdfbe079e168bb886f2fc8805aa9d68b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705329, "uuid": "d96738d8-86ed-426f-87e2-ce62bdd6920a", "comment": "Malware payload (XWorm)", "value": "d570f28d3c7709a2df4846bbb20876444576f01ae811a47995d0b64679c9fcc8dad7c9749421a15a8dac8b6d9481d38c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705329, "uuid": "fae40036-beb1-4add-b57c-bc10e6fcec09", "value": "T1C6F05462B7FC4205F5F7BB1469391576476A7F4459BCC31D12A0180D0DE5B048875BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705329, "uuid": "acfa46ef-0d10-4cbe-89c9-e2428fb4ddb5", "value": "12:Q2/oGr+FTcoGZElghBTH+moGZRbdGZ69If8fz4rk7QA17mN:Q2gGrGGZE6hBCzGZRbdGZ6ef8f0o7/1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705329, "uuid": "ca7de9b9-9745-40cc-8e81-4fb02c24a583", "value": 588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705329, "uuid": "9d20ef81-6143-4b29-aea8-1bb6f0bf4e03", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705329, "uuid": "d8c66c96-75fa-4215-85bf-d4efc00d3746", "value": "4688964.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b526c4b-d1f3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708655336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655336, "uuid": "db792b42-d522-4e1e-a6af-bc687d046583", "comment": "Malware payload", "value": "4aebae857e36db8928902bd704753005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655336, "uuid": "43a35e30-cf45-49d6-99cd-3b6a34e29620", "comment": "Malware payload", "value": "a07cc5da63e027b909fb2cb71482141ba8a0fa055da5108891e5967f7b36f029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655336, "uuid": "e8c6a494-ecd5-4838-bd59-05efd26c468a", "comment": "Malware payload", "value": "2fc9b36f55a9b91ee7bfd46d76fce96160247787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655336, "uuid": "b6d7ca57-0a45-4702-8174-5c4ac3d1b12d", "comment": "Malware payload", "value": "2e15a998575d94eac3fc51745fe09028ac28d128e9e44cd96fbdba43d2f6743fd3475e01986194bf8c3825e8c213dee4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655336, "uuid": "dd1ac3c3-035d-4b6d-a55d-b66e693ab803", "value": "T137256A40B9B2D0B1C706103B1E7ABB76A5A58F0E5F04CACF6354FF9C6D7326168362A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655336, "uuid": "41bdfad6-cbdf-459b-8ccd-4e2d69d7214e", "value": "6144:v0jf5HNAyHGItxmcwhmyBLv/6hloY7Yf0cAPa+1RpJ3bS11iI2AMEeCZSSa+xj:sjf5tnIbhmyBDIIpZ+1Rf3bS1p2xEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708655336, "uuid": "8727d293-669c-42a6-8a40-ccd0d92c5b62", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708655336, "uuid": "2b25cdc5-4567-4d28-a54a-24a256692d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655336, "uuid": "9b7ebd42-78a4-4984-aff5-e7eacd2268d7", "value": "SecuriteInfo.com.Win32.Trojan.PSE.10S0A6W.21416.2571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d25421-d231-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708682135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708682135, "uuid": "b61d9fa4-c495-4612-9a26-b87e48388ad9", "comment": "Malware payload", "value": "70886787e1eb706d74c31142bc4e40ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gimp-pc-com", "colour": "#E4B56E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708682135, "uuid": "8a3b725e-2e29-4bd3-8f61-fc0c32771ef2", "comment": "Malware payload", "value": "a3e23e553130cbdf0053a7c95311f11384f4e13b9b0a656a4506f6a5fdb618f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gimp-pc-com", "colour": "#E4B56E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708682135, "uuid": "5eb2896e-2465-4f5c-a332-93dd0cb51e41", "comment": "Malware payload", "value": "66b2e3811c798490ff297463adc2ff3874463dd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gimp-pc-com", "colour": "#E4B56E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708682135, "uuid": "0c324576-5cad-4e88-b206-b6713c1a0152", "comment": "Malware payload", "value": "65f1d568dc4684d4288e4768e499e96ed2b53e2e21088160b256fcaf5879f1e1ec3f00a64aa49e1c745c472f8ed87145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gimp-pc-com", "colour": "#E4B56E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708682135, "uuid": "b3b7f69e-5490-4724-8614-8f8d43878b4f", "value": "T18A4629C0FA8B54F5D9432B3194A7627F57342E098F24DB9BE704BF6AF8372911936209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708682135, "uuid": "42bea576-baf0-4ec8-9ef5-7686913ae16f", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708682135, "uuid": "7548ee67-2dff-4b78-a631-1f91a675d8ac", "value": "49152:CwleOjheUjqAK9/F6MTVXo/ZwxmD1QohH5iQ8dKl7UXLDzaIjnECy7o9aEKNJ6jX:nleOIf3K1wRLfaxyMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708682135, "uuid": "7c4e9a1a-c3fb-4374-bed8-16d2eb59dcc2", "value": 5806080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708682135, "uuid": "32827b19-cbab-4d66-9f33-d3dc2ac53ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708682135, "uuid": "f2cee157-1931-47c0-bc3f-c0f6900f011f", "value": "SystemSpecs3D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddce7f00-d20c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708666319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666319, "uuid": "982b17d1-c9ed-44dd-835d-bbbbc270d218", "comment": "Malware payload (Gafgyt)", "value": "cb074f18ae32aebcaee03b6c3ce00b6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666319, "uuid": "39434789-1f12-4d11-a2d5-db80c512a653", "comment": "Malware payload (Gafgyt)", "value": "a3e3cf3f08879e78644ff74671fda20205506ba18f8dd25c93cf18ee41fdb1dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666319, "uuid": "46b72c3f-3c81-4422-9787-554d02f82fa2", "comment": "Malware payload (Gafgyt)", "value": "b774ec40b366aec2750883506943f0932524157a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666319, "uuid": "7a594b8c-31af-4f60-9bd6-37ffbf6923b6", "comment": "Malware payload (Gafgyt)", "value": "5cd7688e8f7c3325d69b2f05b21e8df8502b44a3e1ba1b1cb700519f3638074490c7e58229883587b224c0fcac9dbe7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666319, "uuid": "0bf22461-6573-49d7-b06b-e13c10182288", "value": "T18FE33905D7408B57C1E2277AEBDB424933339B54A3D733099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666319, "uuid": "fc22a874-963b-4f4b-afe1-98d386177647", "value": "3072:ut8iFDKEfFN+Fa+1sWgh7a8oXV7pUMbmQwfCMQiGW:s8iFDLf/+FaNRh7a8oXV7p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666319, "uuid": "df3dea9e-af15-4630-a6e5-0574faafe1b3", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666319, "uuid": "9081f221-d880-4c9f-8923-a81e7cc67581", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666319, "uuid": "207a426c-db99-4779-9864-e8bcf0d27e08", "value": "cb074f18ae32aebcaee03b6c3ce00b6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3cb4963-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708708823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708823, "uuid": "68c63366-5a88-4c2d-995d-f357b0a9ade1", "comment": "Malware payload (Mirai)", "value": "06979f9ba895b5306691e9d7273e45de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708823, "uuid": "41f40c3c-6260-4360-9838-d3584fc2aa6c", "comment": "Malware payload (Mirai)", "value": "a3e77aa71704611bfb4f515e9cfbd6bd55bd852681b9e237ea1a0286f5eee2a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708823, "uuid": "c8073ea8-3a90-4942-975c-0bbed43361b4", "comment": "Malware payload (Mirai)", "value": "27c2260c43322f3122cae5509ab6527517a1d6f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708823, "uuid": "da7de11b-a84e-4077-b9af-f233280aa409", "comment": "Malware payload (Mirai)", "value": "51888ff1a758ae6481253df66eacc013ec21a1080b9bb48175d57e2da0cec76b997689425d5a295095d73aae767cd344", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708823, "uuid": "7e875ade-5112-4456-97a8-ade581be38f3", "value": "T12DB31977A4515FB3C045A5F125BA99320F12AC931B1F1A84763DBAB04B3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708823, "uuid": "83045978-2766-4892-b5ac-e0dc1e4ce7d5", "value": "3072:ewNUWqpiccXBr6yKYz0VUMmH1cuEgv26uN/:ewNjqpizOMz0VUMmH1cuEgv26uN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708823, "uuid": "e2583a54-98dd-419e-a297-81f61b6c4b88", "value": 112634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708823, "uuid": "fcb9200d-acac-4370-b2a6-db19dcd98739", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708823, "uuid": "49d74491-5c0c-4fb6-b58e-ce50e88080eb", "value": "06979f9ba895b5306691e9d7273e45de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16d72dc-d1fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708660205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708660205, "uuid": "bd0e4043-1fd3-4225-8ab8-d02240783720", "comment": "Malware payload", "value": "7ff29bd03f59d9fee1072624b4ecbda6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708660205, "uuid": "fd81fc11-805a-4962-8a4d-28487061fce2", "comment": "Malware payload", "value": "a638e5cfe6e72a60bb6b6ff88f36afca5c1c27277ca609a9d08c9f567df6f18a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708660205, "uuid": "2a42db05-835a-43d1-a33a-209985269581", "comment": "Malware payload", "value": "7810de9b1d6b314069482e45a81db302703f60a7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708660205, "uuid": "843afcd2-2b60-4bda-a960-35c586086ae4", "comment": "Malware payload", "value": "8a32acb79fdfbb0d140ef39271cc29597d297b9449516d4c16a827356a4a0a3abd48a452b9989550cfb0d2058ae8d56e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708660205, "uuid": "4dcf6bdf-96b2-45c4-9713-e9461c2bdc08", "value": "T191853335A0C436C0F3D677DE5AE981389E0CAAD54B3E0884E287679D65C0FDC619ABC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708660205, "uuid": "06c592a7-29a8-4ccd-9430-bcdee0dd3407", "value": "49152:3nnKTlVZhlRA7/ihYdBHPBYeL2ONcAK2GvtT7CBlK:3nKJVHlRA7/iGPHpYeqMcz2GxCBlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708660205, "uuid": "1656edea-d4f1-411c-aa8a-f52c694c0dcd", "value": 1801327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708660205, "uuid": "7b394ccd-84d8-4749-be92-21a3a4cd86c0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708660205, "uuid": "d3fe340e-6b4a-4005-ae4e-bfa01b5c25fd", "value": "RFQ Sheet.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b785024e-d20c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708666255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666255, "uuid": "4548567d-f4c9-448a-a423-5cc7604bc8b0", "comment": "Malware payload (Mirai)", "value": "855b1dfe385d66abb749163e2aaf9b98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666255, "uuid": "3ab97f3b-7719-4e83-8732-591dc67b7f65", "comment": "Malware payload (Mirai)", "value": "a676bcc037e3b190f3b713042dd12fd02783f8f43e3ccbaeff06660d8488aed6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666255, "uuid": "97744d6b-6d6f-4e57-8be1-e61d0effaee7", "comment": "Malware payload (Mirai)", "value": "f1dcfd24e753fda110c327c79829169f2456aec4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666255, "uuid": "50ab0cd5-5c2b-4ca9-a342-a621cd1d29c6", "comment": "Malware payload (Mirai)", "value": "01d94815a99cd8f4d56a8d63df783ed0161fa0210b977f857737eabc62eb3a6a2187b73f6472bd0098d98f0f55bcef32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666255, "uuid": "2e37955e-5cc9-498a-9784-027ecd613118", "value": "T132230231890A9EB525303C76DFD5D7937AE02AB1C6672013D6280B3C6F757131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666255, "uuid": "81e18341-b2ed-4af9-9e96-95d67e34fa59", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3X9q3UELbUXfi6nVMQHI4vcGpvU:DECFd+A6YHAxmLRQZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666255, "uuid": "bf19c28d-0a4e-455b-9d23-f1286f9cd5d5", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666255, "uuid": "e884d0dd-934d-4014-b3f9-34e706ad4602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666255, "uuid": "94b127d5-2e07-41dc-96db-46b3b9acae3c", "value": "855b1dfe385d66abb749163e2aaf9b98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf92a71-d220-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708674879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674879, "uuid": "f22d738a-afef-43b3-bb20-b200c243e4a8", "comment": "Malware payload (Mirai)", "value": "f222cdfc4d0e9151c6a47e2c15d49973", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674879, "uuid": "8fa05817-12c2-494c-9bc8-d4445ae094d3", "comment": "Malware payload (Mirai)", "value": "a6d50922d5b62b7f4d38c0bc2f71a7613642d17b4eb1f39a70d6b03c9fffaeab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674879, "uuid": "e9ea6d8f-7e35-4d97-98a2-d11481711514", "comment": "Malware payload (Mirai)", "value": "f8ee0d00a18da551dfc116c3093059bd7f2b4e9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674879, "uuid": "fc14102c-0048-41b4-b7d7-a396f042a93a", "comment": "Malware payload (Mirai)", "value": "4909a497fa09c26d79fdd8f3e819114a51f998556ff6b4a2b2d52dea173929d0b1c8df3651c23c42ffded27995be186e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674879, "uuid": "c988f63c-d9c1-4b12-9eb7-70eb0ee8719a", "value": "T1C5216557A5C56D94CF28D73C4DB157517B06D935C84FE3CE4F0C46B6292F38C66A4094", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674879, "uuid": "a79fa5be-287a-42f8-be8d-940658f9d7cf", "value": "24:wCVm4llns9wdGtSnUpzzbBWpzmnvOKGB5gDgvmxvGgkC7m17olNfu:wal/sOdxnUpzzbBWpzmn2UDgvmxvGg7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674879, "uuid": "cef5a2aa-411d-4c56-b254-abee23492eed", "value": 1192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674879, "uuid": "51c009d9-83b2-442f-ad8a-1dbcaed0fe12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674879, "uuid": "209909f7-f7cc-45f4-a434-ce4930c79227", "value": "f222cdfc4d0e9151c6a47e2c15d49973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be67e385-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1708705351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705351, "uuid": "7aa978e9-3a2f-4b69-a878-ada5e482d566", "comment": "Malware payload (XWorm)", "value": "3cdb320252963303de00451f26cead1f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705351, "uuid": "b599f0a5-23a6-4f5d-a6c6-bae240af9fdf", "comment": "Malware payload (XWorm)", "value": "a751246dcdeb752c75a29edc0c223a676f07c808141c13768fe086a08d2270c8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705351, "uuid": "953820e8-ad63-4f34-a9f7-6ccfcf882c1f", "comment": "Malware payload (XWorm)", "value": "44999aabe2bbca0eaca90936921110973bbae0fb", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705351, "uuid": "9dd659ad-f451-4cb1-bb75-4b91b23846a5", "comment": "Malware payload (XWorm)", "value": "941c1b95858b72c8f55d829971a16cfa2c2422199b70ccdf2f11ae9c4785cb68080c1e1cf8e2cb776692f2254941b5b1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705351, "uuid": "6f2dffe1-f0bb-41d0-b469-1943796e3bfb", "value": "T1C4F090827BF95300B5B36B4445392575172B3F54A83CC21C11B01D0D0EF0B408576BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705351, "uuid": "cd762386-91b6-48c0-b9d2-b61f7c78130e", "value": "12:Q29tw0+FT6RElgh53RHgHRfltR69If8foY23VQl3w01nSGN:Q29tw09RE6hpiRfltR6ef8fMVgw01nbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705351, "uuid": "4e2aabfc-ccd4-4e28-9982-d9600a54866a", "value": 592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705351, "uuid": "14f47cca-a115-44a7-85fd-dbd43389fd44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705351, "uuid": "6f1df91e-b9fa-4bfc-8150-52df9086d74c", "value": "75658609.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5eb35f-d255-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Havoc)", "timestamp": 1708697400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708697400, "uuid": "7b401f8a-ebcb-40bc-9b54-62170969a229", "comment": "Malware payload (Havoc)", "value": "f1a00d4750fb35ec5d20057997b0f2f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708697400, "uuid": "65eaac5d-8731-403d-97f3-eed1b17d720f", "comment": "Malware payload (Havoc)", "value": "a78a8dd4f4f4a99387e2f26b2b20d10d0647a3cfde19619bb250650998abd7f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708697400, "uuid": "2001602f-44f2-4344-85a2-b69f51d8c343", "comment": "Malware payload (Havoc)", "value": "e745074117469a6e2cf51e717a0a28a65817f28e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708697400, "uuid": "7873a819-0d46-44c3-a5bd-7b25e3965b70", "comment": "Malware payload (Havoc)", "value": "9c9056a7113575dc06970312ff971cd0be2fd2a75d0b868509cb9c588f10867cdf5708ecf59fbc73fd7d386711f9125e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708697400, "uuid": "586d434f-5306-4587-8382-4c60f98e6674", "value": "T17293A419E203E1F6CF0B49B0134BF2EF8A7551329470CD46DF9C1F169AB3E69A588B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708697400, "uuid": "f82b684b-c15a-4203-9610-53252f5e2ed0", "value": "1536:EVX4tmH109ukn8m8sl4rWpKRs/SuB0MSDx8WK4neLR/LFdgfGGbBHxU:EZ44V09x94s8NuB78CWKieLhLcfGGbBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708697400, "uuid": "d90243c9-8ab4-45ac-9022-96896a9ac62b", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708697400, "uuid": "8ba2bbde-5005-4e71-bae4-1fdcee4b351c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708697400, "uuid": "9c70920a-5a21-469d-9edc-5db245457e73", "value": "f1a00d4750fb35ec5d20057997b0f2f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4aa96b-d24f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1708694749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694749, "uuid": "aca8dfa1-9464-4f35-9866-f3fb197a08e1", "comment": "Malware payload (RiseProStealer)", "value": "7ef0ee2d1ede7b0e684e566163dd98cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694749, "uuid": "074461bf-a59a-442d-afec-f7202c526c06", "comment": "Malware payload (RiseProStealer)", "value": "a8fdc6707c7a7d45de25f1ebfe17ef7b357f6108bb5086b22cd3d30abed049e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694749, "uuid": "e64716d7-e2ff-4ba4-94ed-4c817a93d813", "comment": "Malware payload (RiseProStealer)", "value": "c9cfdc6efd3223485ea95a832585120e60ced396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694749, "uuid": "dd2ac577-08c1-4e35-b28c-00490755a37e", "comment": "Malware payload (RiseProStealer)", "value": "50967d1d1c87b5d9e84eee90e9cf436002c67db5cdd29614808bfad39e837bf88e9a8d74b50be5081e23a2cdad6475a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694749, "uuid": "1a83f281-df9e-460c-aa19-86057c5beb4b", "value": "T1FD5633422DF331D4C8C9A6B56C02BC6C75F45D3192B0CD29A4A5B2C7DBFB5B0A6B6183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694749, "uuid": "be5290ff-abc3-4dbc-9563-7422976ca9fa", "value": "d716233fa9e0a1b9e5f58fbed8dcbfa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694749, "uuid": "1046dd4d-cbdf-46ae-9360-22cfae2d86da", "value": "196608:Qclq2SUgfGteN72D4BcuASpKsNP1sPBBfhb0RU:H4UeUo9cFXsNP1sZVhbuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708694749, "uuid": "bc9e6346-1bcb-4385-9a4d-3b7b10071aca", "value": 6459992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708694749, "uuid": "d9918a05-ce91-4416-8be1-ffbb3e6f637c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694749, "uuid": "7f6bdf43-3eb4-44bb-a200-d63d2daf3690", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85b7b89-d226-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677397, "uuid": "e968d065-dbec-4bbb-b0f8-8e8a78597e8e", "comment": "Malware payload (Mirai)", "value": "e3aea00824dfd28b756c6b0880ef9e9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677397, "uuid": "a0a6eccf-fdc9-4d5b-b490-e4a6dd6bf458", "comment": "Malware payload (Mirai)", "value": "aa3c87083dfb10cd9c137e1651bd94a2c3a5d6bdf40cb90105009377fdb5f656", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677397, "uuid": "a5a19221-1907-42b5-888a-dfbf69001195", "comment": "Malware payload (Mirai)", "value": "32f57fa10507cda7a7b4254930ac4bb93536ef38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677397, "uuid": "903993d9-6aa9-4186-9b80-c4db4a52d607", "comment": "Malware payload (Mirai)", "value": "e1baf774349c55d3aeec069cfbcf15648fc6d6f2d8a34c0eadcec729439dd1247cb8ec47ac6bf5dbbe8c7f916880a001", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677397, "uuid": "54447c93-ee94-4ee5-a78d-d998cd9a892a", "value": "T1A5534921BA761E27C0D5A4B661F74B25F6F183CA21A8C60B3EB10E9EBF615407543EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677397, "uuid": "09eb06ab-8346-4a11-98d1-889e4dfa918b", "value": "1536:ITSo3cHAeksXMOJGIMD20tQ0QYtwX75FtPB6:+So3cHAekYMOJGbWgqXVrB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677397, "uuid": "29b0b51b-9125-463b-b1c4-b09730fd0c21", "value": 64504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677397, "uuid": "1276392e-afa9-4a00-b766-feddb2b2807f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677397, "uuid": "48ef6ef0-2304-4e7f-900c-15b1739f4e46", "value": "e3aea00824dfd28b756c6b0880ef9e9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8703c731-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708705687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705687, "uuid": "ff86d500-4953-47b7-bbde-5c0410b77043", "comment": "Malware payload (AgentTesla)", "value": "93a3a3cdf6a104f6def256e4ed74163b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705687, "uuid": "5977c076-9bc5-4392-9825-8e43e255bdfe", "comment": "Malware payload (AgentTesla)", "value": "ab88d9f111564a5194b844f512e4f671086c54afa5cea5dfb9ef7e6a25fc0bf8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705687, "uuid": "e5676a77-553e-4a7d-9dba-9cef3eda0fe7", "comment": "Malware payload (AgentTesla)", "value": "8408df6e3e063be9af59a695f43cb7f7ef07f7c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705687, "uuid": "13f24760-5f6c-4dcf-92fd-79fa0cdf6b18", "comment": "Malware payload (AgentTesla)", "value": "cc859859e529da14ca3fdc9212428b0f8b947c5c8dcdf3d122724f70d2baf32dedae6d5f10366e960fa6e84cc2f357db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705687, "uuid": "293ded0a-cbd7-4706-949f-ed8aa59f3282", "value": "T17DD42391133B7DEE9366FFF52B64B80D4B32508AE135D341ED08EF4461E882815EBB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705687, "uuid": "d98d6ece-0960-41b5-af8b-4cd0f7067307", "value": "12288:6+nWlr2PrRvMnqYQ6aiANhB+5HCwDo0yEX9Xs9qX5J+sz7ZvKApO:d79SnANSZJDo0yEX9Ocj+sz7fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705687, "uuid": "0b98a06a-dd63-42df-8f18-e73b251e340b", "value": 616223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705687, "uuid": "c8ac1655-c018-42a3-8d6f-65087c9556d4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705687, "uuid": "3d9bddea-dfde-4ab1-9fe8-86c8a646dd3c", "value": "PAYMENT SLIP.