{ "Event": { "published": true, "date": "2024-04-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-04-12", "timestamp": 1712966582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "135cb2df-8251-4088-bbcf-82d79c4d6301", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db01744a-f8df-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1712935083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935083, "uuid": "fe1c8473-385d-4a06-bd7a-ac58c86ef979", "comment": "Malware payload (STRRAT)", "value": "77b5bec60e8ccde749c522ca55b62f4a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935083, "uuid": "1f073205-8f0b-4355-970d-eb52cd42ca7b", "comment": "Malware payload (STRRAT)", "value": "001b11a9ed658c8504c01726f9b5df3b04caf2ee095396de2e79712674e6dfe0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935083, "uuid": "a554833e-c77b-4479-b54c-81233c26b49e", "comment": "Malware payload (STRRAT)", "value": "399089c4510de6e905190593426436c243f3e692", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935083, "uuid": "e841dea4-798f-4afc-abf6-dd24910ee7dd", "comment": "Malware payload (STRRAT)", "value": "792de19f33bc43eaeac5330369aab771f61df32b645f319f4d01b2c4411b3f2b2f9c05f03fe07c29a7d58d40d2fd66b6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935083, "uuid": "14435994-36cf-47b0-b55a-c9d01c50405a", "value": "T18653F16ABD8BD27AD377A5F24445932B69FC82AD064CF4B60CE1AD83C0175860F0BDC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935083, "uuid": "97a6bd5c-9954-418a-bf00-e4b617116878", "value": "1536:EOVCTmOXlFWlOI7xaiv9WCCC6/YC9icqKBMeGCMQOulVOBXTB2yWv7lv:E2qpVFWx7EiYXeevMQOulVYTB2yWv79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712935083, "uuid": "1541f124-b937-4f68-8dc7-7f98a00b9657", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712935083, "uuid": "35aab532-0c40-4041-8196-55b35ef68624", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935083, "uuid": "5dd1648e-243c-4b5e-8ccd-7e19f5e4db99", "value": "Attachment.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd67b0b-f8e0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712935379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935379, "uuid": "d1975763-b0b4-42aa-aba2-8a7ee82b7587", "comment": "Malware payload", "value": "c4986ab5eb021bd7328af26dc8f38f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935379, "uuid": "762ea0b8-1ccc-43dc-808b-ae84de310ec5", "comment": "Malware payload", "value": "0025fbc3758c396d8953ececc93666af67df93eb71f98c368f4b4197d6b6546e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935379, "uuid": "029e23a9-338c-48d4-84ed-cc0ade6f2008", "comment": "Malware payload", "value": "3f5b3ef58b27d257002cb8c106a559d6574d0eb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935379, "uuid": "e6e2e20e-8d46-4a59-b2ae-1efbe660785d", "comment": "Malware payload", "value": "1ac15f8e6774b940152506a3691d3b52e2d99a6a7cdd5914da3556052b0e033a0d85a44febf3bfdf7be41205c0c210f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935379, "uuid": "3111f269-b47d-42a0-a611-ac7475be1719", "value": "T1FD04B65BBA2611E1C5BAC07895D2722FFCB030A2537067CB6A9597270B72BE4B93D740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935379, "uuid": "e48a0c5b-1ccd-44c6-88ad-133fbf0ceeff", "value": "5720420238e89ade785ce3533b97c8c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935379, "uuid": "625c16a9-cb09-400d-8ec4-b5f24abbae7b", "value": "3072:FG0cvC0U6J3SnC4oBM8zxn0vd9eM4/P4+z1MsVPW:IvNd4a+zI4C1MsVPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712935379, "uuid": "2ead3f85-db24-41b7-952a-45efb87da3c4", "value": 173728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712935379, "uuid": "d8bb559e-f369-48bc-a7dd-f3bba7399ef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935379, "uuid": "084b4acf-83a1-4517-87e4-361804d43fab", "value": "SecuriteInfo.com.Trojan.DownLoad4.15026.1939.24907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec3a82f-f8a9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712911547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911547, "uuid": "3f7df68d-3985-42ee-b7d0-9629383c2039", "comment": "Malware payload (Mirai)", "value": "d808a738394a7e77e9b717361a6cc4eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911547, "uuid": "90c40dc5-8c6b-43fd-8d11-277b08141419", "comment": "Malware payload (Mirai)", "value": "01b83ba1c179bb950283d2be3e16f8df78adc27d8879ed44682ebcc7e35bdd12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911547, "uuid": "beb9a0c8-6487-42ac-a87d-494ec01f467f", "comment": "Malware