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1831bb4-d278-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708712631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708712631, "uuid": "7bc91163-4ba8-4dc0-83b6-35b87784e1d0", "comment": "Malware payload", "value": "41d4f7ac88fc13d62071f0e91eade952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708712631, "uuid": "a06a1a91-2da3-42b8-b1fd-4ff91d242ed2", "comment": "Malware payload", "value": "ad86a9aa104fbe73a131bc1bf1619eddc5b4a338c3b1667269d2700c9658ae72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708712631, "uuid": "0717a65f-8547-4d56-97c9-2194bd88f83b", "comment": "Malware payload", "value": "aacd3864db89e5c50788678109ad5a2cdebc47e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708712631, "uuid": "4e3a4cca-c0a8-4803-bc4b-33bf92902f11", "comment": "Malware payload", "value": "a91e61b727782826a270b46d8ec5afd8d7be325febba780486025693e387dc54a190bd06bfa33d830f33c8204886c485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708712631, "uuid": "3cca52ca-0943-4776-96b9-1ec8898f5a89", "value": "T1CD938DEC5AF84A36C1AD877CD16354209B359A437303E36D4E82B0EB5D633868653DE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708712631, "uuid": "3d44b408-e1f8-4387-aa0e-2c463dcccd3a", "value": "1536:ZeopEF8Ka2tc32pUGGG2vsOKOlKZ7vHhvIEVITFBoAKUWdjQIYTm2SnZHvozwOnv:ZeopEiKftc32pwKOCZgpFWzTwkZHvQRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708712631, "uuid": "bd56b070-a54e-48f8-a38c-2fac1b9c4a7b", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708712631, "uuid": "4bf025b9-a240-4fd4-a7ee-c4d1b68d1b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708712631, "uuid": "a2ece64d-60cb-4b86-a12b-fc83f800f065", "value": "SecuriteInfo.com.W64.KryptoCibule.A.gen.Eldorado.15028.11808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd07e4e4-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708708838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708838, "uuid": "7fd4749e-9580-4bc1-9017-b156b6d1a0a3", "comment": "Malware payload (Mirai)", "value": "ce77b3a63dfa1ea07994de75e33a73af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708838, "uuid": "ccd371e4-50d5-436a-96c8-103b1fc79171", "comment": "Malware payload (Mirai)", "value": "ae6f2055b4e49634196326929c43570e25ca0ee54de798bbf8281a36990e4f8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708838, "uuid": "af096669-67d3-4cba-a62e-5d3554c88b27", "comment": "Malware payload (Mirai)", "value": "772fe24f2cbe71739cf683d5fe1adfb1aaa13d0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708838, "uuid": "2c043f40-9c3a-4c60-b9af-0d6462d9c84c", "comment": "Malware payload (Mirai)", "value": "04b011d5d7c6d6b9105360907a99768412c39d0ac9beafb45e73fda448f87ae5dc1ca1921442e3733e7af739bf6f8c98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708838, "uuid": "59ac58c2-f226-4979-93a3-641713404030", "value": "T15613D06B84EB9337DB6B02314EE1709B506025269A4498A5CCC4E27B2A5DF209F2D3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708838, "uuid": "1e253055-24ac-4b44-80b3-438fa347117e", "value": "768:oiV2VwFE4AKGo+DD5gVTpEv+jGNUnpHH9VVonbcuyD7UGQRjviWnE9S18E6Y:ovmKXDv+j/pHHRonouy8GyLXD1p1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708838, "uuid": "e320eb53-2b2d-469b-a5b2-b4af7c3bfae7", "value": 41512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708838, "uuid": "b1b5c861-860f-4557-92d7-5c5166b8474f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708838, "uuid": "11b8695a-867a-463b-b758-90e471b00a1a", "value": "ce77b3a63dfa1ea07994de75e33a73af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677e4dbf-d269-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708706064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708706064, "uuid": "30dd1a43-7ef4-488f-9297-76b4ef18d2b2", "comment": "Malware payload (Mirai)", "value": "4c18dee0a2b3b4faac8c1b84edfecef9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708706064, "uuid": "920f6683-c34c-46f6-b1ee-52e730bcb222", "comment": "Malware payload (Mirai)", "value": "ae92f28207836dd65f4a63ca83f242a6ae2e5efe46936c2a6001a7a980abe77e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708706064, "uuid": "f20b9f4b-39b9-4630-ab27-29267b63cacc", "comment": "Malware payload (Mirai)", "value": "c77dddc05fbe278d604b4242e738f7de181fad27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708706064, "uuid": "77f9c7e7-2ef7-4d94-8553-f16a1f36ace3", "comment": "Malware payload (Mirai)", "value": "89212e72ef0bbff904f3c1d7517fb054c23dda99d61912bcf8e79841972b422c0baaaf4fd20c0c55162b2fc48cb3417b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708706064, "uuid": "51f7c61f-2b89-4e5e-a40c-582adaada7f2", "value": "T112F33AC7F801DEBEF80AE33A48130905B130B7D111926B377297797BED3A1991967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708706064, "uuid": "8dd5967e-0002-46f1-89a6-e35674ebd763", "value": "3072:uwk4+Q/q86CmP+PiCMJnE3ySbJI8pyVrjbiqLEQoH8JyWeCsy:9kd6qnEiSa8pwLEQykyWvsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708706064, "uuid": "0fdde880-6d95-48ae-b05e-74bc675a50bd", "value": 162272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708706064, "uuid": "01a1f8be-79ba-49e6-8dbd-a810d39fd9de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708706064, "uuid": "84ad8f53-10b5-4591-aa10-448c40cd6fd2", "value": "4c18dee0a2b3b4faac8c1b84edfecef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b1a69a-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708708817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708817, "uuid": "1f69b932-5663-4725-9a02-fba346beb28b", "comment": "Malware payload (Mirai)", "value": "77e06c1dc294b1672d5eb8aeb7801891", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708817, "uuid": "f46795ba-3642-4597-a08b-04c9044ca6ad", "comment": "Malware payload (Mirai)", "value": "af531ecb7b05fcb5dc2b55fe1bc528c3d122b898bebb09a52091a2ac6bfb425e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708817, "uuid": "ebfd8995-fc8f-4922-821c-361785283c35", "comment": "Malware payload (Mirai)", "value": "5b2c36140d1918f4f69090bd89ea0ab1491dd806", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708817, "uuid": "0c2b8ca5-f4ae-425d-a95e-fe4fde0a029c", "comment": "Malware payload (Mirai)", "value": "fafb14ab1648b642caf4b0b4e5941e69d171ac3fd6dfb74d314ac54aa56fc030480bc97a86e940925656e659a1605fbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708817, "uuid": "40cc4dfd-fbb0-44b1-97b9-90e994649668", "value": "T19B33F2A09B21FA92C4F15434E5F8188FB19EC7F590BF3462124DB9701DEBBBC6984553", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708817, "uuid": "eee650cd-aa4f-489b-b64c-26ea2cd37ed6", "value": "1536:ztIcYSAcImxXv+/EC5456oXiTu/LJXE65oG2GR:skImxXvC54dWULi1GL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708817, "uuid": "bd4302b3-0617-497a-97df-1aeb8f581b58", "value": 50328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708817, "uuid": "a342dfe5-d2af-4179-880a-c3b367deb738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708817, "uuid": "34ec0d05-fa28-4200-8ef7-e9612ab05bbf", "value": "77e06c1dc294b1672d5eb8aeb7801891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7df8122-d278-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708712641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708712641, "uuid": "9a0f0fb4-1280-49b1-bbdd-083485ac6081", "comment": "Malware payload", "value": "452b59d4a22cafa83fe72c108189d8a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708712641, "uuid": "e14c74c7-6324-4cbc-a2cd-056459f34b85", "comment": "Malware payload", "value": "afecca6d8a3f0abc78a682c065ce01e2795b67518223b1d9d345751e1a24f827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708712641, "uuid": "597f5e6f-73f6-484c-aa4b-fb98ea26bdc0", "comment": "Malware payload", "value": "045543c7796781e77acd2f31846c2a5d98aa7511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708712641, "uuid": "963adf59-2622-46a2-a7a4-a433ab34bf0f", "comment": "Malware payload", "value": "e40508182ad471e22cf9a61827ccc73862e5120ee16b7bc2e0006cfa0bd92615ba55145510495c7bf0ad488bb7222305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708712641, "uuid": "58129de8-a6f1-43b6-adec-81814f2729a5", "value": "T157369D15A3E900A5E87BEB34CA65C333DAB17D525735D10F0649F6061F73AA28B2F722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708712641, "uuid": "80243a3d-b42c-4854-89f0-ef0daa821230", "value": "964e987a65332e88976fb9e2fe8f0501", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708712641, "uuid": "3ab6c609-fadc-432e-8325-65620d6e3fdf", "value": "49152:HFO8qbUnfi6s+xjXYQhoy92zAamCaA4wUtG3sQdDpf7pptx1dp9PH7dqgR41b5wz:fDsUoLmyHpf7rJP1oipH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708712641, "uuid": "11dce4de-4907-4f8c-ad9e-3969af3a5cf1", "value": 4879360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708712641, "uuid": "af3fccef-65e5-411a-b2b2-6cbba194ee5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708712641, "uuid": "2c36da18-ffff-45b6-b87e-01eb6b981bd6", "value": "SecuriteInfo.com.Variant.Lazy.481550.28669.21095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72257232-d266-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708704793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704793, "uuid": "7be8d89c-64d6-4cb6-a583-e287bba8381e", "comment": "Malware payload (Mirai)", "value": "f57bcab0493edad1792a14ea41b5de64", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704793, "uuid": "b54bf914-5f99-4da5-a230-8ba529efa7d2", "comment": "Malware payload (Mirai)", "value": "b00a4fa678aab0d67269d9ce505df8384f463aa8c13d3188d1a29930562b7e10", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704793, "uuid": "e67aaae1-169c-4a98-85db-ed23ad8ddee2", "comment": "Malware payload (Mirai)", "value": "205215015299294eb754aa4dbdf3fc714d1b6132", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704793, "uuid": "2acd0429-2084-4ff0-964e-32ceef1c22e8", "comment": "Malware payload (Mirai)", "value": "0e4e49160caf5849c85ace60261361661bdaf43c26a2b10e9bcea007533b5339dc6913112f07bd3ae5168872905a8e02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704793, "uuid": "1328a846-53d9-4ace-968b-1418fc34b786", "value": "T12614D81AAB510FBBDCAFDD3706E90B0139CCA54722A83B363674D528F54A54B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704793, "uuid": "52edc9a5-c376-47bd-a6d3-e2a9816aafca", "value": "3072:CeobGLr4iixyKi/e+60fQnBikx0jAz6/4bPU:CaLdixy1e+6koB1S+6wT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708704793, "uuid": "5c787e50-a94e-49fe-a1bd-cd2720d164a1", "value": 190868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708704793, "uuid": "df085454-6e8f-47bb-a5e2-2130c0e83f48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704793, "uuid": "99dbf2d2-f708-4e86-b563-080574835baa", "value": "huhu.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4f1470-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677755, "uuid": "98e3e79c-6b34-4744-ad0e-e012251db9de", "comment": "Malware payload (Mirai)", "value": "d9e1cad31c5451f7a28b49b4c96b69b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677755, "uuid": "bbe715ef-be19-4861-a44a-ad0ef6fceaba", "comment": "Malware payload (Mirai)", "value": "b03dd558b57f68269d5030fd504d298569291b294a757124e2f6d4d534bc9459", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677755, "uuid": "a0631531-b9dd-4287-b39a-85df761e238e", "comment": "Malware payload (Mirai)", "value": "933ca65d960f4cfdf29c27dbc6b8a8f3796ec023", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677755, "uuid": "5e324bec-6ed5-4a3e-94f4-238e009749f8", "comment": "Malware payload (Mirai)", "value": "a74798a809a209f14b68d34f605e3dfad40def6d4ec52bbeeacfab130ffc6df758283791d3aae9ee0626088f6af48d73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677755, "uuid": "09d00351-0c0e-44a7-9c7f-b2fa57df9dfa", "value": "T1B014981E6E228F7EF268873047B74E25976D23D627E1D684D1ACD1101F6039E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677755, "uuid": "86149c0d-65ef-4f95-b8e5-46b49cc50cda", "value": "3072:14YIKm5x1fjWlwPjLBGhTv29W+VOtS+YvkVfSRZHt:14+ejRBGQHISBkVKRpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677755, "uuid": "1de610c0-11ba-4073-a146-2b2566218f40", "value": 194780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677755, "uuid": "c773c886-8167-4847-a68d-11a6e3b35c88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677755, "uuid": "552fbb5f-4866-414e-b499-6ea4fcf755a7", "value": "d9e1cad31c5451f7a28b49b4c96b69b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943de75a-d247-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708691536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691536, "uuid": "0da79eb5-ac6e-4f16-8596-8dae3396d923", "comment": "Malware payload", "value": "44b0317e02d2493cb70ef460b99009b1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691536, "uuid": "c5928ae6-5dab-499e-8dd8-82263041e187", "comment": "Malware payload", "value": "b181052262b7e502e03644b8acff4342b2b6e2df7cbd59fd2a5920d3324208c2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691536, "uuid": "66547bd5-80cc-4839-aba7-3c4b74d7413e", "comment": "Malware payload", "value": "8d40f24af7425c2cc15af54c1098d8f362eeea47", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691536, "uuid": "ed9dd22e-62fc-4afb-baaf-4a9b62187dbc", "comment": "Malware payload", "value": "93023b82165fc821727d6e1f62a1c5608b74f4745f3e22ded41e33c22aee721dfbb4587d3cee3d3f5341fa5bac9d2a41", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691536, "uuid": "d4fb1968-22ab-46a3-989e-8d1d6056f32e", "value": "T1BDF0825373ED4204E6F3A729D57421A94F6B7E76A678C60C11C00C0D0DE4A854C637B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691536, "uuid": "e6f2e0fe-536f-41d0-a52a-72c7742ff94e", "value": "12:Q2K0+FTyl8lghUIH/l/D9If8fcdHJ/6cBcr01m6cUN:Q2JbW6hUKJef8fcDhcr01HN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708691536, "uuid": "d1924552-88b5-4f03-ac54-4eece26cda53", "value": 550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708691536, "uuid": "9cd7e7d9-fa33-4cd6-9308-742ef01bd62a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691536, "uuid": "0f4e012c-fe6f-4e60-9600-bea0e5b9846d", "value": "Docs.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8123efff-d282-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708716844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716844, "uuid": "5879dc8e-79d2-4fec-9d7c-1bdd8d08d3f8", "comment": "Malware payload", "value": "b01c1bed5023072bfc77eff32b9ef400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716844, "uuid": "94274f1d-1b08-4f40-81eb-e9a38b24824d", "comment": "Malware payload", "value": "b1baf15f339d67b3d1788daaac03095cab9ee52583a8183414f0d5bf55335e2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716844, "uuid": "18ecfa10-542e-4ad5-8aaa-17bd8ae64d3c", "comment": "Malware payload", "value": "d84aee15a00440e609ae0226a939c00c650fe36a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708716844, "uuid": "9900d509-6d6e-43d6-958b-6fe1ebb39d78", "comment": "Malware payload", "value": "2af8d7dd72302d5ddd0370cc2cef27b80257f7a065a58582687cd5c63503c70ef976be29079779dda55d479a87d0e73b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716844, "uuid": "f01c0005-6bd5-454c-a0d9-804dee5228e7", "value": "T1F1A53342F60C6A55F31FF934C4241E657438F702308E6BB7AB5FA108BDCE76A69890D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716844, "uuid": "4dbe67dc-85e1-4a93-be52-aa1755fcf15f", "value": "3c0e70bfa5f73f1f1cef484e2bcb5bf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716844, "uuid": "5ae9f906-4fa6-48da-89f6-21cc87fdca6e", "value": "49152:EVcHqnyx3ki82WqcRd/bjegQMGhRnB47YMbhZw8UmOj7j3:IqqCv6qUd/dQMGhRnoZXUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708716844, "uuid": "d1c2eae2-897a-4455-8834-9558a43bd728", "value": 2257408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708716844, "uuid": "f1db4bce-f863-471a-8ae3-d942d913cb50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708716844, "uuid": "761cabc9-9adb-4d5f-a933-75b09f1964ba", "value": "\u041f\u0421\u041f\u041a-2404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df372310-d220-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708674912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674912, "uuid": "e1136ed5-b702-48fc-a369-ef30564f80d8", "comment": "Malware payload (Mirai)", "value": "1025e6a05b931b472244e5ca1172d51b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674912, "uuid": "a984ceb9-7845-40b9-9709-c2f48a1a8e89", "comment": "Malware payload (Mirai)", "value": "b1cce7c9b9df5271282e05aef98c09ecbef58427e70af71d13f7d3286446ed85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674912, "uuid": "4895e4e4-3487-4c38-810f-d605664ce7db", "comment": "Malware payload (Mirai)", "value": "11574ea9baa2f9e030651d759a4b2bf67b474c31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674912, "uuid": "59374abd-87a2-446a-9c10-1aef3028dbd7", "comment": "Malware payload (Mirai)", "value": "8d746ad75b0a1afae914f66b6693c7f39b20f3882c233e201102042d68bb2619b3b7319835df4f60bdfd42b6865d8ec6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674912, "uuid": "7b42691e-8dfe-46f9-94c2-11c2249cc787", "value": "T126219EA667D36D27CC540277DC9F5714F362AE84859EF513E32216290C3F21A1F2215A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674912, "uuid": "4fb071f0-58d9-4f42-a43a-57625fde2d88", "value": "24:JYolMlgP9qD0at6EoSqG39rUlFSy4JzLCkIdsgHiGIX5dlNfc7:JYolMOFqDPtzrkFSy4JzLoiGIX5dlNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674912, "uuid": "aee4232d-35d6-4395-ae1f-2bb9d1d7493e", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674912, "uuid": "484da0a7-f051-442e-a6b7-e89ad5a53cf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674912, "uuid": "8619b53c-8adf-47aa-829c-88c34078e879", "value": "1025e6a05b931b472244e5ca1172d51b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e6de15-d220-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708674898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674898, "uuid": "e613766b-9a15-454b-9329-fa7a68d20bf1", "comment": "Malware payload (Mirai)", "value": "9ef3b1de7a93ae5015eabf6c14072574", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674898, "uuid": "36312c50-a0e9-4f30-aa0e-e8f6c5a10bde", "comment": "Malware payload (Mirai)", "value": "b3724e084ec4789e8660340a9473d4fd6e9f0461c3fdb69b765ed976e58853e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674898, "uuid": "debae27e-261e-49f6-827a-51e3d7b73cfd", "comment": "Malware payload (Mirai)", "value": "638dee81eb84a44be3a1844fbbda869b72a3e68f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674898, "uuid": "e048f186-29af-448a-8d3d-9b8c2879cdf6", "comment": "Malware payload (Mirai)", "value": "cc31b313350c022614f42e819835bf94dc6945d41668e5427a8b47c92453d1603a2f0075d33e852e741a7c2b666bd012", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674898, "uuid": "4e834b4f-6c6d-419e-a909-4adff4b5a1ec", "value": "T1BA219B96A7D36D17CD480237DDAB5714E322AF84859EF513F31112250C7F32A1F2219A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674898, "uuid": "3e056750-9ce2-436c-9807-b08a5ae319f3", "value": "24:JiAtVsgP9qD0at6EoSqG39rUlFSy4JzLCkIdsx2HwQIQWlNfe:JPtVFFqDPtzrkFSy4JzLiI/lNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674898, "uuid": "fa50b511-bfba-450b-bc98-fd310031a3db", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674898, "uuid": "6f6a1fb3-0c45-48e6-bd69-8429f0d888d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674898, "uuid": "6a482602-c1b3-47b0-9bc3-488db6ec4877", "value": "9ef3b1de7a93ae5015eabf6c14072574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcc1ab0-d239-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708685650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685650, "uuid": "7aaa7309-73d5-4f56-a842-d0b0a1303b26", "comment": "Malware payload", "value": "d33289823e934425b0ff34ef3754693e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685650, "uuid": "cf6ac482-72ae-4191-80a8-6b52e6382ea0", "comment": "Malware payload", "value": "b51792c750df3131798f6f3f52f38a9ea746994786ee2b08b34892136c2e4aed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685650, "uuid": "57093acd-a19d-4bbb-90b8-fe012e1faf4a", "comment": "Malware payload", "value": "a39c6e6d6395620906f12aaf8dfb405afe030075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685650, "uuid": "42d2f65d-1c1a-4fa5-94d7-0d66e809e79b", "comment": "Malware payload", "value": "a5ea09356dcb98b60299c31a289e8baf9d6fda1dfe20f16071ca2dbda7f5f7d3360f4e22e6b1a1b719e954526589b7ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685650, "uuid": "a04396da-7aa8-4ef1-a4e0-ebda780a8f5c", "value": "T1FA53175AB19324BCCB9BC07CC5FBA472E8B175542524FD2E17B4C9B42F30A202BAE755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685650, "uuid": "aab6723d-f105-4a7a-ae89-5d690c284b15", "value": "1536:bPkZR6p4980rJE0PHI2yz5pSPuwYq9Z0xxTUGomru:YbH4tDxxTDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708685650, "uuid": "99c8d0ec-3046-474b-b8e1-448eae3c0742", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708685650, "uuid": "ee74a36a-a8c9-4d08-b88c-f20f701b49c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685650, "uuid": "96d88d16-30a3-4227-b669-44a3ebd43d80", "value": "d33289823e934425b0ff34ef3754693e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57983905-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677691, "uuid": "26eccc56-714a-48d2-a3d6-40ac435b5cb6", "comment": "Malware payload (Mirai)", "value": "e12592a9a354906071ccff782225edef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677691, "uuid": "a7f54905-f642-4718-aa52-7ce83ef286e6", "comment": "Malware payload (Mirai)", "value": "b57b2bf87b27c619a18bec34e79aec79e57a218401bdf9173ac03f8fcca06b50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677691, "uuid": "5e292e1e-cdd9-410a-a550-6952cf66c8e3", "comment": "Malware payload (Mirai)", "value": "d3e51dcbfc9c3620c5d91ede7c811e91d80184c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677691, "uuid": "a7bc8a69-0b53-49e2-ae9f-85334e8297a3", "comment": "Malware payload (Mirai)", "value": "32a571cd77e5de07815209d02180ed47651b1ccbad248a6a69068c5f99385190bd766cdd8e319ac4c082e51bc12db93c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677691, "uuid": "3bdf011b-9083-47a5-a956-56d7e82c64dc", "value": "T152D35B73D8296F68CA54D1B0B0348F796B53968181472FBA29BBC2B48483DCDF545BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677691, "uuid": "a879c93c-c2bd-4a14-927d-3cea8858eb8a", "value": "1536:NaFF9cAS70OCP0naDCemKcdIO7qRrGUuhJm6WLk8YWUkyEibF3:NkC7mPeaDvcNeGUmM6WQ8YfgmF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677691, "uuid": "fdd3dafd-57c4-422c-bd15-7a81dbc117bb", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677691, "uuid": "904301e6-ac6e-42fc-a616-1157be4960d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677691, "uuid": "f40c9b6d-3eb4-4213-8dbe-80f2151459e6", "value": "e12592a9a354906071ccff782225edef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9edb25-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708705296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705296, "uuid": "8957f46a-71eb-491e-95b9-d210f23a8bec", "comment": "Malware payload", "value": "c1cff980776e59d9d34334cf1120872f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705296, "uuid": "e92e9d9f-0a68-4f75-b5bb-6902b183204c", "comment": "Malware payload", "value": "b8b9ee510e755df78bb5f13a433efed736d69b92ff7c161a535b3f650c6f8d15", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705296, "uuid": "2452ca8b-96ca-4d15-ad15-6f03022cfa26", "comment": "Malware payload", "value": "d5d36a2ac15b33a810e6f786ede6adf8ef54ba60", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705296, "uuid": "93c901b0-c045-483f-95dd-d4a732515846", "comment": "Malware payload", "value": "e48eaa43e8a3a68c7fca61c3634364467db4226ba2597c69379a95a316d137a6a00cdd5e50d60a4da18eb701e1300836", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705296, "uuid": "9cc7f2ae-4fab-4f32-9d39-11c3a2b47b31", "value": "T103F61A27374433364B5311926A4E16E9AF3DCC3973619450A86C827C275AC78E3BF7EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705296, "uuid": "c98b94cc-2e2c-40ee-8dbb-cb614bb083b6", "value": "49152:RuXuAeqo/llvrc/eqXNRH4bwmguV+dqwytECIuVHwytCVlLK/mQyY/K/mQyY/K/a:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705296, "uuid": "ab17f208-a3dd-4900-9444-e9443c26cc19", "value": 15483914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705296, "uuid": "7af55b6a-eb57-420d-acae-7c14504d127c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705296, "uuid": "dd7b9bf6-7890-481b-acd7-48865a74a08c", "value": "past invoice(s) 22-2-2024 99684958_751935.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da63f253-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708705827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705827, "uuid": "65b96f02-8abf-456e-9933-28a537f3f209", "comment": "Malware payload (AgentTesla)", "value": "6b934d2c72027f89729ac4f6fea69b4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705827, "uuid": "f552f30c-17df-4268-a1d8-f25ef0d3cc40", "comment": "Malware payload (AgentTesla)", "value": "b8f57ab21e46de7db9ee6c9366251b88b1ba62013154c12bc92c3acbd44058d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705827, "uuid": "7208f875-f71c-4a7f-92cd-b5a4c2eb627e", "comment": "Malware payload (AgentTesla)", "value": "9cd343ee1496300792ccab60879fdf528291302c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705827, "uuid": "1f11eec0-1bba-46a2-91b1-ffd52f1f4f41", "comment": "Malware payload (AgentTesla)", "value": "7bf01f59227a33112f8b04de410ef59cd785befad041fa35c8a3a3e4a32719a44069fa56877b30491a33288fb3e10631", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705827, "uuid": "ac15dd43-5312-47c7-9bde-a4b4d2190d31", "value": "T16225F15976745632DE04CA3854F2AE50C6E7EE6C2BE4D10A20C8B66D1B313FE8F539C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705827, "uuid": "91f0c660-f354-4623-a214-921d6729d401", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705827, "uuid": "b98067fe-8100-468b-98ce-fdc788e5d4b4", "value": "12288:P5Bx4XQ7GpyCv5gIuxM7QCA/QiBf2jlBqd+vZyA5GcXrHvcxFv2wj9L1xN:RBx0IGpyGWzxM41RqLu+wcL0xosL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705827, "uuid": "82f477f4-bbb7-4fc0-9853-66947b045c4d", "value": 1046768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705827, "uuid": "4019f721-b018-4af2-8819-b64dbce3b78e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705827, "uuid": "a6daef0a-65e4-404b-9ff0-f09077fb52e3", "value": "PO OAU_FEBQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ec5964-d260-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708702297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702297, "uuid": "f9008de5-4c2f-4b3c-a752-4e6fdd2aa83d", "comment": "Malware payload (Moobot)", "value": "20287b86e67517cfa03fa3d6426d8bb4", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702297, "uuid": "7d299aff-625d-4afe-96fb-b9f9ffffd9b9", "comment": "Malware payload (Moobot)", "value": "bb286f8e7b3c5ffa65afee2cc52645d25db6fc3a6dd43ee7ebe94d043dfd2d90", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702297, "uuid": "162f9219-7b78-4949-bb75-aa87d54c58d7", "comment": "Malware payload (Moobot)", "value": "34e5c0a73c94a1d81e1c8450ebf7594496c6d08d", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702297, "uuid": "a0eb85e9-6c16-4f23-a289-2526e4ca9728", "comment": "Malware payload (Moobot)", "value": "e9773715132f5097c3675b6bace12581ec2e020bc3377ad17b100f5f4c15e22303846996c73d00b6493b41a9c825f843", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702297, "uuid": "7d395fa6-bdd3-4dc2-ba1d-3425c43e4954", "value": "T17A534B17B58280FDC09AC1744B2BBA3AD93774FD0378B2A677D0EB262CA6D211E1DD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702297, "uuid": "8ea2a8da-6343-4733-9f0b-09043874fb82", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/8YDiwy2NsimfFoktCe3fcxQj:WShU3q7cEDlCK/8YDKHi8Fok06fcxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702297, "uuid": "6c07d01f-4e1c-491b-96a2-b18dae1d7e63", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702297, "uuid": "63604b38-099e-411c-8f4d-aa4d46db26a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702297, "uuid": "23b33e65-68ed-44b4-ada7-1e55a064fddd", "value": "x86_64-20240223-1531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4945248-d20d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708666680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666680, "uuid": "c7af62da-dbe7-49ea-8f03-b4a5fd9a821b", "comment": "Malware payload (Mirai)", "value": "6c11fde63355ebb7087c7e12cb14eae0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666680, "uuid": "083652d7-cfa5-4f01-b2ce-d7af57cabb8c", "comment": "Malware payload (Mirai)", "value": "bb4267dc358c1ab33740a9932026a7fc62fb3871e12cdd94693055e012d824d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666680, "uuid": "21cb917a-c013-45a5-90d1-989f5c5cc3b8", "comment": "Malware payload (Mirai)", "value": "a1d40a9d2a09498a4d0246cf3f84adfc78611938", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666680, "uuid": "30708793-bd18-4be3-822c-5ef9244d1736", "comment": "Malware payload (Mirai)", "value": "c9a53daa878e3cbfc3edc7c1805c3afbcfa1687c42d545b508b15d1f4849014e97377310868095fd35d4ea55f551e80c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666680, "uuid": "dc2df294-e9ea-4867-b2a1-eeb942db47c5", "value": "T16682D03061AB75E8DBE10434FAAECEC6971A0BF8D1FD36D216596B7C894500211FD3CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666680, "uuid": "da50e2ee-5374-4ed6-8e02-87679362dca8", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaOhymdGUop5h5lk:2dV0P6+kom0tVAoNvm+to1Os3Uoznlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666680, "uuid": "69f1c4a6-4c6d-4bad-bdfd-f4e2fbc32cd8", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666680, "uuid": "d7a70b45-dcf0-4a78-9727-9aaa8c0bce78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666680, "uuid": "c6f2e511-e4f0-49a8-8e86-75486e2eb0a3", "value": "6c11fde63355ebb7087c7e12cb14eae0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb53e2ac-d289-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708719949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708719949, "uuid": "d09c76cc-2cf4-49ef-a65a-8f7e5b1ee497", "comment": "Malware payload", "value": "e195699ad0301c995aa5ccb69059759d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708719949, "uuid": "16406dfd-0238-4d6a-8c5b-bca979259f70", "comment": "Malware payload", "value": "bcc10e73f9855f21ec8bfd99adb3539c5064cac6008a37998d16b57310f2bb3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708719949, "uuid": "7cc02aab-1598-41de-a941-93da758f4ac4", "comment": "Malware payload", "value": "c5ef5db5915537100a1ff927bae229bf21aa3c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708719949, "uuid": "f91e3da9-6473-4cff-8677-b4c66f6f9815", "comment": "Malware payload", "value": "3c909ca0ac68c2b8f7c004f611ef0e1539fd1f7412e71f6c0f46b44d483ef12bbb305d1ac8d901d64212c9cbc4f7f623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708719949, "uuid": "38bb6d78-7b0f-46b4-b631-8b4cede16164", "value": "T12CD412D1B352C1E1E079427C4AB7FC046A71BD9342848FBB31DD725A6E938AC24E352B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708719949, "uuid": "e70aaf96-b7de-427f-b3a1-430de2fc9738", "value": "3a74695c5fc62887bbe1fda9c7c0a765", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708719949, "uuid": "f48b0b4f-d659-4e9f-b28d-1c2bb913101b", "value": "12288:zjPwkCbMrOmJPywl0gUoVpG25mHodg+GZCrM6ZjQLvUKQmKAnI5XauPv2df:zEgvdv02bmyg+YCrM6twvUKQmBXQ2df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708719949, "uuid": "3e97cc9c-7b4f-4f7c-94b9-8f72b11d5369", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708719949, "uuid": "f450ad28-e5b6-4067-97b6-048341041bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708719949, "uuid": "1c93502c-9383-4166-bd79-48643b8ac50b", "value": "SecuriteInfo.com.Win64.Evo-gen.13784.17154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3c849f-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708705693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705693, "uuid": "87b1d627-1a5a-428a-930b-d3fdf3786b97", "comment": "Malware payload (AgentTesla)", "value": "fa3267601e7ae603efa62bae7e8e5ab5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705693, "uuid": "32dcc938-899f-4b11-9240-e8632581fa37", "comment": "Malware payload (AgentTesla)", "value": "bd1d2e0fc5a13b960fc305b05497e9c0d6e31137ed831a0d7523cea5cdaa50d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705693, "uuid": "af3692d0-e9ee-4098-8524-cf11e42fc773", "comment": "Malware payload (AgentTesla)", "value": "5d16d6cf76984e6f228aa737ade7a0194e19dcb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705693, "uuid": "1fcec20d-06a5-446c-a366-54ffb6a15357", "comment": "Malware payload (AgentTesla)", "value": "9474b5995fe572bffa07fc43b6f86fdc19ae74d82c63b4138ab9369e25cd832839f1fa4604d5c9e5a8d24d312d50063f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705693, "uuid": "c8658741-1691-476b-9493-384f69d30fa3", "value": "T10A84123F3347D11BC197783A4E8A80DB521ABC411B466A2F74A47B4D0D7BF8247A361B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705693, "uuid": "53399257-5a6c-4086-ac55-a17d3de51513", "value": "6144:PC5zvCp4sJgtouzdDHBMixiMK6G+ZFrTgT1WWnJaFBxe+PREJqE2QxxGl74:PC5bCfgtomdjpozwjT2kWcPc+PEqEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705693, "uuid": "df5f268d-bb94-44f2-b8ea-1b399c841aaa", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705693, "uuid": "1941a27d-ce27-475e-b289-b1ed8600b79c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705693, "uuid": "8f22ee0f-0018-4ee2-86ef-1b4ad864a8a5", "value": "solicitud de cotizacin909#.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b91486-d266-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708704791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704791, "uuid": "5ce3e25e-1bb3-4f3d-a089-5f46b8a82ce2", "comment": "Malware payload (Mirai)", "value": "b72950af26dd04d2b5cfb24d857ec91c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704791, "uuid": "24532114-4b33-4419-8063-aa23153258af", "comment": "Malware payload (Mirai)", "value": "bdd7fc689f6ff280909ca93161a4ab72f9fcaf33976a3a1907f05404eff6674d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704791, "uuid": "66fea4a4-bcda-400b-9991-66d179050240", "comment": "Malware payload (Mirai)", "value": "3278faa3e2bcbe87aa74fdf4541586b1a9dac695", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704791, "uuid": "e6fea2a4-051e-42fd-95ba-46680eaa778e", "comment": "Malware payload (Mirai)", "value": "7a6f8e8308389feab0405d7feb5b4d013911a28fdee4b595f61a950b2d6d048c6f9b6840ea1827cbdecf6d79e9d1c8a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704791, "uuid": "e769c00c-8217-45b1-b230-ec17c62702a7", "value": "T13B142B46EA408B13C4D627B9FADF42453333A75493EB73069528ABB43F8679E4F23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704791, "uuid": "c37bb553-ebd1-4368-9ceb-c19c2d6ea818", "value": "3072:qFUnIwEARpsc52jIiazWTukwMPLIEMB/o830NrcogM/R1p:/nuKscY0iazWTukwESBA83urhgM/R1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708704791, "uuid": "518ddac1-8cad-40f8-a14e-01da6ca42366", "value": 192682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708704791, "uuid": "496b207b-939a-4206-8afd-7b943e9ea2b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704791, "uuid": "58aa620e-9d4a-468e-bd50-20c867a375f2", "value": "huhu.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac365ee3-d25b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708700166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700166, "uuid": "e694ab2f-7c31-4ce4-bb6d-5182ab9d89ca", "comment": "Malware payload (RedLineStealer)", "value": "691ef3891d5c155f2689647f2c441617", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700166, "uuid": "3bdfd564-ea3d-46c3-9741-918323effe31", "comment": "Malware payload (RedLineStealer)", "value": "bfbf60a70d1dbdd452f3b3bc819ce5804b5fc4baa028af084c2e84abaf73bb65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700166, "uuid": "a8fc8f27-f563-41b2-ad4a-fa7cdf23d4b6", "comment": "Malware payload (RedLineStealer)", "value": "03252b08cea28b39026ead3ee95f9d3db3acf3ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708700166, "uuid": "c9c9bc82-93e0-4978-8914-9c3d3c56b395", "comment": "Malware payload (RedLineStealer)", "value": "84a1a197e2ec4610be6b405c3c3c1aaaf77b1d3f4be9863e0ed3cc5754448960706b89583732776794943ef6eb7c869a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700166, "uuid": "cab454e0-ff80-4ace-a9f0-9f60038da97c", "value": "T1361633B295D4E9D2E014D93A8CB2F81513625D04A0B26EC7BCDB2703C5F1B9BB83995F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700166, "uuid": "48159d77-47f7-47b8-aaad-3d5e27b8e773", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700166, "uuid": "8e140a27-65b6-4143-9bb5-45788dc05ba1", "value": "98304:rJwI8rhd38BxuBCgbL5KWnsdZButFXK/IUCccYZPAxFe:GECwgQYspAF6/IjccYGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708700166, "uuid": "1d1783de-3d7a-4db2-9e2f-7f45e354ccf3", "value": 4290560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708700166, "uuid": "b30c31ee-9373-480e-9f4a-548dc4667725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708700166, "uuid": "89f22272-35ce-4b28-8abe-3f6eefbe8966", "value": "691ef3891d5c155f2689647f2c441617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b363e2e-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708705238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705238, "uuid": "c7203a02-7a26-4e08-9131-992877846c43", "comment": "Malware payload (AgentTesla)", "value": "f38485c927c41083769311aef5eac8c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705238, "uuid": "66624ac3-e19d-46a0-baab-207105318212", "comment": "Malware payload (AgentTesla)", "value": "c119837547083f87c3852d0399f2065b733d687a5cb493523463df231351324b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705238, "uuid": "20fb9ebd-9600-483f-8445-f160305d6834", "comment": "Malware payload (AgentTesla)", "value": "d883b17a8a12895729c253a3497eed90dd718db7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705238, "uuid": "97eed75e-723a-4930-851c-433b8a8df5c6", "comment": "Malware payload (AgentTesla)", "value": "59fd0dd9d0efcfaf00c04e1f4d1ef0d25f4c0bf2c1956cfd9853727333a83010c9c983d37842bb1f3a1847ff86c381b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705238, "uuid": "61e75cdb-990c-4513-842b-e70ffdd9e65d", "value": "T15C149C2DD34B02598F620377AB5B1E5141BDBA7EF39552B1306C437933EAC38A2252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705238, "uuid": "eb0506e6-9718-4915-bd9d-847f7794d7cf", "value": "1536:gwAlRkwAlRkwAlRkwAlRi3vsBlwu2aS9kqaH:gwAlawAlawAlawAlI30Blwu2VkqaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705238, "uuid": "f08e09d9-1d85-4bf7-96d4-1dc1d7c2aaac", "value": 