payload (Mirai)", "value": "18ed39fb220d591247aa880a55af963bd915e55c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911547, "uuid": "466947bf-b66c-4a20-88bc-ec2556f1efae", "comment": "Malware payload (Mirai)", "value": "9b14906a76fd33ed88f0d929dd6c71098cc0fb876727e32a172cdddf27d157b63f63d6982e40ff132ba09f6d0e4e90f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911547, "uuid": "80e59297-9a62-42cd-8f0f-cb6fdbf7900c", "value": "T17E14A71E6E228F7DF669873047B74E209B5922D617E1D680E2ACC5105F2439E681FFBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911547, "uuid": "a050daf2-3211-404a-ba46-07fa13db3f1a", "value": "3072:sseHi0e/tJmWNg3DEiu0R0sjAym3N60DB:sseHirqM53Nll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712911547, "uuid": "c28494a9-5f54-4882-b518-5a1f206e8bdb", "value": 193792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712911547, "uuid": "4b04993d-2ccd-4cea-aa34-7b4f17eed88a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911547, "uuid": "666e4975-266c-4e4b-a2df-5ccc0899c32b", "value": "d808a738394a7e77e9b717361a6cc4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea17e18b-f887-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712897312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712897312, "uuid": "410cdfaf-4856-42b6-87f4-1b143b0ceb41", "comment": "Malware payload", "value": "effe7aa4019ce2c6e59704788ea61446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712897312, "uuid": "81bddc69-775d-4fdf-b4fe-deafcd8a07ca", "comment": "Malware payload", "value": "047bb9d649417b19f3868e06eeac0a2fcde7c5d1221725c428cc8e1353f53fad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712897312, "uuid": "2e170ad7-758d-4741-b104-6b1c89cbd8e9", "comment": "Malware payload", "value": "4d4f482b2b668eb1f2684714296463af8d1e29e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712897312, "uuid": "a7eecc80-115b-4993-bc2c-5ff2149b0685", "comment": "Malware payload", "value": "cb2a39119a03b41ff082925496ad5e294ffd12becfaafa7367514a1b2e75241f152e6d1d89fafcf405bde6cce82e5a18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712897312, "uuid": "ebb207f6-65e8-41ef-bf36-3ec2a1d067d6", "value": "T181A4D021E261FF3DE2620E30ED79DBE016E9B9505A705247635C2B2F1E7C790BA23356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712897312, "uuid": "1518c8b7-0d5b-4b5f-b576-4cd3c0de9935", "value": "e03af4c47837fbfefcd192e4bab71da3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712897312, "uuid": "05b93bc9-1f58-429b-8464-0f8eafb40a18", "value": "6144:OuL05o0A6AQdP9+lLGPinhXQ0Y2q1bmHwVyQH2nUmDtCVpu5yW:lf0zAplLGi+zP1b4w/2nUktCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712897312, "uuid": "f2536e51-6168-4490-acbf-dd05d50fcdbf", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712897312, "uuid": "4f25af1d-d7d1-4b78-8ced-6308c897b7ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712897312, "uuid": "7cd28d92-8118-49fb-9f67-c14829f83386", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bed2c6a-f89b-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712905664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905664, "uuid": "5f542df8-1bbc-475c-93ca-a09d6bae67b2", "comment": "Malware payload (RemcosRAT)", "value": "3313eb87b0bc5e481ca54ff57e080793", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905664, "uuid": "caff901d-1258-45a0-9340-e352e1d610d7", "comment": "Malware payload (RemcosRAT)", "value": "077908df152930e21a6a203c4cdbeb24a51804e68ee10c795f3dd2f494d0ab3d", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905664, "uuid": "be689e75-7a90-480e-991a-360fc155e5ca", "comment": "Malware payload (RemcosRAT)", "value": "c5fc552653fe33c331e78e85f2945f9fed2e9814", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905664, "uuid": "2c54f8d9-55eb-4750-96b8-a695d0d13805", "comment": "Malware payload (RemcosRAT)", "value": "bb4de4fb32ff20fd30c22ecd727e54f67352a56b68c30ab6531e823d85625f081480903c755f9b9ff805a04e0ef4295e", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905664, "uuid": "9546f063-a609-41a5-ba22-d1f3fb0fb1b3", "value": "T147B49E01BAD1C072D57524300D3AF776EAB8BD2028364A7B73D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905664, "uuid": "e28953bc-01cd-4b11-885c-1bbadda42009", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905664, "uuid": "8ee1c415-feb4-4321-ac05-fd2d3229638c", "value": "6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcN15Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDIcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712905664, "uuid": "f6fe94b8-fd47-46fd-9a86-c7d471d098b6", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712905664, "uuid": "6c5fbb42-b0ef-4836-bec0-e84d2861a9f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905664, "uuid": "1f637d07-448d-469e-ad89-04aa56f164df", "value": "1712905659b3a0401165b4de8b51335239e707e45fe13411c0009bb29d5b7455db0cbf4c0a339.