205533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705238, "uuid": "301c7c79-7a6c-4caa-920f-36eea705c327", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705238, "uuid": "351364a4-05c1-4ca2-8ef5-355830ef59c7", "value": "hsbcpayment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3d781c-d234-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708683228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683228, "uuid": "d04330c5-6757-4596-9b0a-98995e0cf2bb", "comment": "Malware payload (Moobot)", "value": "83680d723032ba773e6be1f5f8ce3beb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683228, "uuid": "d939d2bd-c3b5-4162-821a-6a21e3d1c760", "comment": "Malware payload (Moobot)", "value": "c1d70983fbdfe65ec68a3813f7f970449b49aefdbc255ebb55e9cbcdd2a9abf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683228, "uuid": "b0eb6237-2b9c-4d59-84b2-5ab4dbb691bc", "comment": "Malware payload (Moobot)", "value": "2ff6bb0a50b3bf3540e5d2c27910d464d4eff5c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683228, "uuid": "2de97f15-5933-462d-a051-abe42e0de553", "comment": "Malware payload (Moobot)", "value": "cdaefe311bf39d81e1b2eefdb20d1ca20e42839c879ca22edf2b4209159746496015cb0ba1d7c09029662a218ac93178", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683228, "uuid": "ac333538-c460-40f5-a04d-44b4c63cb39a", "value": "T181233AD6B800AF7CF98BE7BF80570909F621731551930B2667B7FD836C321A85D66D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683228, "uuid": "0a4ebc13-4be0-48ce-af83-dd9b06ce4f83", "value": "768:NfePldw81eJ3RUF2bEbxQRHdiKLxzyLcuF838zcP8THi5OzypEkDl+JY:tullkRO2bQx2lLlyLVF8381C5OzQEkWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683228, "uuid": "434fab83-a498-4d6a-b0b2-e6a9f0c536dc", "value": 49092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683228, "uuid": "b6e54237-c608-4b74-a628-82e56edf3922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683228, "uuid": "3321d650-8ad9-4337-be63-c1a324cfbfaf", "value": "83680d723032ba773e6be1f5f8ce3beb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48885fe9-d234-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708683249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683249, "uuid": "f43111ee-1bb9-4524-b98b-11997322bb90", "comment": "Malware payload", "value": "f7f8d69e6c1c10224a2a5f2d094484c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683249, "uuid": "13be37cf-ccb2-4bd9-a1d2-992693beb0b9", "comment": "Malware payload", "value": "c1ff3b0ba0b185141ebf0a5fe9d4de0c8e99c61aa6197f1c3623e24fedb3aab9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683249, "uuid": "ea6791a3-b744-4c00-942b-f3b36e8a37f7", "comment": "Malware payload", "value": "8940e081a7ceeb05898cb6f9075bc1409e6287bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683249, "uuid": "c2e7f6fc-3160-4240-8ebf-1815bbc09000", "comment": "Malware payload", "value": "05b7a4495d20837be747939ffad48da1070072e0fe3178567228cc7f41b496c262a2b1c8e6d8ae37cd2d92b930f1dffd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683249, "uuid": "46903a19-7d06-462f-acfc-653d2d145b40", "value": "T116F2E1516049B1B0E1662C3296DCC582E29E5F3ADECB746B078420EEBA468535EF7713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683249, "uuid": "26ef2640-52d9-4906-bb05-68d2d8c014d4", "value": "768:9zxQKKqdDkDBcpUtGFYQM/wbruJGL3UOENoonpXDZOv86:NtYDB/twNbru42pF+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683249, "uuid": "17be3236-fa6f-4120-a234-a93ef8150ff2", "value": 36712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683249, "uuid": "98fb27d5-7430-471d-ace8-da6fc792604b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683249, "uuid": "f109e3bc-1991-4f91-b139-6069da210e18", "value": "f7f8d69e6c1c10224a2a5f2d094484c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc7ea8f-d239-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1708685673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685673, "uuid": "96b66e7d-e388-49c6-9eae-c5376cbdf448", "comment": "Malware payload (Rhadamanthys)", "value": "45d6ca555dad0ece28086d3ed5a93fd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685673, "uuid": "1156dcc8-e2f8-46be-a3b2-d507b1f1542a", "comment": "Malware payload (Rhadamanthys)", "value": "c27c1e00bb778d222efa52a9dbb9335230052cd7eaacf34a8d28b4436aae580c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685673, "uuid": "0205441f-704a-4a65-a744-d431a598c95f", "comment": "Malware payload (Rhadamanthys)", "value": "d6c7646766b4af486954fef3320d9ead1b54b3f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685673, "uuid": "d6152dd8-c22a-4325-ac59-19c791b53065", "comment": "Malware payload (Rhadamanthys)", "value": "ff3fbf9cbe59a1580c593408dc0bdbf7650194a59b47db88b46619f98602cb6d3c27995dcf745d69f1de8749f7c1d35f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685673, "uuid": "2140adfc-ef55-4ac3-9990-080e2382e89d", "value": "T1463523C277E6C1B5E9B502B2DD223FF94A72F9200A284C47E38056504F7B3CAD255B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685673, "uuid": "dfbe70b6-55fc-4d92-9a74-0ead21daeb14", "value": "452aadfa57e66bcd1c5c5143514fe563", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685673, "uuid": "6a61b091-29d8-432f-9f2a-0f2813923ff2", "value": "24576:c8v4ocLsbEDUSlCgpXwo1sfb+X6VFVFrG5bIOf3tja:c8vsHDUaCdGS+X6DSF3tja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708685673, "uuid": "ccef4d66-6f1f-4eef-9e99-eab94b816e3f", "value": 1095094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708685673, "uuid": "da558db6-aaac-48a9-9ea7-692ac1ce3493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685673, "uuid": "f7c76e17-edd9-42b9-a286-d24c06f87782", "value": "45d6ca555dad0ece28086d3ed5a93fd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbbcf9e-d296-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1708725613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708725613, "uuid": "1d2e8c87-f97c-4265-8a30-169c230387e2", "comment": "Malware payload (RedLineStealer)", "value": "1709383fe9901262649ac4785d1d3ad8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708725613, "uuid": "91e89448-d189-4978-aedc-705c28b590a9", "comment": "Malware payload (RedLineStealer)", "value": "c2ec58019152493525ab9962c758fff777c96af2407599751fc5f100874222f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708725613, "uuid": "502aafba-19c3-4977-8a27-1296cba9a1f4", "comment": "Malware payload (RedLineStealer)", "value": "a4ceb95152163a3e614ee8fcf3245961fb0939f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708725613, "uuid": "4274ecee-0a38-4d5b-a11b-d6e76d2217ed", "comment": "Malware payload (RedLineStealer)", "value": "9ca47c44ec99a1fd33564eca8dfceda0a5869d75f2de6a133127a29ffad3f2bb64580e71073b9194446cf87b3a50c7f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708725613, "uuid": "6cb41018-5043-4079-9b4c-75049df6cc7a", "value": "T1C4250201E902923AF8B705F7CAFF687D672CAD51131954DB63CC18AE9B2ADD2793011B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708725613, "uuid": "83965322-b9e2-431d-ac29-ebccb371d305", "value": "2f3a7c5c46373967696674b9a526bbc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708725613, "uuid": "fd982b44-b182-4177-a988-bcd5ef1ad086", "value": "24576:vz28lByb3iF9e7MxGFMCSwynoQzBP7qeceG7r8UAZ:vK8ANFMCQoQ1jqeq5AZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708725613, "uuid": "5a9babe6-440c-4849-a0f4-33326ac8d9b5", "value": 985487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708725613, "uuid": "60e40704-bc76-476a-a799-27927e8721a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708725613, "uuid": "0e5f9cd5-f4ff-49b5-857b-a149be824e38", "value": "1709383fe9901262649ac4785d1d3ad8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981672e0-d22d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708680376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680376, "uuid": "02ed9c1e-0166-4c74-b487-15484c7ae6a0", "comment": "Malware payload (Formbook)", "value": "4d8740caea2a49f020383aa7f800fc6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680376, "uuid": "a9eb4077-58b4-41c4-8060-d5502e34cde1", "comment": "Malware payload (Formbook)", "value": "c365a6886581c5afdc2bba03f6b8dd4af723c570002d359af8cafa1c145e4adb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680376, "uuid": "d6835ca5-3f29-4b59-a729-6f0948e499d5", "comment": "Malware payload (Formbook)", "value": "ecef93ba9a8d025fbbf05396ba9d9f1809d2d47c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708680376, "uuid": "25d24bad-ddfc-44e5-ace2-557e85f878ec", "comment": "Malware payload (Formbook)", "value": "4b4d0e4a375da38cedc48f0a03540f537b1d3a50a6889d2e1c09153ae3ad8768f7a0aed87aeb325cb5ccef57108ee43b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680376, "uuid": "d5e13d10-4441-4c95-9a67-acf804bdfe70", "value": "T16FF4D04DA3204297F1182B75CA6D3E5902301C7C75D2EBE4F9A57B6BEEE1B96183301B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680376, "uuid": "e16dff60-2a6d-4db3-a6b6-d2649650a975", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680376, "uuid": "d0241881-f6dc-48db-a67d-e59bd9e175e5", "value": "12288:ilW3EmzBh35L/+/dE95O0oqtnChRhRLAbmseBcuxkz8FpoxruA6UBH:VBQwjoq0hRPLSNenDUJv6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708680376, "uuid": "7d83ee59-f4e7-45d7-aca3-25d5915b443b", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708680376, "uuid": "f2f24209-e107-465c-893a-9ac8a7616981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708680376, "uuid": "63ad7a52-1f4c-4fa5-9d0d-7b027fb8c202", "value": "SecuriteInfo.com.Win32.MalwareX-gen.17439.11924", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af440790-d260-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708702319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702319, "uuid": "9c02d217-b9fd-4632-8e39-069d463e2eb8", "comment": "Malware payload (Moobot)", "value": "55b31714f4f920b50c2ef7fc91992d9d", "object_relation": "md5", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702319, "uuid": "1456494d-3fd1-4447-9c99-cdb5e793a8d2", "comment": "Malware payload (Moobot)", "value": "c39c7dced3d6a5c19a86f9699eb15f52354d53ce2a0740a66093bc1e93cf5d27", "object_relation": "sha256", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702319, "uuid": "c4ebd1b6-4351-413b-841d-e39688121a04", "comment": "Malware payload (Moobot)", "value": "491b0346be0b5324923b3a3d428e94053978a78f", "object_relation": "sha1", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702319, "uuid": "4ab3ba0c-ee3b-468a-84fa-1a9536957b9a", "comment": "Malware payload (Moobot)", "value": "910937b0ab02cfba3280c157f8bb3a79a99e37070d93ac2787e4d14c3d2a54134ea1f3968d82e7270849ef7e3ceda05d", "object_relation": "sha3-384", "Tag": [ { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702319, "uuid": "a60a3fcc-15bd-49dd-995c-899fbed14eee", "value": "T136632891BC819A13C6D1127BFA6E028D3B2613E8D3DF72179D225F2037C692B0D77A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702319, "uuid": "931a45f2-b1b6-490b-95fe-9f4920a3d0c8", "value": "1536:aNWlx3miiJe1MWaOi/kWlkfIiVL6Kq8GNRuzAvjyx:aNkRHVMCIiVL6vjjjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702319, "uuid": "a8277f4d-ddb4-42aa-ad52-700b809621b9", "value": 67116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702319, "uuid": "070c01f7-04b4-4a3e-bc1e-fbf8656f3949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702319, "uuid": "dee65196-e5f0-4858-806d-977bddca51bd", "value": "arm-20240223-1531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fe819e-d23e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708687645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708687645, "uuid": "e3ba3066-cf2b-4310-8363-d81afc467673", "comment": "Malware payload", "value": "e865383ee46acce14605ba4a660efe2d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708687645, "uuid": "27d6bd9d-821a-4aa3-976e-d8251a3edc64", "comment": "Malware payload", "value": "c6053a9c03ee039402c79b902502fc2617a49de16f5d7c6aea02bbf7a348a3a7", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708687645, "uuid": "e0a38d37-86d4-4c90-a56a-ff1bfcb36581", "comment": "Malware payload", "value": "b658e4d9035756e242db3af8f4e29f855dcb993f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708687645, "uuid": "a86bb5a6-4edd-48d7-9467-af6c3b39cbb3", "comment": "Malware payload", "value": "d52afaa343278762ff22d5ca3ee13e4a1414f925d45d480f02ee530dbb91f5125e64ca650921d4543a9b249cbb824126", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708687645, "uuid": "416c987a-e8b5-4770-851f-e45667d1ac03", "value": "T11D369D21BD8FC036E67F05716A29EE2B943D6DE20B7104EB73E4B96A15748C25332F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708687645, "uuid": "9b001081-7552-429d-a7a7-bd9a3b430cd8", "value": "49152:WUleHBG5q7vK6f4dCItiGS5oW8XlT45HqhpP9gY0dB0lAwvI/odU4BPMPT58fGur:blehf+Wain4BPArk2gBDK3pPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708687645, "uuid": "f6436776-3f2a-4a9d-a550-a19c3190e4d8", "value": 5295104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708687645, "uuid": "0c3711b9-bbce-47fc-bb40-bf8c61d8a76e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708687645, "uuid": "9a718ec8-70a6-48f8-a5f1-4d0d000d74c2", "value": "SecuriteInfo.com.Heur.30198.9129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179f98d0-d235-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708683596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683596, "uuid": "4d303285-97d0-4fa9-8d0a-404fbab3027d", "comment": "Malware payload (Moobot)", "value": "6a71b4b603c07c84b03efc88dca80dde", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683596, "uuid": "8a0b7475-aede-41e2-b592-bffc4e8215a3", "comment": "Malware payload (Moobot)", "value": "c758915d2a13b51f9abef767cf6f080eaa8cc3e0cbcfb5ce83a7d7deee1fc46c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683596, "uuid": "441b299f-3fd1-4abb-a581-05c91401c2e7", "comment": "Malware payload (Moobot)", "value": "f916c52280d0355098b7bb06339964697592d55a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683596, "uuid": "242655ed-3dcb-40e7-a677-941f88078497", "comment": "Malware payload (Moobot)", "value": "1cb8dc1745bcc20154c8716f0cffb8ff7e79c5936743b2565648713936f94d8a8edc13481ad9e3c8864309c421a32394", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683596, "uuid": "6e513eaa-caf4-4a6e-8924-2f8489cb4397", "value": "T1FC237C73D06DADD8C20806B4A6358F381763B50087672EF65E8ACAA28447EFCF5193F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683596, "uuid": "86f808d2-d068-4902-b037-91b79a3a7e4f", "value": "768:NFANhCjZTMygsUQMMVj/x3c0qb5eFmC5oP4uCgG:NFANhyMyb1x3c0qVe4VQuCgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683596, "uuid": "478ba4ba-524b-4dc7-9562-44ce58dde386", "value": 46776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683596, "uuid": "a1245269-d576-4a83-8409-1345c3f41eff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683596, "uuid": "d305ef55-0f5d-4768-a5d7-42b516a4a5e3", "value": "6a71b4b603c07c84b03efc88dca80dde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc68c19b-d20c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708666263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666263, "uuid": "5f67a450-f96a-4605-8724-4bb8d212710e", "comment": "Malware payload (Mirai)", "value": "3052f1f873137df966912b3f309dc9e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666263, "uuid": "ad88c8b9-05c2-432b-81af-5aa0e8dc5726", "comment": "Malware payload (Mirai)", "value": "c7b10865c23a5045248f6a143f07680b2db9b8291d211ca14ef38117e4de0c53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666263, "uuid": "014f349d-e1f1-479e-a979-f2e6a6848187", "comment": "Malware payload (Mirai)", "value": "e4c5a77a03d76ae88b1f27c4e3ad8557d04e3c1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666263, "uuid": "bdd3560e-fd85-45fa-8b7b-1eb2367242c2", "comment": "Malware payload (Mirai)", "value": "c31bbd8ba75bffea20cdfe2e351f9398d87234cc35ef1d632d181a387f6f48ffc1dd5240c5027d37fa987bab0adcd3ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666263, "uuid": "73b77928-5da5-4b63-b47a-2e06ea8cf775", "value": "T13C432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666263, "uuid": "fef6dbd2-4634-4ea7-9d1a-f0aec2b5e981", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw0:RqtmZPuutfbltZFBSJsBcfDSTFI+BE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666263, "uuid": "01ea072f-5b5e-426d-a976-78b3f53c7776", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666263, "uuid": "f2806445-4a5f-44fa-8dcc-395e2cb6a7df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666263, "uuid": "4e324fee-e1b0-49ee-92f6-5c6025cc1c5c", "value": "3052f1f873137df966912b3f309dc9e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd847e89-d20d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708666721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666721, "uuid": "d069fd0a-910d-45f5-93b0-c2f5f88271fe", "comment": "Malware payload (Gafgyt)", "value": "53a5e225c4d1471218b2b5e380ae399f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666721, "uuid": "ec33bfd1-f2bf-4bf0-8cec-761ebb1eac02", "comment": "Malware payload (Gafgyt)", "value": "c8d6ab561a301b94e249c42b8c2a957388c8e142f10938f9affb754dec731913", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666721, "uuid": "8ecf3e08-5ab3-4878-9178-66a7ab5b36b1", "comment": "Malware payload (Gafgyt)", "value": "c3d2c7d9c273825de3ecd2613a5b47e92b598b04", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666721, "uuid": "d2b512e4-3a6e-4f6e-951c-e4a3179dad3d", "comment": "Malware payload (Gafgyt)", "value": "451ec8fa9fa8162c467ca843f1d87e600f4a4048c05d4c06410e0bb34efa7b31c74310d56b6b9f4fe1ca51faf411f77a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666721, "uuid": "0cefc4f1-8b91-437f-ade4-e2ee5fbcc53d", "value": "T141A32903DA60847EC48B93761BDFC6225623F8B90731621B63C4BEA92F169D9DE5D343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666721, "uuid": "30ce8b9f-12b0-4a47-8893-b5c4a52f790a", "value": "1536:QtfT9WiC3txvWtfEo5vXJM9wypej++3hSEgL7nLGPTms5TDUMHYr/:QtjC9wtsOnuejjhSEgL7smITDfHYr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666721, "uuid": "7adb1307-9bf1-497f-bbcc-4e38121c627c", "value": 101269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666721, "uuid": "4c4d1294-5635-40f4-bdd4-156821496c74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666721, "uuid": "41b59001-7bf4-4c3e-b4f4-50ca981d0ca8", "value": "53a5e225c4d1471218b2b5e380ae399f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cdedb9-d269-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708706056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708706056, "uuid": "17c5b1eb-0d0d-4d9b-affb-41613526d1d2", "comment": "Malware payload (Gafgyt)", "value": "ca9597c70acf1ecf46506306d2f55742", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708706056, "uuid": "8b39c708-c910-437e-b402-5bf9d56f8cc5", "comment": "Malware payload (Gafgyt)", "value": "ca5b57abae2cecd876a4ef096dcb800d96f01f97255b012755096314f2be33d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708706056, "uuid": "688ab076-b72a-4e57-b756-b119d9497ad7", "comment": "Malware payload (Gafgyt)", "value": "24a8f292755c35f410fd71e849c8f5bc0e9720bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708706056, "uuid": "e676ac6e-b5c4-4991-81b6-359a4a54523e", "comment": "Malware payload (Gafgyt)", "value": "5185be10b7140c8e7a37a61048fc6c846ea15357b9bb09c93399b46390d46f9e9193b449f69c45c51397e4fd627b8637", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708706056, "uuid": "7e3e6e12-a789-41ef-bb7f-34281e2a79b6", "value": "T1C6E33B06B31C0A47D1632EF43A3F6BD093EF9AC121E4F640255FAA8A91B1D375586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708706056, "uuid": "7c448f5a-fc8b-40c9-afae-bcef0aa3321d", "value": "1536:7gOsKpQZvK4JWp4Gaxp6vjRX0IcTs1MX4QaruBvA0WDkmKSnkqDR54fuhNr2J05:7+BGax8r1eXKrh0nfu/r2S5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708706056, "uuid": "9def99e3-821f-4d3b-bbe1-dd9d78be579b", "value": 146396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708706056, "uuid": "02bea539-1dea-4a65-957e-fc1822778881", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708706056, "uuid": "ae9993d1-a9d1-4897-b073-201ddddadf24", "value": "ca9597c70acf1ecf46506306d2f55742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaea6355-d259-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708699413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708699413, "uuid": "cee285ca-3728-4634-a8df-e99f6ca5e6de", "comment": "Malware payload (AgentTesla)", "value": "b9d9839c976cd61a16715b47b9b4b622", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708699413, "uuid": "8c780113-27f1-4a8e-b2c7-6f53e6d788f6", "comment": "Malware payload (AgentTesla)", "value": "cd0dcabf50a922dbd975a8eceede3627e6873c9a8d8a5260fb6ea576872656c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708699413, "uuid": "f660661c-e47d-4808-89dd-cc783a5353ba", "comment": "Malware payload (AgentTesla)", "value": "f2beeca9140445d7a5d99c328ac31f622f499036", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708699413, "uuid": "4e8cf983-de52-4024-a900-30ace8256120", "comment": "Malware payload (AgentTesla)", "value": "8873fbbc66fe848b174c58a68b887279673284dbe1b1e1e4921233893f468066dfaaef381027650b4ed80129ae621ee0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708699413, "uuid": "770de16c-13d6-4ba8-b936-dc5c3d642616", "value": "T10CE433ECFC8F06AAB27E4311DD6951590C7468735C6B5A0040AE98E2DFDC81B4DE9EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708699413, "uuid": "91d92d43-5fa2-4b5a-92c8-1a1f0f81a323", "value": "12288:yHlCcsjTZLysClUMYW0ixtjqklQejHEgBeh2cFa/1gjFN/Ql6b:yHlFyVLuAWTxd/lQiHjBeh5Fa/1G4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708699413, "uuid": "6756f3e7-f007-45bb-b918-d12e1750e4b4", "value": 690567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708699413, "uuid": "7f48ebd8-1e47-475e-9fdc-c1992115a4c7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708699413, "uuid": "993071e4-bac5-418f-a609-b5cc72da65f2", "value": "nScaned_Doc.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64eb187b-d25e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (STRRAT)", "timestamp": 1708701335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708701335, "uuid": "d848ef15-7c82-4fd1-9d71-07c3dadb1b53", "comment": "Malware payload (STRRAT)", "value": "1f1f27ded1ea733d6be70e13bb1ecd60", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708701335, "uuid": "e13a1c2a-f323-48fa-8396-b8a23a0c1714", "comment": "Malware payload (STRRAT)", "value": "cd95317ffcd0cf91eb2ce9fa6a0d062a9a1dab9fd278654b85172445873e5fcb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708701335, "uuid": "5074746c-c1c2-4cbe-87d0-1ef685152732", "comment": "Malware payload (STRRAT)", "value": "d03405a17b31e3f58ab90d4cb1ee08f9ba0cf131", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708701335, "uuid": "fa5f4c08-aed5-45cd-9f35-dc3d4e293032", "comment": "Malware payload (STRRAT)", "value": "acc174191defce0d7e77174555a0c320bd2ab6ebf91ce090f68b71f4adf3e4318f9995e61a39058bd91d4b1ffb052b98", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708701335, "uuid": "e4ef6edb-b4a0-4b6e-9642-3dd5a9293fee", "value": "T19424026A3DEFD1B8D407C5721404D17A991DB208D268D61F22FC09CA8D30C2A9F97ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708701335, "uuid": "9b59640b-2fc6-4461-b3e6-0bbd68a8da9d", "value": "3072:jVhrFK2o50lj/H9OtNodDZawwcSHpHA1QNPmnztEHb7yR7MBprhF19AyGZV4etuc:jp7jx1fwcCg1QNPmzmKdMBnF/c42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708701335, "uuid": "a50db5b6-8abb-4b7e-a496-3392daf495c2", "value": 214503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708701335, "uuid": "487a4535-5816-4b53-a1eb-2b9e9b37eeb8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708701335, "uuid": "f67d8d23-41d3-4fad-ade7-340ab88ad729", "value": "invoice58499.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3fbb10-d299-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708726819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708726819, "uuid": "36ffd1f8-4d22-4816-bcbf-220319f0235f", "comment": "Malware payload", "value": "05be60e7ce39bc0e331cec16e4970e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708726819, "uuid": "92264c8b-f88b-48b1-ab9a-b0cf01bcd02b", "comment": "Malware payload", "value": "cec45912a7ddaa7db4f047c89ec0811e7c339a608f479e7312b104a10e215eec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708726819, "uuid": "122a9f9c-98a4-4379-919a-9cfdf11aff29", "comment": "Malware payload", "value": "382993505b233cf0d6d3a0cf49e2a6ad284ccec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708726819, "uuid": "d2f3796b-eb44-4205-afcf-adc2d3cf3383", "comment": "Malware payload", "value": "d21875815efb1126ba64adb5cc34042610d5b40fbb8553fe3c822085ba9fe2ca581d99ccceedfb5883fef9269973c81e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708726819, "uuid": "64718ac8-1513-4b4e-b402-74f9f27db20b", "value": "T14CB5CF22B40190B2EDA100B1DABDAB79587CBC3107A904D7E3D83D6E5B345D27B3A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708726819, "uuid": "ecdad753-f6df-42e3-91bc-0ccc9acb23a0", "value": "7c097090fb6d89eb735e5178b71d08fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708726819, "uuid": "3e94fbf4-7fcc-4688-b638-ff6a70b6c7f7", "value": "49152:Y/r6ZXd+Am+utgT1KDQTY5U2debvXgYpRa+qRK0NSVn1J5Ew:C6VEV+2m1A5U2q/XpRqRKFn1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708726819, "uuid": "81f0e984-737a-4d54-9185-45da69870c09", "value": 2380160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708726819, "uuid": "e59770bf-16fc-446d-bf3f-112fe0d57128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708726819, "uuid": "20aee1a1-6e13-4243-b2cd-e7bef12c6618", "value": "SecuriteInfo.com.Program.Freemake.251.5843.2460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c429cd41-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708708796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708796, "uuid": "5e156419-d176-4d4b-af4a-7cf083607cc2", "comment": "Malware payload (AgentTesla)", "value": "9dbe2af5998908187b79afebf4753634", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708796, "uuid": "9a34f864-214b-4a70-a757-908b8556ac21", "comment": "Malware payload (AgentTesla)", "value": "d023fb1b834e04895084d602077082766b04a7d2798fb6ce912c844d108ab4bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708796, "uuid": "4395f444-97d1-4bfd-9149-767264de4d39", "comment": "Malware payload (AgentTesla)", "value": "e4fd2fd4d0c20b80dee8342b88e6e140d1f0137d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708796, "uuid": "c8c50a15-45c0-4436-81af-bb5e1a2342c4", "comment": "Malware payload (AgentTesla)", "value": "d2cb78e712ca07f77874e03bb4c7a638ddce3be14048ae8b90e9c8ba7d241cd2d8e1c38744379b9d3771c6765c6a8238", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708796, "uuid": "fe6cc3b3-c292-4c9c-aff3-f4f482615420", "value": "T1A405C036ABF85E27D1DE837B59E3490FEFB1E026560BE79A08C0D6A51E43B614E001D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708796, "uuid": "f2014919-6722-4391-8c18-7d97abd3fa7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708796, "uuid": "9cefa90a-606c-45ce-89b4-cec3327a6474", "value": "12288:zsoyQ4yiK45iAkLU+czq+hFRBYaOYOWfJfgQKZe0M43IAK7Yng12qrGGl:4yiKAhjzb3R+vYLfhgQKzFIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708796, "uuid": "b448792d-0cad-46da-a871-0377c8c21836", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708796, "uuid": "eb834e18-e77b-40e8-921c-c88fd21e863e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708796, "uuid": "13b686e5-c793-4dbc-8094-3fdd4eb4bbbf", "value": "9dbe2af5998908187b79afebf4753634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdf8a2b-d20d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708666672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666672, "uuid": "ca42b422-c47e-47c7-8c9e-7b7d5905de98", "comment": "Malware payload (Gafgyt)", "value": "8c02298340c42eba0ef0d9311475b7b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666672, "uuid": "a066a340-3c3a-4cb5-b272-5b94ac3d300d", "comment": "Malware payload (Gafgyt)", "value": "d12efa50a9e148f5b43b6b6b7c002842158bfa9ac3d05202c217296fc4f0676c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666672, "uuid": "1a82f241-fee3-47e6-8639-a1b16c480de3", "comment": "Malware payload (Gafgyt)", "value": "b55db2550865d571e328f4cc571bcd66b9d813e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666672, "uuid": "3b0fb4aa-6a78-4b20-b88d-109f749af5da", "comment": "Malware payload (Gafgyt)", "value": "b4b2a25b751f6de771c8a69bcf66158697b49ffd43e65ba521a9f9f5e31376e44f2694ee60ab8b40c5846168e0b26d0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666672, "uuid": "d9c79c0d-103e-41dc-bd27-46df90f1745d", "value": "T182D3C62E7A61ABFEE169963107F35F7083A625D227A09345F26CDB181F3128D5C8F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666672, "uuid": "dad57232-512b-429b-9371-cc01bb2a3d68", "value": "1536:DHfGlkuMau3GanIg2rK/c6U1J8iEHLfPti2dSImNEz7ugf7hoWlNDsFrj4hs29NA:Kx+/PtiJn8ugN9sVXoVmCBgAYiCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666672, "uuid": "53065790-ae96-4c7c-9ebf-df4329bbe8dc", "value": 140059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666672, "uuid": "23af9555-b59d-49ec-bc36-c678098112bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666672, "uuid": "bf6730f3-93e7-459d-9c83-e8f37a195d51", "value": "8c02298340c42eba0ef0d9311475b7b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cad236-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1708708791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708791, "uuid": "879acf93-0d1d-4594-ba90-212be709b8be", "comment": "Malware payload (RemcosRAT)", "value": "67ae0c382e324c4fcdadf64310cfd401", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708791, "uuid": "e980af22-a9c9-4533-8913-dcdd2665fe08", "comment": "Malware payload (RemcosRAT)", "value": "d2d607fcbf9e801aa1f69b9eb2116c10431c66eccf55cccdd343268e1f511a11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708791, "uuid": "55264ba1-8732-4027-8e76-a51066f0085a", "comment": "Malware payload (RemcosRAT)", "value": "81c52daa009906c68ca31c1af7c9f1c4d9edca7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708791, "uuid": "62d5f89b-6ae0-42e5-b725-2014c157b8dc", "comment": "Malware payload (RemcosRAT)", "value": "1555027167c186c80dc0354fb20a81d2caa9c53d50bf3639298628af5b4ecd069783dee492feebd6a4cf0f81c2069265", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708791, "uuid": "3acab0ee-646b-450f-9ef2-4d56c122ecfa", "value": "T11385C0A2B1D0912AD133DBF51B5699E4373F7D312D18678EE2E63B890A34AD064E3533", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708791, "uuid": "7dd3c9cd-5cf2-4dcf-a2bb-53b223d0c123", "value": "e36cdb81e59d5a4701e323e960f1f7b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708791, "uuid": "a161bfa0-af7e-458d-a762-6df9d4f00a8f", "value": "49152:2uLqn8Y6FlWZ0vH/k3mlXoQq7TuN5zdi8ewnXZCz:2uZp/k3mlXoQq+N5zTXZCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708791, "uuid": "998e7650-e876-40db-b990-cb6f81d6bd36", "value": 1800192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708791, "uuid": "c5d07858-dbbc-4293-9eec-6195436b583b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708791, "uuid": "db353631-a1b3-4bc1-a114-91d9fbfe2742", "value": "67ae0c382e324c4fcdadf64310cfd401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596aa075-d231-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708681989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708681989, "uuid": "cfb0b8c8-d763-40af-b864-3d11ea78cb58", "comment": "Malware payload (Formbook)", "value": "94ac55ec5b62f454de48a911f77d23c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708681989, "uuid": "c136b1a4-0fc3-4ddb-9b14-1b9f63a7cfa8", "comment": "Malware payload (Formbook)", "value": "d3a9f4917640c82521a6d6de9e220ed18844cc92e7129d6a984078eee2a5ab3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708681989, "uuid": "05c157f8-84a3-46d1-9eff-e855417be1ba", "comment": "Malware payload (Formbook)", "value": "a7d6e5ed7b9ef7527eef020b40b1ee5e27d72ef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708681989, "uuid": "c5de91ea-8b59-4798-84a5-9517e3fea35d", "comment": "Malware payload (Formbook)", "value": "c799b19c4cf67777e92091c2538810d4de43ee0bb976db48b9858b6f67b9083b6be3f53738f355586cdf041cafb64843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708681989, "uuid": "4420b7d1-0bc7-499f-a948-3383855662a2", "value": "T1A2E42211B7749B13DAF9CFB400A415500BB2668B789AFACC5DC636EF56C3F40AA42B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708681989, "uuid": "d1c4e948-b22a-45e8-82d9-b6167eca6142", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708681989, "uuid": "4a343b4d-a14b-431e-8bf7-642c58ad0872", "value": "12288:elW3GmzBh35pYdQiMpP9r/FAfGjy+cI7q3Qr7B7sXS3Bol2sygNsINDkR:XBEyLP9GfGjy+77q3qkS3qHGI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708681989, "uuid": "d8e55bff-62a7-4674-9c90-b0f93a86cc54", "value": 679432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708681989, "uuid": "c33f6035-1405-43a4-9a40-7aafa9c7f1c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708681989, "uuid": "632a7a21-ffb0-4574-9de8-96cefffc5064", "value": "QWde8zzNzJMr5UM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54ff734-d254-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1708697282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708697282, "uuid": "6b1337ac-7b1b-4061-9302-7cc1a50cb567", "comment": "Malware payload (RemcosRAT)", "value": "91293ca562a8b693184085f540705121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708697282, "uuid": "3c69bf93-0722-4cc8-ab2a-f165b5192571", "comment": "Malware payload (RemcosRAT)", "value": "d7268a17700192bdea52b4f9706fecbab93392a6f65bbd1210e6fbb679fb0959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708697282, "uuid": "1f2ad0a7-1b9f-4ec6-82a2-2c151102c38a", "comment": "Malware payload (RemcosRAT)", "value": "66afd533c8bb1b2d3bcb703915e64e8e4a2cc1ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708697282, "uuid": "31749dbd-5baf-4d6c-84cc-e19a6676457f", "comment": "Malware payload (RemcosRAT)", "value": "dff6575beea94f02b359bc068f2d28ecc22baea76c4b6d09706c7ae27e407b2f28c9601d449d077926a2826dee89a712", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708697282, "uuid": "182c57b0-bf90-48ad-8c5b-dc378651683c", "value": "T1E3758B09225C4392FE77E57F0A51A65E1A785D2100D2AE2FCE553E28A93F3E1153F2B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708697282, "uuid": "63de2d50-21b4-4089-8a7e-3c6033db5c60", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708697282, "uuid": "b7adef59-8979-4f70-a076-0b36661bf6fe", "value": "24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8aD5hMBpLEtHHbB0GUbeeU0gfy8y1:sTvC/MTQYxsWR7aDvMBpLEtH7areO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708697282, "uuid": "856578ff-b2b2-4777-b696-18caa888e94a", "value": 1587200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708697282, "uuid": "a1011193-d973-4191-81ed-401794c4a127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708697282, "uuid": "402bbc03-3144-419c-8dee-4657bc042f7e", "value": "Quotation Drawing Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343618af-d29d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1708728312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708728312, "uuid": "7fd3379f-b6ee-488a-a845-42dcf0cf885a", "comment": "Malware payload (DCRat)", "value": "073fd0a4f0ea10bb112b28fc66f7a33f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708728312, "uuid": "8dac9bb8-5e88-472e-b2c1-19173b1a77e1", "comment": "Malware payload (DCRat)", "value": "d7294c779792236b7f5a076ffb38ffa67b75a763e5c396db424b8b7d880ee5f7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708728312, "uuid": "75f9bebc-dca0-490d-ac8d-282d705a50c9", "comment": "Malware payload (DCRat)", "value": "3d74791f88b1f1a7f4f1ec1b00d7ddd9fa57412e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708728312, "uuid": "0e8faf81-dcaa-465d-aaa3-50aac18553d9", "comment": "Malware payload (DCRat)", "value": "f19252d633203c7a9e93591de7ae14209ee8783019d4bd0be7adb6865d3c1374c603affad34aa1ffdb30ee7942d20911", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708728312, "uuid": "2074d58c-4f71-4c3f-9041-e0311c51b7c2", "value": "T152A5CF0666618E37D2AD3F72C4DB012E42A4E7277952EF1B765F21D6790A2388B071F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708728312, "uuid": "907878a9-2408-4cef-af7a-a242028fdf0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708728312, "uuid": "989f661e-0b5a-40a5-b250-92927a497595", "value": "24576:YSLwjgYHBqNvdj9jlrDbed0xV2dVI3Gz/zEZ159Qg7qkxX1j8GTd6omNnQVO7muf:N1bRzed0WdVfc5oytZ+ngj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708728312, "uuid": "90f7bcb0-1d44-4816-8194-6d533ccc3e07", "value": 2121728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708728312, "uuid": "a2a79529-3422-4e91-88c3-7cf4a29d9940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708728312, "uuid": "08570a9a-ce4c-49b3-a86c-b06ebcd4b240", "value": "073fd0a4f0ea10bb112b28fc66f7a33f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e15772a-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708677675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677675, "uuid": "292fa904-a0b5-46c6-b131-2e41c65ba062", "comment": "Malware payload", "value": "5573f819f0dea7a0c2e114dc2ff8c158", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677675, "uuid": "6e6373c9-011a-4076-a02b-3d5e0df867f9", "comment": "Malware payload", "value": "d7655a4d87535aa8d86551eb1fec2d3902e80d5500c23063ae4e0d965f17aa22", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677675, "uuid": "d34d9b3f-33eb-4b57-8028-597cd3508abe", "comment": "Malware payload", "value": "59ddf82effca8abef5c7127b88faf52634a1d8e5", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677675, "uuid": "954f53c6-b667-4a50-bd05-009ccfb533f1", "comment": "Malware payload", "value": "de80613a4cc75081785d410ed495cd87e36119c5e075ff3721b240a5e3797c2315317bfd95c1140623a7275bd62cc50d", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677675, "uuid": "9c7221af-875a-4263-8dd8-0ed42338fd53", "value": "T19D51A42DE646D6CB13731BACA8C9D349FB1D819D9116E510242889CBD08CA7633F8B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677675, "uuid": "ed2d3c1c-d2d3-4886-8689-07bcffa9adcb", "value": "48:LYFcfZDCXX/ZJI8TvjpCV9D/YhmELhXvQgEA3hwUUuW2tPBJ6i4Amdg29BY5vA1/:Ly7XXI8TvjO9D/YBhX4gEA3PJrtJJ6iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677675, "uuid": "8835a313-712e-444b-903c-89b969f20654", "value": 2633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677675, "uuid": "869d2f39-55cc-42f2-9649-ef89f66ca034", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677675, "uuid": "7f52cdd2-172b-44b7-8866-cf246c752042", "value": "converter.