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cd1067-f8ac-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712913123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712913123, "uuid": "d95da44a-5953-4c8d-bea5-9e7a10b3538e", "comment": "Malware payload", "value": "f623b91dca5f9eb08c5eba189c61c8c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712913123, "uuid": "67fe3640-e40c-4ad2-a108-d965f929cd89", "comment": "Malware payload", "value": "07c8420481e7f1c8332243b68612c5fc03db49ad03e9b86baa21c9474ce31f51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712913123, "uuid": "b645cbba-0623-4346-a318-202d90643de3", "comment": "Malware payload", "value": "0d480d1c1da2b41762c36c119530e7032273e20c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712913123, "uuid": "37e9fab0-e757-4231-b018-04eb0094a8e7", "comment": "Malware payload", "value": "55a5a5a2ab4f2271dbd4d3255eeaa135eb168c510ce75fd23e4be228e42d8a25eb2b23ce6c873c4f038b1641707aaa24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712913123, "uuid": "9a20eaa4-dbbc-4be1-9065-1b596870cf82", "value": "T1E3E42307665D5EE2D830877539AB39D4C2B239192720EA73CD90A0EE8F337571473EA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712913123, "uuid": "e44e85bf-02f5-4310-9ff0-e6166ff5d3e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712913123, "uuid": "eae2c12a-6fa8-435f-8d6e-2964dfb1694d", "value": "12288:ekvq31eoW8qAMUnuhD1UxCPT3kz47SPOGkC79v390WWvRl3ddJDx1aHBalpo:eeqFbqBUuhREET3kz47SPOGkChf97W7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712913123, "uuid": "3bf91843-d073-4472-b9cb-9b7692412507", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712913123, "uuid": "1812e2fe-d721-4b96-b9c6-f402c97f405a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712913123, "uuid": "8c727d58-0c58-4ee5-b9ad-bc3c9cf7256a", "value": "Swift Message.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98efb046-f8ae-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712913926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712913926, "uuid": "9a69c501-be58-4a71-b08a-1c236f91d4ac", "comment": "Malware payload", "value": "14323a70cdc4cdb5070b05dfde38fed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712913926, "uuid": "a6110e2e-bbfb-49a2-883f-8fd1bfe71036", "comment": "Malware payload", "value": "088f37fc09e69a1294fcc28f526d433f114e966b8c30078a9c718c82caf3790a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712913926, "uuid": "19851b7c-5422-4f83-b702-d786a57ad48b", "comment": "Malware payload", "value": "ebcad0fc7d0167f7370e7c7148a9b262075c4d23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712913926, "uuid": "c6e862e2-fff3-4933-b3aa-631c3bca0f65", "comment": "Malware payload", "value": "e4d902c5ec3fb4c8558c154389a1bb49c4bac349ac6cb9812e7c0ab3fdb3c62e1056a96b622e1d2b9dd3569238d752d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712913926, "uuid": "04aa6e53-e810-4e92-a9c0-21eda4aed7cf", "value": "T13194BFE1AE60B7E9D5220E304959CBE017EDBC109A35965B235CEA1F2E7C3D0C92F716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712913926, "uuid": "3743b807-ffce-448a-8a6c-16f5ed9bd45f", "value": "1b0af0470af4d888c83defee61420444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712913926, "uuid": "8dd1f457-8550-43bc-8b3e-e752a252396c", "value": "6144:lCdWUanBEKclS/bcxnYGPaeIbHhTDhVeKbVd5bIu5yG:nlnBEjo/bAnzUBWKbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712913926, "uuid": "273d7fbd-d4af-4b44-8826-7df05494b7c2", "value": 411136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712913926, "uuid": "419139c7-7707-4504-9a2f-80f67edb8532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712913926, "uuid": "9f5c2e35-08c8-4c3c-ad43-1ab025fbef6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12680c15-f8a9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712911553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911553, "uuid": "b7795b22-c336-4bc8-b0bb-6c04c1850f0f", "comment": "Malware payload (Mirai)", "value": "6c84dd4eeca403a63f5310edbeb75d75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911553, "uuid": "5011ba9d-bf69-4fa2-9774-3acbdb65985d", "comment": "Malware