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d93d59-d234-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708683217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683217, "uuid": "7aeffed3-5649-4523-9153-cb276eb4a649", "comment": "Malware payload (Mirai)", "value": "3c24a7b77bc414557ede16b5eb7d1987", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683217, "uuid": "7a006f60-55dd-4afb-8ecd-ab18d0897717", "comment": "Malware payload (Mirai)", "value": "d7db620e7b6f8b4a7a594adab25db9208f193e4f7bdab424322db604d9ac01a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683217, "uuid": "bbffd97b-0637-48ca-b10d-802001c21f39", "comment": "Malware payload (Mirai)", "value": "6e97933d013ea962c00164a55361cf4ff007bb8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683217, "uuid": "1408b728-b107-4c66-9f7a-e20b719c23c8", "comment": "Malware payload (Mirai)", "value": "6fbc64fcd3c86a07c2287c31e3de3b538278888e084261698de741a9672bc8724c447248b75f886a644cb67e5cb60f02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683217, "uuid": "6b5ac841-b32f-4a8a-b73c-596ebe7853b0", "value": "T152332881BCC18A16C9D413BBFA2E418D372663A8E1DF32079D216F117BDA82F0D7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683217, "uuid": "bc05e4fb-c161-449d-8058-49ef1db604fa", "value": "768:r6fsJDUlBf5odAiUapEv3TsIbOkdnoJ+cOezgNveC1wbfKKNOFp4oL+:ss16N5kUayv3TsIbxdJFetYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683217, "uuid": "29f6d4a5-dddd-4d80-bdf7-2c9cd78534ed", "value": 50876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683217, "uuid": "9b49f444-cbc3-485e-bc67-1c1be188f419", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683217, "uuid": "2a3a52e2-0563-4286-9df8-f6f3656f9dd6", "value": "3c24a7b77bc414557ede16b5eb7d1987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31cfcf4-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708705815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705815, "uuid": "0f77abf1-f33d-472f-8dc7-8901006898d9", "comment": "Malware payload (Formbook)", "value": "00ac51b7c853cebd3d5b3536a9609245", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705815, "uuid": "6d398388-1908-484f-8238-a8f51eb9b0d1", "comment": "Malware payload (Formbook)", "value": "dab7f2d2eb0ed32fd0e2df22053436a579028d8ef80e56a66900bf93ac655f19", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705815, "uuid": "c76a1d14-c904-4b0a-9481-112df6974e65", "comment": "Malware payload (Formbook)", "value": "a152ac9f8664471dacb3aed902dcbaac82fb69d4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705815, "uuid": "af1df3d5-a7c2-4304-8f16-6af67c8385be", "comment": "Malware payload (Formbook)", "value": "90f7bc35a7e3ede7695103f2549db2138e475778a08cbbb8d1cdd9a71fcbe26c178a948c515d51ae4499af1bba533cd1", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705815, "uuid": "432fe1ac-b480-4158-963e-7f2e00525aff", "value": "T19CE4235073E5C76BEABE2BF66D2062000376B06A5A38F74C0E81B5DB5297F170E71927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705815, "uuid": "e8e21fac-0f2a-4543-b851-482bb0eaab58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705815, "uuid": "3878d600-11a6-4b2a-8021-0090e9c4e4d5", "value": "12288:2ws/KP5Ujd53LlvlGw13/5R1XRwT/Nt+MTxVIGnom5SxDPpKpcWuoqMX/qqMrF9w:vBKOwR/L1XRwL3+MPIGn55SJPpRoqy/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705815, "uuid": "efb2225f-8fed-4e58-8eb6-91ea066c8c04", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705815, "uuid": "95cc121b-ed04-4c83-85e8-e211d807f211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705815, "uuid": "020d61d9-3f36-49e3-84fd-5fddb62edcf2", "value": "DHL_AWB#6078538091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7851908b-d266-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708704804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704804, "uuid": "5917915f-f93b-48f7-a351-51aebbd0c49b", "comment": "Malware payload (Mirai)", "value": "56542595ab9d9bea81e0b026d5350608", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704804, "uuid": "7c9635a4-9c7a-40a2-ab3f-87988adf5f7e", "comment": "Malware payload (Mirai)", "value": "db06a3f2bc5bf0e9370bfc37ee9785018670fb9502561edbf4a018beab57d0ba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704804, "uuid": "70ccc8b9-ec6a-420d-ac89-86e2c29a9b10", "comment": "Malware payload (Mirai)", "value": "fbc3c692b742de515f622974d96dc9e1a5d508ea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708704804, "uuid": "2d195f3f-6ea0-4998-9a7e-2839d74272e0", "comment": "Malware payload (Mirai)", "value": "e7410fcc13bfcb0a9832d5938c372a55211a41c1e0ae984c9fd0d808ac17e5712571577c05aa9e879f979d618a9bdfa0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704804, "uuid": "83873566-874d-4d9f-959a-d87b00a9a240", "value": "T11E14975E6E228F7DF7A8873447B74E25976C23D627E1D680E1ACC1105F6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704804, "uuid": "d4ad5c4a-90d2-43ec-9380-4a167f7af0c8", "value": "3072:v1WtKjvjn2/mu1jjjYbCKp+971NzsRkbu82vW/Et:v8tK2/mu1WP011NQqbubWMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708704804, "uuid": "abb3c603-400b-457a-b85c-b3af5f776780", "value": 190356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708704804, "uuid": "5607b3b2-38f9-4199-861d-e1ebaeb8c88f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708704804, "uuid": "f6da2b2b-84e7-4dfb-b1fb-531871c171a0", "value": "huhu.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad23399a-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708705751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705751, "uuid": "f9eb7953-1884-4716-9e29-f7f4d014b183", "comment": "Malware payload", "value": "2936b1f6bcb5897fb15c25d5a4f2b0c2", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705751, "uuid": "eb71375d-6d06-449f-ba7b-74bc1a879748", "comment": "Malware payload", "value": "db36e6d97eab31ec49255cfad7115dbef3aa3b16173a77879127932430db86c4", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705751, "uuid": "f72355f2-442e-41fe-8e85-feb50ea08c94", "comment": "Malware payload", "value": "32ee7c916e5ce91f8e383d7384be0f8449add7ce", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705751, "uuid": "9f52f2b4-d257-4453-a3e6-2689219f2d86", "comment": "Malware payload", "value": "129bdae0738f2059c55aa1c00f676099505906ba1cdec7e7c5446dc773318bec4e10184c7634fa2f0cb8fae3b9571970", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705751, "uuid": "e836f469-eb5b-42e3-aac7-96e2fd9433a4", "value": "T14942B0FF51F4F4F6DBC109347291289FB7EE88002DD9844A9B90E714514AA4F5389A0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705751, "uuid": "b42eef9d-71a1-4f51-89de-d1b9d6280727", "value": "384:dXPTJqRcZCruyVNEWPUV0vMnf/wmbmiAl:VPhCrdyu0/nwzRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705751, "uuid": "921fdb7c-c481-4d1e-8c73-0138ca098f7f", "value": 13014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705751, "uuid": "1624d603-6252-459d-94a5-541f08ed040b", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705751, "uuid": "4f806f70-41f5-4ea2-bbad-6de248466d34", "value": "Reserva Detalhes.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f30e94-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1708705337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705337, "uuid": "1dd8a3e8-4205-4da4-855e-32ee26cb6f49", "comment": "Malware payload (XWorm)", "value": "a04ed20abf32c2d5c7e1097a715c963c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705337, "uuid": "0f045549-b92b-4e40-84c5-83292f86af11", "comment": "Malware payload (XWorm)", "value": "e0e93bb3bd5785e338ef459e215b1b073a652395f5045482f0fd4265bcd7cf38", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705337, "uuid": "299017e0-a668-4e05-98a8-e6ec85aae861", "comment": "Malware payload (XWorm)", "value": "8e43c558628a10d1e99e45e537b5c29ab334fccf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705337, "uuid": "7c3ef528-8837-4fac-b6a2-2a7b7fc98c47", "comment": "Malware payload (XWorm)", "value": "160b1dddb5a2c26267fc324618beaefa3794b29f673677f9a69c7284b7a79e7a940ec66001d70dfdded25aa066bdda33", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705337, "uuid": "c2aa3d5c-50e0-420e-b7fa-2ab8051e3e51", "value": "T1A2F0904267FC5220B2F7A70CE93C22AD4F23BE65953EC20C05A00E0D4AF2F0448617B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705337, "uuid": "463f3391-b35f-49bb-958e-b11ec9086ba2", "value": "12:Q2//zKJ+FTc/zK2plghW1UwjHu1UwDh/zKqOzK29If8fXv1UwKAlF1UwJ1a2N:Q2GJ02p6hWCDIy2ef8fp7hJ17N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705337, "uuid": "f180cb17-22db-4001-8277-7106760b5d37", "value": 628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705337, "uuid": "9c7758f4-ff8d-4165-9a12-694693b28439", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705337, "uuid": "2c9a1645-829b-4564-a2f1-d947f769dea8", "value": "56780653.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a9c438-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1708705850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705850, "uuid": "287503b2-63c8-4ecb-ab40-4455f912cf54", "comment": "Malware payload (GuLoader)", "value": "bae2b5f2ba2e3976d19f78cd57589b43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705850, "uuid": "c4196aae-63b7-4d89-a903-c72bcd209530", "comment": "Malware payload (GuLoader)", "value": "e25d6621a38cc9d1dd2428d1886a5080ceec742e8c22fe754e31f6d81eaad44e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705850, "uuid": "b2d5f976-2a24-46b9-b5b2-b24a21af47d8", "comment": "Malware payload (GuLoader)", "value": "c8cbfb695d01b52a83790146fa2ff89de37447ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705850, "uuid": "4e464991-8e4d-4017-9520-1bbe4a1bee2e", "comment": "Malware payload (GuLoader)", "value": "ae806af32b91a51d12d9741b4644a902f7c4350c7cb610bc4a125a6108e0fbaf2ef7224823f458f68643888a0079151a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705850, "uuid": "c68e2e70-25d3-46f7-8785-3fcc91ddb23e", "value": "T16BC4239B1AE9889AC3D247B207F7442AD1FB12521FF5A68F2B244F3F4C257464E4B1D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705850, "uuid": "f601946e-b61e-4705-832e-ebfd010ecdb8", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705850, "uuid": "0568bf57-3e8b-4ad4-8ff0-e59aab515062", "value": "12288:U1JKwATSHsf9/erPv2OzvwvtV9Tj20z168E7rg3ONKUHOI:UhATSMV/eL+OzGTjxzk8QOyHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705850, "uuid": "5d00b43c-6a64-49c9-8d8f-89a66f1781bd", "value": 588408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705850, "uuid": "ef500b71-ddcf-4a11-bb90-e6691852faba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705850, "uuid": "4b1bdc87-8193-4299-92d9-f5eb1807fd80", "value": "Ziraat Bankasi Swift Mesaji.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea94a036-d239-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708685668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685668, "uuid": "2f0d2143-898f-40d6-a1c1-a4a63772c443", "comment": "Malware payload", "value": "e6c125ed9f2427bf83b7ff01b7312a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685668, "uuid": "ec71be51-4f49-45d8-a130-bfda84c10720", "comment": "Malware payload", "value": "e37c9fc196e61ed129744dba706ff65cfd68acf123456ab32568a5a1a2dfd3ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685668, "uuid": "d5e460e3-029e-4650-8cad-6bf2bb1a58cd", "comment": "Malware payload", "value": "b78a491dc2da9163c195a3cf3cadd06da28dba85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685668, "uuid": "ca49f369-7d1c-4078-abed-4283bfe62f85", "comment": "Malware payload", "value": "4c591ee320badd49ef5ea4a82d374f15dd2e4e3f8578850e560a2cfb87a1378f622d023364f1369f6eae1b88eb474967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685668, "uuid": "73866293-10d2-4910-809d-8893e7588c40", "value": "T14C85F105EED6BF6BDA22B4BEC91B989789AEE9120740CB33530CD5777071B340AD71A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685668, "uuid": "75228f56-34ea-48b4-9836-005daa98d438", "value": "3e5979a83b7d4d13a769bf406120ead1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685668, "uuid": "1fcd39d6-17e9-4750-9c78-0eb94a1ed03d", "value": "24576:OKmywXUmmr/t8bDcfyGKhNjIMVNCOwsTsPxj+SgybyvuzdQ8ZwcpGzWTw7:YXHUa3VR+PoyzzdQ8ZwccWTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708685668, "uuid": "0a9a73ed-e427-4cc7-8e6e-f15579d9d883", "value": 1820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708685668, "uuid": "cadaecbd-e9a5-4b82-895b-ef79ad540846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685668, "uuid": "973e209e-c401-4a9c-9923-4a49ed8df343", "value": "e6c125ed9f2427bf83b7ff01b7312a12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247b1438-d26e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708708099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708099, "uuid": "2bf7d7d5-bcde-486a-b24b-c7e13cf0a866", "comment": "Malware payload", "value": "b422aa5138a4f7827f146ee20bbb527a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708099, "uuid": "bdd3ee21-51f8-4fe1-ad11-3a51c272720f", "comment": "Malware payload", "value": "e3d8554d92470564e5c436b6d113b10c346e3c9bd89af5d041bc54f7121c2e63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708099, "uuid": "a8955192-5c3d-4c7f-b4ca-148300396619", "comment": "Malware payload", "value": "de79207800b080a05e8bc557a1e42861650c37f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708099, "uuid": "8ca5f5ff-ddf7-4bdc-9bf3-708cd1e5a05d", "comment": "Malware payload", "value": "4964bf60d9dc7f07957af64025026e22dd25a7582450932f0b9e6d87efffec4f51bc7cad0c23a9b873fdadc458bed7be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708099, "uuid": "ada593a3-68b9-4927-bdc3-6b3a1983465d", "value": "T1D835F2A1B552FB36CE17CEFC0475D5231EF09D128C22CA4BD741BBA58A726D30835E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708099, "uuid": "37fdce55-534e-485f-a200-0d5d8573d13e", "value": "e3c6148870b3ee2911cf20d47e6d7e64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708099, "uuid": "cdf7cbbf-da30-48ec-9d76-84333ea35c0f", "value": "12288:vyICROFLQDsrE3kyPRBd3TInYpYk7VT5/iCQYfTL7UqNxdtToi/0ZJfchp3Xe8uF:vrfmRBdMgY+/6CQwVtTnofcD3JxIKqlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708099, "uuid": "49bbfdef-b842-47dc-82ee-dacb3638fd7a", "value": 1087256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708099, "uuid": "65aab944-67d7-4199-8ac5-82844259787c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708099, "uuid": "30469174-31d0-4516-a9df-e41457a25789", "value": "midSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b0e848-d247-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708691542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691542, "uuid": "c7eaf4bc-b3a2-4237-85cd-aa4082ad75e8", "comment": "Malware payload", "value": "2c9f2b87ab7ecc4a1e6f563e4801808a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691542, "uuid": "bf3d4463-e744-464b-b148-4574b6bbb35e", "comment": "Malware payload", "value": "e4c487c431e48820bb56370a40f1c9fa83b0b23b04246018c54aa07f782c942a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691542, "uuid": "2535dfaf-55ed-482f-9d3a-70d5a759f9de", "comment": "Malware payload", "value": "a4daffea41fd7f8052f60b8268931ccf9fd197f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691542, "uuid": "0c309e0f-5577-47c9-8722-ddaa67202182", "comment": "Malware payload", "value": "c8d2d6a7595bcd66c233d463f37c5cbefbb66a71d8695141eef696d9c0c3c600e767c1312fd35fa64b0b371df53bcb1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691542, "uuid": "b56c8827-5fba-4e4e-8efa-330ad7108c96", "value": "T19D03E09DF1443EAEDE6CEC3E69E94A323C94B888F19F821C9B010D91C78599739C11F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691542, "uuid": "945e2470-50da-4a3f-a473-dc001d33d7c1", "value": "768:v5MObrpmLTNYi8nM89k3XqeryFAG6CctQvP+WM0nVRAravW:vaO3ELTNsnVCaeryx6L8bVRAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708691542, "uuid": "cda205b5-fe61-4fc8-ad65-5d1472579905", "value": 39468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708691542, "uuid": "8aaa526f-28e7-4acd-bbda-d8fe57c59afd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691542, "uuid": "ba8ef46d-b6a2-4a1e-a8b4-6abc76443729", "value": "SecuriteInfo.com.Linux.Siggen.9999.30896.24770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0283f3a-d21a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708672256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708672256, "uuid": "872c9a79-c4b5-47e2-ade5-00060ff53332", "comment": "Malware payload (Formbook)", "value": "a5768846d5a8022cf2c012b03a7689d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708672256, "uuid": "382521dd-b72f-426f-b9f5-c1d83323e331", "comment": "Malware payload (Formbook)", "value": "e63178380c4876680b220683c543472a2d087bce6adc45449ecb4893901fd986", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708672256, "uuid": "5dd9e1ae-875a-41c7-bafe-5de3533c1e3f", "comment": "Malware payload (Formbook)", "value": "08ffa501eb773266a5067adbcdd4d65d23280b47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708672256, "uuid": "cb8c1c30-2b80-469a-982b-37ff37f46142", "comment": "Malware payload (Formbook)", "value": "4e921f641218cd60a36d43be0c617ff11936bea05ecc60ba0986a9e890420c28a21e947e4a02a33a00e2df44977ca57d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708672256, "uuid": "e2e405fe-cb04-46fa-b60e-4b122beb0a73", "value": "T18AE4221436AC0F32E6BF1FFB7951920247B9902F987EFB4C2DC660C626A7B0A5514E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708672256, "uuid": "9d081811-a011-48e0-aa03-8ea24715d36f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708672256, "uuid": "15377984-195d-4739-a66a-11f583149641", "value": "12288:vws/oP5Ujd53LlvckBAe3S0rNUak7SKHNy5whiUzsTZ6iM9woTQWNI4:WBKGkBvC0rNUa+ty5wdzsTZtM/TJN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708672256, "uuid": "dfed32fc-2e59-49e1-a9e4-b34e759c9d18", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708672256, "uuid": "92f6a65f-3882-4f8d-acef-0f80b34d3210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708672256, "uuid": "ea2db465-cba0-46bf-a5a9-7e22c31783c2", "value": "#1_4636233527.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0603050-d25f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708701972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708701972, "uuid": "b7c013d5-b276-44de-a6c8-92198780dac9", "comment": "Malware payload (AgentTesla)", "value": "540e585e51c9a466de5d467f6740d99b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708701972, "uuid": "d6dc4f35-6dc2-45c5-9cfb-8c8de92771f7", "comment": "Malware payload (AgentTesla)", "value": "e68a0da390baf3802baa117bce98b4b3bcbd4f0d0f1355df483d1c5366206921", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708701972, "uuid": "040aa57d-bf94-41e3-a094-9528f82d904a", "comment": "Malware payload (AgentTesla)", "value": "39dd8118ddb60954a0c603cbc4f4636565708d75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708701972, "uuid": "bb372c70-2f07-4af2-a413-7765af2f67fb", "comment": "Malware payload (AgentTesla)", "value": "99bf1cb71079ae246ee8f495630217b1e2a23a029984da0229790b0e4007365cf85a6281c2fba737370d731203f01810", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708701972, "uuid": "6a21e950-c7a4-4957-b6f0-3c03849cc7ef", "value": "T1D0E4231463BFD332DBDE837720E9310147B2302A6552FE256EAE62E798677148B06E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708701972, "uuid": "fc8b1c10-bf56-4fa4-94ba-dc1b7c9dbf92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708701972, "uuid": "052db352-6105-48b7-93cd-e14785c48c42", "value": "12288:nnQ2GO66qCUOSsRokLB2D/HnYZ9KqEJpcoWCladcon6W3HHI/pUmnZzBh3:nnQ2Gr6q0odnE9K1HFdcjnd3nqnHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708701972, "uuid": "76d93a3d-7620-4d43-9ef9-5785e733520f", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708701972, "uuid": "b6e68902-e4bc-4c7e-b848-5018dfd5f33f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708701972, "uuid": "7fa19dc3-b69a-402d-81a9-213de12318c1", "value": "specification sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96630a22-d247-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708691540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691540, "uuid": "60e34d34-222f-44c5-875c-8d258bb3feef", "comment": "Malware payload (AgentTesla)", "value": "2d3b914a08a305baf5f465eeb0632577", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691540, "uuid": "b43f690a-6ca7-4749-8fdd-ff8ec9ac35ab", "comment": "Malware payload (AgentTesla)", "value": "e6c0c98ad74a7eb584979f60170364d931359b314996ef7bfb82fa107469b010", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691540, "uuid": "b4af82f4-ed88-4218-b70c-d0c951700f2c", "comment": "Malware payload (AgentTesla)", "value": "3eb3c6ab3cb9f709ffc6a5bce6f67d2da188957b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691540, "uuid": "7b4f6c76-587a-48c9-94f5-0503e790d46e", "comment": "Malware payload (AgentTesla)", "value": "cf9cd9420aa344e21993c39e4f99ee50e1fe9a41cb7951f1794708d8e7a7546b20cc0dcc4c934873239e507cb3cf1047", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691540, "uuid": "8d62c5e6-2202-4843-868a-8ca01f643f6d", "value": "T13F7302DD83B821CEFA0F19A3C53E7BC854BB88BD26E0454F62E187651944B4A5785ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691540, "uuid": "6ab879dd-ae85-44b9-a940-135571bf5f43", "value": "1536:4QTlQ364Gal2k4u3c6/48V5g6qlT8ecxeXX+g1iTNmCDtGngN2v5r7j:xTlilQuM6/48LgtBcxhPDtYgYR3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708691540, "uuid": "01ac60ed-3751-4acf-8915-4e94ae5ef249", "value": 78773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708691540, "uuid": "c9072572-7c5f-48f3-8810-a0977c3d6e05", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691540, "uuid": "7ca906bf-bd14-4a94-899f-893846e35405", "value": "factra.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a99141-d239-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708685609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685609, "uuid": "b9974f16-dce7-4e59-b4c2-a4fe280a44f6", "comment": "Malware payload", "value": "86a7f4e68645920ff6dc0246ebe90f82", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685609, "uuid": "0583cf69-b216-4162-9c63-15d2368f231f", "comment": "Malware payload", "value": "e7d71efb5a0ed704378966e835efb1de6208a4e48f77b79aadcd69f93680c182", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685609, "uuid": "e5cbff72-7368-4260-b9f3-50e180bbc888", "comment": "Malware payload", "value": "eacdb18200085813bb635174bae0c5845f21211c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708685609, "uuid": "25fa03ad-d462-4aec-a2b3-ecdad7d53477", "comment": "Malware payload", "value": "59ab6a720d6959fbee0157b11ce00e1d2e1b05b487896341a4602090a81af7a8aeb2410eb0fe6a8c0595d9df5dc755e0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685609, "uuid": "5f3cedb1-9037-4f73-807a-2122eed3c796", "value": "T10507228BFB98DA2AC47340B2C95F0237314B5D155A4397776E48F31C28B39D16E86BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685609, "uuid": "c0c8acb7-5382-4829-883d-929902b2f02f", "value": "393216:Zsy9slz3Bmz6UJ/KyUoyJTybZCNjWEOrPFJRR4ehYArC:Zr2rBmzPKyUoyZA2jIv+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708685609, "uuid": "59a72eb7-891f-42e4-9539-2d678b82c1de", "value": 17422829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708685609, "uuid": "fb579a7b-87c4-445a-8ca5-0fc3e2b9c3d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708685609, "uuid": "5553c5f0-2e04-4132-8847-75462f355534", "value": "Cool Emoji Keyboard_1.5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45424a49-d24e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1708694410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694410, "uuid": "2b34b8ba-8109-4e52-a201-b3b33eac6d3e", "comment": "Malware payload (DCRat)", "value": "f0bbe487784a0f95a5d510062282faf8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694410, "uuid": "7703b0be-bc3c-409a-83ac-23de519628cd", "comment": "Malware payload (DCRat)", "value": "e88f0c18b270a4394e8e3b9321395ef4346bf0962ea2adc25eecdc02195f738e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694410, "uuid": "cbd72768-fefb-4ee0-9bbe-23c37f530e97", "comment": "Malware payload (DCRat)", "value": "41a844ba07682d76956f2f7fdbad0874a42a5865", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694410, "uuid": "20290215-bbea-4879-ba39-6bc4bc4af64f", "comment": "Malware payload (DCRat)", "value": "a7598ae7f5b19007569ff8c983561cb5b2d6ef6be9295e53cc0ab45782f334274d7435a8d0d5d24cac5c65df1524b1cd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694410, "uuid": "a14317ca-b113-4d74-85a8-7fe3210922e3", "value": "T11E95AF1A65965E32C7A457729597033D8290CB223616EB0B361F14DBAE07BF18F732E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694410, "uuid": "14653100-cfb9-4539-a6bb-48f66cf66eb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694410, "uuid": "8ec990e7-e90f-4ccc-bc90-8797aa2a3f9f", "value": "24576:pSg0AqI+tXoAHtibewt8amOYKEJSxrR4rI/iepDChMLPDlbZ655u6NMkaSn60K4w:p8VfsiomOjFmEUyLPDlbM6+6B4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708694410, "uuid": "e44f11c1-2f31-43b8-9497-368820960589", "value": 1882624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708694410, "uuid": "46e67dab-932c-45ec-a6bb-efc9efc0fb2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694410, "uuid": "2f8658e0-d912-4aaf-9474-fbda52e9a4e6", "value": "F0BBE487784A0F95A5D510062282FAF8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350ff4d8-d260-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1708702114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702114, "uuid": "544f4fae-3f31-419d-9d31-1bd40a80a664", "comment": "Malware payload (SnakeKeylogger)", "value": "3aa4f27e5d5057cdfeb9f81fe6925ec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702114, "uuid": "dbcf285e-b7cf-4485-9154-a43c1c7c1f1a", "comment": "Malware payload (SnakeKeylogger)", "value": "ea53a3ff383cf9d83302a015521ec95083a4299838a7673a7c707922138b6d51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702114, "uuid": "52cc3741-df45-4677-ab0d-d05911ef1c18", "comment": "Malware payload (SnakeKeylogger)", "value": "be5e0edb0dca42602021492ea21753a7a3b638d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702114, "uuid": "0b166e26-4079-4096-9213-170181c906b8", "comment": "Malware payload (SnakeKeylogger)", "value": "09c54e911d948e360cdb63ae71dd50335284c07fc301834dac60cb001ec9d8bcd89ebd6f8c3eaea2f3822e6a2984c480", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702114, "uuid": "43737715-74c6-43c9-8ad8-541dfa90f338", "value": "T1DA94E114A3FC4B15F6FE9ABBBCB008150E77F92F6926C75D4999010E1A31BA0C991F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702114, "uuid": "24f4b18c-9502-4fd7-866a-aa7497aa59fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702114, "uuid": "40888f1b-9842-4f73-bd40-fdb1d6739360", "value": "6144:3tQkq7iHAOiXqRv+enKCjZ94XkYbjdfa7ib2C72BdkEKWGH7FHboEey/cZOsmz+u:viXG+aKCj7IFFfa7i6C7KGc46AmeMTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702114, "uuid": "43280935-6c85-4f74-9988-dd1d479a1aa8", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702114, "uuid": "ba69da75-6981-4dd7-bad8-1477cb879120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702114, "uuid": "db382421-05d1-469f-85d1-8ba3786843c3", "value": "SecuriteInfo.com.Win32.TrojanX-gen.9014.19757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd98e4e-d26f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708708813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708813, "uuid": "ccfae7f6-0d7a-490c-a61e-8211a92c6b6d", "comment": "Malware payload", "value": "a91f942248aa67ff4d4646cf4b0f3921", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708813, "uuid": "7df8f119-d5b3-4745-b0dd-fb4e7bd56f8e", "comment": "Malware payload", "value": "ec00ed204cf14b949776b2c8abca168a1f2ba696ee660ee5d1b6cd617e29fc59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708813, "uuid": "65563341-1ee3-4fb7-aa2e-4999ae99bbb7", "comment": "Malware payload", "value": "103f6dd888729b9025103c47b0f2b72ada68be89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708708813, "uuid": "606c88b6-a4f4-431b-ac56-d43911caf040", "comment": "Malware payload", "value": "aa31192970e846b5ebe49da7df8501045534c3200c84ad8611ffc10ac9fdf4a63751e3fac247668436b4b598fbb05989", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708813, "uuid": "e0666402-d8ea-4b42-a99c-5f8984844b02", "value": "T18C85C0A2B1D0812AD173DBF51B5699E4373F7D312D18678EE2E63B890A34AD064E3533", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708813, "uuid": "37330df5-b833-4d20-8f84-46ad1eb5084f", "value": "e36cdb81e59d5a4701e323e960f1f7b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708813, "uuid": "90c786cf-3281-405a-bbd6-650bef32d862", "value": "49152:2uLqn8Y6FlWZ0vH/k3mlXoQq7TuN5Sdi8ewnXZCz:2uZp/k3mlXoQq+N5STXZCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708708813, "uuid": "7f66e161-0238-40c0-a098-5faefcb52cb5", "value": 1800192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708708813, "uuid": "d69f5c34-4f20-4802-9f62-6065bc5994d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708708813, "uuid": "2613bcf6-17c2-4f52-aa6f-feb2d2f286d4", "value": "a91f942248aa67ff4d4646cf4b0f3921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2575d1-d1f3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708655334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655334, "uuid": "4e8f1ad1-aea8-473b-9e45-f9ec4cd142da", "comment": "Malware payload", "value": "d97e03aa6b45d38dea8b86a1511fed47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655334, "uuid": "f389a7d9-7f69-43ff-9e9a-fc1e7fa58754", "comment": "Malware payload", "value": "ec3776abfee18442388a0a5245738ca36269f497b514d72f11c127aaee49f808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655334, "uuid": "f07788cc-e879-4bd5-997b-85f09b16b419", "comment": "Malware payload", "value": "bfca2c6d0c1d254096afc5c4e14ac86c96b10d95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708655334, "uuid": "39b63e22-b2f8-478e-a916-7484a8ac2ee2", "comment": "Malware payload", "value": "ff2b8d1ee5353a02aaef2f1f15f37ce880d6cfed8b3676d992c48c318001c47107c017064d06ec03ecde83ba90467b2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655334, "uuid": "028e7a07-87df-4a63-84d9-a4da99dfa2fb", "value": "T182D47B21F9E240F1C216153219FF2B35AA79AA065B258FC3D364DE6D1F261F09E3B136", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655334, "uuid": "7d437e2a-02c1-42a1-8de8-bff47f2a74ac", "value": "a89a015f30065aa5967033dada8ba16a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655334, "uuid": "aff3a984-076b-45b8-9a57-649b54623d2c", "value": "12288:3vzP4jbRMI7Ba8HW8hd0D4zy0fufPJYiQxWnE:fzgewHhmDd0fePSiQxgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708655334, "uuid": "435f6142-e704-4d02-993c-00d549d2992b", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708655334, "uuid": "155e8698-a549-4f38-a8fe-8894dd78610e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708655334, "uuid": "d712da50-2c1a-42fb-bb22-720e871f773d", "value": "SecuriteInfo.com.Win32.Evo-gen.10266.28179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedff0eb-d268-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708705808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705808, "uuid": "40a97d05-9c34-4e8a-b8c3-76863c5138c1", "comment": "Malware payload (AgentTesla)", "value": "a07a6c63f8c37ab79dd2c12b934fe6b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705808, "uuid": "5013d8d8-c896-45fa-b5b5-63e3d3375020", "comment": "Malware payload (AgentTesla)", "value": "ec7534a141105f0d82f8be59729135367412db7515de7b277687b5facf4d6b44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705808, "uuid": "6590b928-6489-495a-94ed-8970c9633cee", "comment": "Malware payload (AgentTesla)", "value": "2cf02d710f7f1108bc824e16315bb0341a90ccb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705808, "uuid": "2e6b4708-cb99-4576-82ab-99188a15328e", "comment": "Malware payload (AgentTesla)", "value": "b9196ef068843d01df46a92718c35e3cba8968c427fd003fca511876b5fe39d72582332524f6048b805fdecf6a4464e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705808, "uuid": "9abcec14-2ed8-40bf-a4b9-d9943149fcbe", "value": "T156F41289A3ECAF67F2BF77F51460640117F171AB9435E3080ED640CA65F2F948E88997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705808, "uuid": "3622cfbc-c5c6-4195-bd66-c28e6a244564", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705808, "uuid": "9a576f65-8d96-48a7-9a7b-1fd0651fd8b1", "value": "12288:h2n8aas5Ujd53LlvuughA7ddNP4YVOl4kIoIumozI/SAnKkqmhQX04q7IwYlj7IV:h2ntKclA7B3VOlMrolAnKuaZq7zijShV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705808, "uuid": "bfc45d6c-eac4-440f-9151-1e860edfa5f4", "value": 765448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705808, "uuid": "c5a2ecdf-2563-4980-b44f-780d130dff09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705808, "uuid": "862550e5-8f2b-4141-b21b-07252b5506c4", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691de713-d245-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708690605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708690605, "uuid": "2319e91a-ef3c-48db-adeb-111e7dc2f3c9", "comment": "Malware payload (Mirai)", "value": "1dfaf1138ccf0385dd5fc6a3fabdfe78", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708690605, "uuid": "0cfb97e3-eca6-4fd9-a21f-495ee8786497", "comment": "Malware payload (Mirai)", "value": "ee312ebe9f57feb3fd77f00c809313e75ef652e52631569b991d9391d408f469", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708690605, "uuid": "d30150cc-e57c-4434-a600-14a57a2e0b1b", "comment": "Malware payload (Mirai)", "value": "069b322a5a9fd3cc518c91de06a8486a574d3e08", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708690605, "uuid": "c34676da-de1a-4414-a23f-23bfda138fab", "comment": "Malware payload (Mirai)", "value": "116577e9deaafe64aad73bfae2614b0007d99eb69607bbe522d65a48ef4721c36f172b345d71ec1632ae69a971b1e1e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708690605, "uuid": "4e859a2f-7652-411b-9bfd-eb792c6a28f9", "value": "T1CD435AC4F643D8F4DC8705702077FB379B72E1E922A8E657D3B4DA32AC52612E506A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708690605, "uuid": "c6a73086-479d-4555-936f-b8f1f29fb832", "value": "1536:lEytfbaM12r8ZBG6X+cHaBuhTT2OoaEDrKQVM:lEytfbaM1zAl5whnN3ESy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708690605, "uuid": "47126c9a-7e10-4e8c-ae3b-92e416298ea1", "value": 55664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708690605, "uuid": "51d30112-6afc-4bcf-801e-cd797a7624ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708690605, "uuid": "7c073b60-7760-4037-a002-4a03c4ec3800", "value": "x86-20240223-1216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c983966-d24f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708694798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694798, "uuid": "fc2cd259-b85b-4f9b-9066-f959d7ebc47c", "comment": "Malware payload", "value": "e55e07f58e29edfc8b19cead8191acb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694798, "uuid": "ff5a37c6-afdf-43c6-bc96-90013aad67ce", "comment": "Malware payload", "value": "ee984eeb8291ae0b8d17cbdfae99a2d996c6c6c8d75a5014946c021d444a78b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694798, "uuid": "57dd5aee-b0f9-4958-a67f-2a8ad357b8ed", "comment": "Malware payload", "value": "1500b9e2a98d88f8b6e5965213e710a7e45a05c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708694798, "uuid": "c2f92b49-a599-439d-a024-ed012cc01a05", "comment": "Malware payload", "value": "8e6addc6904810a1822a67aa7ea801b4fa533a1397d7a168e349fa3b729a175f4c133837fa6f4a92eecfc4a0a5dec453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694798, "uuid": "21f7663a-7d6e-4d27-9a0a-ddb2caef4b09", "value": "T123C3BE5267C0C8F2E8850A3156FBCBA3B733FD0165941787BB947B6F1D32241EE1968A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694798, "uuid": "f67c4888-b43c-4e8e-93a4-2bc1b0895b78", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694798, "uuid": "c9dd1e3c-4c0b-407e-9b8a-21ab747c477d", "value": "3072:zQIURTXJhUvobH+682ll8IixUnQxUSeHReMn0FCT:zsnUwLB82MbUn5eMnzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708694798, "uuid": "3822235a-52ec-4293-91ac-468ab2ecf2db", "value": 126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708694798, "uuid": "f6f6a94e-adfa-47ec-9f2a-37c1f749511a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708694798, "uuid": "71dc34ef-51f0-4b3f-8bfc-472cbf0f9b99", "value": "SecuriteInfo.com.Win32.Application.Piriform.A.30687.31844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02880811-d276-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708711478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708711478, "uuid": "e12c5c34-0f4a-422d-9f9c-f7b74f336cd0", "comment": "Malware payload", "value": "f86d84951531f9ded0349096c2d4fb9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708711478, "uuid": "b8223fbb-f251-4bc0-b119-9646c47643d2", "comment": "Malware payload", "value": "f396d6f2312a827c32755100064646c03695ffb28ba3d9d71bfc488ad75ad5fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708711478, "uuid": "d2233d08-4492-4c55-ad69-8cfd8b02c51d", "comment": "Malware payload", "value": "19a66af61751967474651e12bc783fdea728a106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708711478, "uuid": "9da78d2a-cbae-43fc-8615-543d635e4abc", "comment": "Malware payload", "value": "1b8613c805e57e5d55f1fb390742cbbbf4a1ada961ecc98fb21ab9e6c6b857ac0e630c1bd2891ec2e37789378a0bebf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708711478, "uuid": "a95ecac3-3474-48a8-ab41-a40ac8846338", "value": "T1AD44BF1366917C62D76B46728E2FDAF836EEB4218E5DB36B22185F2F44701B2D233711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708711478, "uuid": "37bd10cd-e760-4268-bbb5-fd64e1b220cc", "value": "8a2d974d23031a4e8b7d19d4cbed4814", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708711478, "uuid": "83606a09-8cff-4e2b-9a53-47db5253310d", "value": "3072:rEWlDIX2EmU3WSs8wChTgmui99Mo8XEUnPgfnJSZBLiTNouInRp5/4:hEOSFw+ZzJUneSZGOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708711478, "uuid": "0c1cb08d-e9ef-4d18-a0c6-02bbc213c65f", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708711478, "uuid": "cfdc385e-7a0c-411e-8927-b38745ba3ab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708711478, "uuid": "3e575f98-9d1c-4148-ae19-fa45ed4b1921", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa5d920-d234-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708683234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683234, "uuid": "d66ad007-d7fe-498d-bc94-363ee51fd440", "comment": "Malware payload (Gafgyt)", "value": "e7fd3c701ad93fa4e259c6a9bc01fda9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683234, "uuid": "c8d7fa0c-baa0-4820-8121-e53e4c86a625", "comment": "Malware payload (Gafgyt)", "value": "f3cbe180d393c4c72c66257d9a1d41f5565335ea64f633fe2768213381972e94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683234, "uuid": "f195c367-7077-4a89-b422-51f4e6964079", "comment": "Malware payload (Gafgyt)", "value": "252ed58833acf44571d7bb2545fd55a3528ab217", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683234, "uuid": "f473e726-1e8d-4585-a662-5858405247bd", "comment": "Malware payload (Gafgyt)", "value": "17e07d4aadc18cc4910e0a8238f8b0b287b81d41953891e2371758d2890420b56570c4485d03d07d4fc8b161d3c8a671", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683234, "uuid": "eaeef82c-cd17-4c78-abd7-a8c8e00db59b", "value": "T12EA33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683234, "uuid": "dcaf0fcb-4cdd-48d1-a6ca-b2a59597584f", "value": "1536:xfRuqNM5h7t/RiRt4nSphaQoRKzO6F6OXj6ufeRTe:OqN8jRiRFphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683234, "uuid": "c661159d-7dce-44e7-9bff-52d2bdc02aa1", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683234, "uuid": "628151c3-bcaf-4001-805a-a3333b620bce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683234, "uuid": "fdbf0b6a-f583-4afb-9734-9dad56e67adf", "value": "e7fd3c701ad93fa4e259c6a9bc01fda9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d42ef59-d1fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1708659312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708659312, "uuid": "e86c81b2-cd4e-45ff-b395-fd53d63eb929", "comment": "Malware payload (DCRat)", "value": "b7477c1b74a23cbc8b442bf6618e2423", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708659312, "uuid": "687d81aa-d252-4f08-a288-b5ae3329e4f8", "comment": "Malware payload (DCRat)", "value": "f42da13b2b7901e3e0242e810a2c4d78e5a62432a2fb5c704da37cf9b960fd51", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708659312, "uuid": "039ddc2d-cdc5-4556-8c6d-788df461395b", "comment": "Malware payload (DCRat)", "value": "1cd9065601f5d6faafb7905b36cd6d0b801345b6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708659312, "uuid": "5a957dba-b382-4045-b31b-19bbbc0839da", "comment": "Malware payload (DCRat)", "value": "af56682952b20d2dcdb3225c877ba16b5c54cdcb68b50429c77beabaa651eec9dec10fea5617814eb2648961ef34e4b7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708659312, "uuid": "d6e6172e-a2aa-4009-a668-936b30dca124", "value": "T1A3455A017E54CE11F01A1633C2FF454447B4AE112AA6E32B7EBA37AE55123A37D1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708659312, "uuid": "84486d39-e8f8-4063-ba6d-b12581c41b7b", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708659312, "uuid": "c56913b3-0414-4d98-bc0e-270056848f0c", "value": "12288:aRZ+IoG/n9IQxW3OBsee2X+t4Rb1xIC4015xNGhqWGk/RfrHi8VO6Jiyw4LHi6nI:U2G/nvxW3Ww0t1vGhqW9HVOjyJtiNDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708659312, "uuid": "9fa1c3c1-6307-4031-bcdc-4d26489ecb37", "value": 1165410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708659312, "uuid": "7054acd7-1b81-4d42-b089-bfdaf87fb081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708659312, "uuid": "86a0696c-089e-4017-ba58-f918aef6fba3", "value": "b7477c1b74a23cbc8b442bf6618e2423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f974e02-d261-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1708702561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702561, "uuid": "1a11e6b0-9a45-455e-a7bc-99fab036ce48", "comment": "Malware payload (Formbook)", "value": "869288892ab156d569c40e98081ed017", "object_relation": "md5", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702561, "uuid": "86a932eb-5226-43db-a76b-0369bb06edd3", "comment": "Malware payload (Formbook)", "value": "f438219674135932916d92aaca9252dfa2e23da126095100adae2d4d6674182f", "object_relation": "sha256", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702561, "uuid": "0d69d166-0c42-4a74-a755-e6a00b4768b6", "comment": "Malware payload (Formbook)", "value": "eb64cc9ea776c5ae6a4ead14d3f5e61311fcac0f", "object_relation": "sha1", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708702561, "uuid": "56727d62-19d5-4d46-9645-ebbacf855941", "comment": "Malware payload (Formbook)", "value": "bb88490ad49dd027d6e90e76a7d0d56d88792e9169ab239d12959219d010f08f2bd6895d49270ed4cb532767755205a8", "object_relation": "sha3-384", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702561, "uuid": "e96c78b4-8650-4a55-90f4-c67690a90123", "value": "T1F2D423DCAF63E78C8E441B4079FA74A2463E16B7579282A59CD46AFB7754C08C2E813C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702561, "uuid": "fbf93f4e-9bb0-4eaa-91f4-59e2f5f62e03", "value": "12288:eGkhubVyzSUIhSqLl4xvcX7I6d1mvZeHkgfTV73wTJXi4q1PChxAeCeEUaMoEnYU:eGdczSUIwqLWxvcXnYSVN4QVeSUu1dA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708702561, "uuid": "e6dc844d-f12b-453d-b4e6-1f449d880038", "value": 