payload (Mirai)", "value": "09050786e1522524ce266487035c9effe27315d8d79b2a7b8195ae77306dca4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911553, "uuid": "c37d65fd-d4d3-4449-9982-eed1365a90c5", "comment": "Malware payload (Mirai)", "value": "234576809b0d8f372b673c2c0ca463fee6604e7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911553, "uuid": "69e5c6ae-347c-44d9-9f56-e691637e19c6", "comment": "Malware payload (Mirai)", "value": "43ab17784e46c065c849086961345b213e7f60ba160c6c7f4efc9b1d279afd299e8a80e70da927633d942449ec8332d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911553, "uuid": "4f2fa5ca-11d9-4b2f-a839-f3961525efc5", "value": "T151F329C7F901DABAF80AE337485309097230F7E145921A3762677A7FED3A19D142BD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911553, "uuid": "65eb6fc9-078f-4170-9c06-9c3bc8797d26", "value": "3072:+6Oe2IMBlxiqj6QeuacWjcW0JcWcBA7u+l7dGXuWRmVdU+L8kEOrO8A+LaO:ZVMBj6QeuacWjcW0JcWcB8u478upLHRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712911553, "uuid": "2bfcd988-5b00-42c0-ad7c-2ca33494c49b", "value": 167368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712911553, "uuid": "5a4e15ea-2d8c-4711-9978-99b047bda7b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911553, "uuid": "bd3916d8-3d8a-4be4-9d79-ac98aa82a6a6", "value": "6c84dd4eeca403a63f5310edbeb75d75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0746db7b-f8e9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712939022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939022, "uuid": "8e9ca9cc-88c4-48e5-be8c-ef5ffd048c96", "comment": "Malware payload", "value": "5dc6cfcade8d04574f4e814fed5fd1db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939022, "uuid": "ab018684-92ee-4121-a574-5e7e2d504c9d", "comment": "Malware payload", "value": "092e2214f73a10a1f046d5b52b66e317e03dc9e6d364bda0221214f97edee08f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939022, "uuid": "65a350d5-29bd-41f3-95f4-d5d1e5037882", "comment": "Malware payload", "value": "ed9ae248df81a0acaff53ab97f68095c107f3b95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939022, "uuid": "90e54f9f-3da1-48f4-8ff8-bf9722ef20d2", "comment": "Malware payload", "value": "90230149cd1b865e417893bd2b4fd41e8fe09abdc27ace0e1d61578ac6602fc07894c58239f04b0032582822d3ebd020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939022, "uuid": "90befe5f-6813-477f-9bd3-786208802cfb", "value": "T173C4C27053E6F20DE1A9163E697E9EE8012EF9DD5717BE1E14C0F3F5A921E402242F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939022, "uuid": "ecb32dda-2d9d-4437-8637-c80a43a112ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939022, "uuid": "fb4d6adf-4b71-4a49-a652-63f53f36cd1b", "value": "3072:zakiQ95oAz8i4a72FD+vmZcpc4g+S+pcbpJVj:uD+acGupsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712939022, "uuid": "6b529b91-e2d7-4237-88d5-3091c4bfb325", "value": 566864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712939022, "uuid": "da4323fb-1d63-4a86-97c5-d5d139a2f26d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939022, "uuid": "dfc4a3c8-06dc-42de-8400-17a8193463b7", "value": "SecuriteInfo.com.FileRepMalware.1286.7375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1558038c-f8a9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712911558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911558, "uuid": "de50c263-ea16-466a-860e-e3f4431c5e6e", "comment": "Malware payload (Mirai)", "value": "8c23456ca11db2f5e06c7fd271402d98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911558, "uuid": "cb6ecb91-6b7e-4fbd-a781-2b2aacf64cab", "comment": "Malware payload (Mirai)", "value": "0a6df3f0038a8ee03124ac6c6b7d408e842e4bdc649b7183c2b8e9d3aa275357", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911558, "uuid": "bb73d84c-3395-4a6d-b4b4-d195285b01b3", "comment": "Malware payload (Mirai)", "value": "2ad1243502a0143bd68eb49f1d0ffc5883280d2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911558, "uuid": "85e32e45-7669-4613-bb71-aa520f1e18d5", "comment": "Malware payload (Mirai)", "value": "3e225af00795461f2cd385e8b23ab6f7c00a38294f276e07fd29523d0febd4157b5834f07406d1b2539de73ebc4df4c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911558, "uuid": "233d0b24-79bf-4258-ae4c-57985cdd25f7", "value": "T107E32A06B31C0A57D1632EF43A3B2BE193EFAEC121E4F640251FBA8991B1E361546DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911558, "uuid": "2f8ebffe-e32d-4471-94d6-f203686460e1", "value": "1536:NhA2X6IkFNwmTccGgSS