637876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708702561, "uuid": "12ed6c6d-0870-4abb-80de-bae8fbd9df78", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708702561, "uuid": "3c533c4e-6e2a-475f-aa8f-75aeef8a530a", "value": "nDHL_Factura_El.bz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1193dc6b-d235-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Moobot)", "timestamp": 1708683586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683586, "uuid": "68d6510f-6056-4dfe-b9f1-980c741cbbbb", "comment": "Malware payload (Moobot)", "value": "e08c3021b4f0142fd7b3191b6dc99224", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683586, "uuid": "e5d2e00a-6da3-46ef-9ea4-dbdba20ed74e", "comment": "Malware payload (Moobot)", "value": "f6320dd9a59f627090ce4f9dadf50f06239e46ea30e7f0619105d1bab3fb7bef", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683586, "uuid": "ce6f91d6-66e1-4bcf-b3ce-15ba393a037e", "comment": "Malware payload (Moobot)", "value": "d44000e127b59e8de6dd1dad80ac41b59508851d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708683586, "uuid": "5452c0e9-caf7-48d4-9826-9d8959b2cba3", "comment": "Malware payload (Moobot)", "value": "716b52f9b4655d8b79607ff761e79e8b4e0b817d813351cb9e6a935b2aaa3c7f9022fc7c27fe4a1822d352bd9fa93775", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683586, "uuid": "bd18e1f3-2d4e-48b7-8234-2f026c2b6313", "value": "T1EB233A07A58180FCC459C1B48AB7BA3FD93775BD0239B2AA3BC4FF2A6D95D260D1D904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683586, "uuid": "6ab8d50f-5e12-43ae-bb23-a98852393cfc", "value": "768:lGCvQBi5Lw1NM8NdVnhIKeWFF5pRy9mbjw8FIIHsHNeM1VBkcKWXn9Oi:3vQoa1NM8nVnatWdp04bjwaIIVMnPxXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708683586, "uuid": "571e647d-b818-4f81-b47d-50b532d08aae", "value": 47360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708683586, "uuid": "7ec347f4-3dbc-4c71-b1a0-c77650dd670e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708683586, "uuid": "4f89a03d-561f-4236-9402-6b57501fccc7", "value": "e08c3021b4f0142fd7b3191b6dc99224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d764cd25-d20c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1708666309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666309, "uuid": "8c3c5973-70d7-4b91-acb3-6fdd51c0dd84", "comment": "Malware payload (Gafgyt)", "value": "3f3e4bdd25fe35ffe393f6cebc186311", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666309, "uuid": "86d639ac-e3c9-4f53-9b28-70d363a39372", "comment": "Malware payload (Gafgyt)", "value": "f7fddbdcbdb4fa9b9e8c842a4396d892f6560db455c5105ad62e5329510bc0f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666309, "uuid": "265314f3-0aed-4b0a-aed9-98004a07b500", "comment": "Malware payload (Gafgyt)", "value": "3fd47331a1597ec3d5dcf8718c71ba8de9e3dae8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708666309, "uuid": "ed23710a-6798-42bd-b041-218b7804a66f", "comment": "Malware payload (Gafgyt)", "value": "7a7b2f4dfd08c01f21e7ae6cc7c6cfc90ffc85036c0e86f1e0c1452c4a5f2ca1243e62e6f5b7d3c3a4a2fb625619fae1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666309, "uuid": "d561d4c1-a7e0-47c3-bdad-20271015a819", "value": "T13693398785719EB3C042AA7925FB89740713A8225B0F1F68612D9BF8070BDDDFC9E725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666309, "uuid": "5fa6106f-0442-4f11-8d37-a8db871006d3", "value": "1536:TeDM+Vlabe0Ff5soS4yfaf7dfmoDs2tSYVm+:Tj+Vlab/DDf7dm0s28YVm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708666309, "uuid": "1a6351f1-4a55-4b71-97a2-dedf5b142f91", "value": 96317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708666309, "uuid": "120d57c8-80c5-4156-b734-7a1603ea7077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708666309, "uuid": "511e315d-6d06-4901-859b-4df57f456576", "value": "3f3e4bdd25fe35ffe393f6cebc186311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77dcf34b-d267-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708705232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705232, "uuid": "01ea5303-ad27-433b-af57-019919b71500", "comment": "Malware payload (AgentTesla)", "value": "28a4222d804fafc98f447f9b4d6d0738", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705232, "uuid": "e7a69473-ed2e-4d46-aa24-23dd32a210c0", "comment": "Malware payload (AgentTesla)", "value": "f9fd0802d99d89be32651b212b314f7a6b98f7f254a71257f55971dc8b60f3ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705232, "uuid": "1a2f3a06-91ce-497f-a3ce-e802f6a04ced", "comment": "Malware payload (AgentTesla)", "value": "72c69ee2a7afdce49b695600c804d07dec32bb95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708705232, "uuid": "cc821a6d-4451-4618-92e8-0d95928b36a5", "comment": "Malware payload (AgentTesla)", "value": "021122867bfe02b473d9e4c539616d052b7b3fc0567b9cbc4df70337ed3e9efe99df48df1119bcbea6575cf7c511fb1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705232, "uuid": "2df2b698-4937-44dd-9c38-f9a72180873c", "value": "T1FEC40151FA818B0AF84687714EF35E9B9729FD815B928B0B311CF71E3DB03A49D17A21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705232, "uuid": "17c52a29-bad4-4569-918d-8327261fff3c", "value": "12288:ATkQSEXMcbNedomzEDOvl3bVx/MI2ztioqQQj9jZTxG/TxecU:ISSMMednEDal3bVWyTP1G/NeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708705232, "uuid": "e9e3187d-5789-4cae-af24-16c98bd32169", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708705232, "uuid": "1e6ef51d-d2e7-4258-862c-f3a4b88633d1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708705232, "uuid": "cdbb327b-d4e4-4095-9cff-8bc8a541ccde", "value": "cotizacin__98765423546576909.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d098508f-d253-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708696791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708696791, "uuid": "ab1d3e86-d432-42bc-ba14-b362924b5157", "comment": "Malware payload (AgentTesla)", "value": "ff8ad96111324309a67b1b57a16eaabe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708696791, "uuid": "6fc83b52-37dd-4ac7-a3e1-04ba33ab30d6", "comment": "Malware payload (AgentTesla)", "value": "fa6a90868be9524a1fb67ac98548f0cbbd4d4254b375c118c5e638c64147e953", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708696791, "uuid": "6316f508-dfe2-43ae-a625-b7ebaafcfdb6", "comment": "Malware payload (AgentTesla)", "value": "43a3cbc67291185ffc9617d97acdfcdc3edc4481", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708696791, "uuid": "8805ab61-f5a8-4a80-9398-d350572b0d7c", "comment": "Malware payload (AgentTesla)", "value": "30c2311e084a9a8eabdee0b497e56de5e21f197809df02b762e288af520396ccc767259e48e04d15bbc9021e93bc7ecc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708696791, "uuid": "742d96e9-8a41-4dc4-9537-b2439e738124", "value": "T13AF4CF1E37118C21CBA39778E8B397021502DEEB845AE70753C9657B612B6FF1FA2706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708696791, "uuid": "c75265f8-03db-4ce6-9042-b1802d346e90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708696791, "uuid": "a1c16f43-f2bb-4f44-98ad-bb16c9f9643d", "value": "12288:p++C1iFusPFiCxRDihTCMSSo94fuu4yBSMZrNUSUa+TIsaxN/nS:z+sVDyTCMStyEUinyd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708696791, "uuid": "1e21257f-402f-41a5-8f12-da18d1ad7435", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708696791, "uuid": "42b5f705-b54e-4530-9fc9-8a5a087ef7d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708696791, "uuid": "82b74ff9-4978-44f4-830d-7c1b70b85577", "value": "SHIPPING DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84f7d61-d259-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708699408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708699408, "uuid": "a6e2d7fa-69d8-4fd3-90b0-7c8d5511e03d", "comment": "Malware payload (AgentTesla)", "value": "7b1b86a7780cae94e0408f3f2a1d62a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708699408, "uuid": "bf26e0e1-73b2-4ee3-a270-2d149ea919e1", "comment": "Malware payload (AgentTesla)", "value": "fa908e22515c6bee2fe37e1a84e3f56ffed4334e2c25efbd753a4bff09edad3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708699408, "uuid": "6fe94469-cf11-45e9-b281-ad82df93db7e", "comment": "Malware payload (AgentTesla)", "value": "1efc0ed099588f4c15254c271e6d468dd41acea5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708699408, "uuid": "5e4ebe38-f896-4b97-88cf-c1e805b85ca6", "comment": "Malware payload (AgentTesla)", "value": "edef4fcef2598f623ded5d3415e7d998bb475c8988a5fb1805254999b3315cb79fa160fb99a624c05029fe01897d37bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708699408, "uuid": "269c7ff2-8e09-4823-a92c-ddb83c40a97c", "value": "T1E9E433ECFC8F06AAB27E4311DD6951590C7468735C6B5A0040AE98E2DFDCC1B4DE9EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708699408, "uuid": "3dbff815-ba73-46e6-a4bc-0d3dd4898a61", "value": "12288:CHlCcsjTZLysClUMYW0ixtjqklQejHEgBeh2cFa/1gjFN/Ql6y:CHlFyVLuAWTxd/lQiHjBeh5Fa/1G4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708699408, "uuid": "f39de293-62a3-475c-9c90-4a1b11f29a13", "value": 690577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708699408, "uuid": "74c7195c-616f-412e-94f4-91222f304695", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708699408, "uuid": "a6351424-eca4-4d9c-9c62-816014501c67", "value": "nCompany_Profile.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7416280-d253-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1708696749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708696749, "uuid": "75f1a93a-8486-4467-94ac-d412a253bd06", "comment": "Malware payload (AgentTesla)", "value": "c8f618fde1d6eff56bdb5d178785fdee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708696749, "uuid": "483d60c6-f60a-4353-8683-0ccb98e7aa3d", "comment": "Malware payload (AgentTesla)", "value": "fae7151f524b89162d3d71388b8274edc0f7877701de404d509b2a5f17157fae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708696749, "uuid": "73346cf9-f3ec-4e5f-8464-3aacee955c32", "comment": "Malware payload (AgentTesla)", "value": "f0578802f4540143f835f7a48deaaeaab165b646", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708696749, "uuid": "ae153c69-ad98-46c5-8608-27c7a5246064", "comment": "Malware payload (AgentTesla)", "value": "7974b257460fa0144329f47b3fd33e05e01e6f4398e00f5e572b2bfc067d51cea54ee15c630ece15cc1e4d2e4e7ad8c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708696749, "uuid": "039f24b4-dc84-404c-a473-5f3a816c67fe", "value": "T18CE42209727DD373E9A787F8104121A45B76A26D7C1AF6CC2D887DCC92DAF098F52A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708696749, "uuid": "266b7bf3-78fb-4ed5-82ae-9f562d6aee54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708696749, "uuid": "148fca9e-5c1d-46aa-b1ef-19f11fe85593", "value": "12288:3lW3hmzBh35ktn3dH0Eo9Bci5vmSXk1ZVZj3LBOBUdtn0K2NxMHuu66upN8ZJ:PB+ltU/9mitOLVZj3NkUdtXCMHuu66o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708696749, "uuid": "c08fe041-774f-49aa-b5fe-5990b3d2de42", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708696749, "uuid": "5b218d90-9649-46b7-95fd-2ef218ca5b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708696749, "uuid": "ee9ce026-b3d9-432c-85b5-0c8813d91a1b", "value": "Quote--FL202306200039 SWP Inquiry no. 2024-1981.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3a4ed9-d21c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1708673105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708673105, "uuid": "9c24f68b-8c5a-4c77-9133-807101d43c06", "comment": "Malware payload (SnakeKeylogger)", "value": "64024c167127f8d3971bc854d83483d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708673105, "uuid": "b3c39468-9fab-444f-8b2f-a15efa99950b", "comment": "Malware payload (SnakeKeylogger)", "value": "faeafba27bf29dce07ec2cad5fc143a8c5ebc887438df671edd1087f6c1145e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708673105, "uuid": "4d7c5bce-5c84-46df-8caa-98cc307d47bd", "comment": "Malware payload (SnakeKeylogger)", "value": "49935bbfcaaa7e4ae7ca76c023b750a154ac76fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708673105, "uuid": "8bba1da0-aaa4-45a8-a3d6-b1c955b2ba68", "comment": "Malware payload (SnakeKeylogger)", "value": "5d9dfa34fdce81f1c000f2ed58c393c91942147e98e6e5f6e34d1d0a6752bf43cd2daa9036f90181ea3788c3ae4743ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708673105, "uuid": "30389dbf-fe9b-4970-b175-14fa711e7a42", "value": "T15CE4BF37ABF85F27C2DE837B99E3450EABB1D026620BE75E48C096E51E43B554E012C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708673105, "uuid": "25da7054-dabb-4bc5-b4a2-1e0a5c0ad990", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708673105, "uuid": "e9f58ddd-c4c4-4550-a7f1-f8b2477d0137", "value": "12288:KsoyQ4yiK45/Rng8VieSbFDoTqCWYiuPn7GiibPPBkhkBaBSfmeZgY59gupYuFAM:RyiKA/Rng8NSpDAHWYiuPn7Gi6BgB41t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708673105, "uuid": "2b0842aa-ac44-49fe-bcd8-46dc4d8de810", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708673105, "uuid": "329a9c66-dfe7-47c2-a989-98df78a42647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708673105, "uuid": "d6b2f717-834e-47fd-94ab-a6b0a67d3853", "value": "SecuriteInfo.com.Win32.TrojanX-gen.12091.2695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92cdcd50-d247-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1708691534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691534, "uuid": "16fd3a2b-5369-4b90-b423-3e2541b673a5", "comment": "Malware payload (DBatLoader)", "value": "e9ba4065a74855e57688c181791c1d31", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691534, "uuid": "ac40ab42-34c0-4744-9c42-e84d945de673", "comment": "Malware payload (DBatLoader)", "value": "fafd0eca0033389b33c6743010aea3a3806768c64510e159144dd13387c1f770", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691534, "uuid": "95a14386-374e-456e-8db9-348d40ca5adb", "comment": "Malware payload (DBatLoader)", "value": "970e9bccd3996b4cf1a42aea8db9e79d4de8763c", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708691534, "uuid": "5b5f12d8-5a9d-46bf-b101-b75aa6d90441", "comment": "Malware payload (DBatLoader)", "value": "f5dfa7a6d14975de5e769b9fe2f0ada7a88e6ffab86f487f9a613e3ae2f88cc1392e0b8ce7a41c9ee742bd35c44920c3", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691534, "uuid": "dc47cd3a-dd95-4d71-b971-d1a213325f68", "value": "T17C25338AC28071E37CA7D4EA9416FD71B076930E52ACCE456520BF805453E5F3D8A9EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691534, "uuid": "fdfcb2ee-f768-4194-97bb-e7ce86c84130", "value": "24576:OCxhvaqNJuLWJy2tGFQpoIempJNP1wISjiMFjJx:DNTiWyJFQjzP1wRZj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708691534, "uuid": "7c377cb2-90fa-4ae1-9c67-c48f22263422", "value": 1027956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708691534, "uuid": "12932147-414c-4cc6-8ffb-885bdcc4249f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708691534, "uuid": "55c8ba89-bd86-4c04-b8ff-fe27d2f7bbf2", "value": "Bank Swift copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ed5b57-d220-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708674847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674847, "uuid": "fe155599-571a-4c17-8cee-afb94efd8fab", "comment": "Malware payload (Mirai)", "value": "957cc6f0ef38420370975b5e992efa9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674847, "uuid": "391bb959-ef27-42c8-8b32-518e0109b6ad", "comment": "Malware payload (Mirai)", "value": "fd8c4b12d290c151e3c17a0e7b9f16c0054bcad8c0cfc71b3cf6db4b6d3b27ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674847, "uuid": "bd089a49-556d-4ef6-a721-b674f45b92a0", "comment": "Malware payload (Mirai)", "value": "a426d63270b1765231914b04f0930326bd522496", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708674847, "uuid": "20fc09d0-14c2-41f1-b463-5fc60a45ab05", "comment": "Malware payload (Mirai)", "value": "1641ad11cb05c5acc6dfe739c1b1f1c510bfae36b3335234bcbeb58812851222cfaa636243823b3cc0aa504ee1215abf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674847, "uuid": "c94ad521-1669-4f77-b437-688f504a780a", "value": "T13F211400F21A1813E5E13EB073371B50A7B98F03161E5A089F9FE3AAD9BDC305A8D49C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674847, "uuid": "d1b1c58f-b5fe-485d-99b7-1b4e95985f1d", "value": "24:3KopWS9nSWZ6S4/KSwISBd6oTKP5tAFlsFEuqzktqovy5/aaTo0YiTl6VF:wgZVbXGA3Lz2qovy5/lPlKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708674847, "uuid": "5610dd89-1576-422a-a196-d56696155f51", "value": 1400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708674847, "uuid": "0225f2ae-3d60-4279-93ed-9c16822db176", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708674847, "uuid": "504d03cd-8d77-4c1c-890c-976c7201bd96", "value": "957cc6f0ef38420370975b5e992efa9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5add9a6b-d227-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1708677696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677696, "uuid": "6227e8ed-ecba-40d0-82b6-280913468732", "comment": "Malware payload (Mirai)", "value": "10f599de9433d9b4bb1c0cd85ae72def", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677696, "uuid": "684576e9-f393-4877-8618-dde09f11429f", "comment": "Malware payload (Mirai)", "value": "fefd0ffc5aabde1e831f4b26653a72934ea10011c97136e33060be553ce83e29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677696, "uuid": "f66051af-a35a-48ab-b23c-9f662dd40b88", "comment": "Malware payload (Mirai)", "value": "d5222bac5a9883dbbc76b6749432c8962d527e00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708677696, "uuid": "66a53197-df1e-44e2-900b-bbde77733b88", "comment": "Malware payload (Mirai)", "value": "33d941b316d5fd4b011491254da6db4ef1a5d64b44964d90340cca996003892d13b7ae8ed7acf3d6355311c4a78cfecb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677696, "uuid": "bb0378c3-8742-4f70-9bc5-560f7b0c6a80", "value": "T18CA37DC5FB43E4F6E85305B12037BB368B33E479612AEA82D3746D32AC91511DA1B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677696, "uuid": "ba2470b9-72af-4774-986b-8badd0261e74", "value": "1536:BkN4jxOr3y8Nb5Wc9qzrKC2+8kLH3fZYeelztTfxUCn5S24IoTR:KGjxOr3ZWc9umCWkLH3hYv1FXQAoTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708677696, "uuid": "14b3948b-bbb2-4d2e-a92e-2bf461d30ece", "value": 104108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708677696, "uuid": "45978e50-b48b-4f3a-b096-d02448cc90f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708677696, "uuid": "9a953ffd-a886-4568-bfce-1ac1a53f501a", "value": "10f599de9433d9b4bb1c0cd85ae72def", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14302b99-d258-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1708698623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1708698623, "uuid": "b659c3eb-b0e0-4b14-a935-4fabbcc154df", "comment": "Malware payload", "value": "b2d8b23c380cbde464cbb1091dc52e27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1708698623, "uuid": "6e996a09-5f97-4aad-89fc-ba20c436321f", "comment": "Malware payload", "value": "fff0bef66f317c9c9944d63db9efeda814e897cfe8dc5a1559984a5c05567a2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1708698623, "uuid": "69d75155-6d06-49d7-8ff1-fb3345f73efe", "comment": "Malware payload", "value": "4267dfa4871204f6394631b6abfd861302371cf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1708698623, "uuid": "c75f077c-d0b2-4e89-a392-571835efc558", "comment": "Malware payload", "value": "c91ae45acc2659e8bb9cc1df191e0db4d575644ef9d25a9e632193ffe79213421daa6967f264e7230cf8fda2d21d4d41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1708698623, "uuid": "32b44d5d-a517-44b4-bc82-9a8479d7d3ac", "value": "T1ECC37C2330C4C433E541053AC995CAF25AB6FD3099369AC77B987D99BF317D28B29386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1708698623, "uuid": "dc8e8103-3008-4987-a84e-2d0808b2aa9d", "value": "36346fc1293647cc8c72e71864934e37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1708698623, "uuid": "afbf2358-0bc9-41ad-a90d-8f7d6971a856", "value": "1536:ErdrlMPcGdWdTed7gn2fSsU4mvA3NIDOPoIYBkJVoRq8zU5bRAkPxs:EFctAehnEA3o6v5bRA0xs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1708698623, "uuid": "e6e4a4fd-4a71-4789-8739-6cb59f06b428", "value": 127688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1708698623, "uuid": "16bd91dc-1b71-48b7-a7ce-9eac9f3b56c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1708698623, "uuid": "b1a5c8ed-8f17-448f-9623-091188d730af", "value": "SecuriteInfo.com.BScope.Trojan.Thogs.7321.1746", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }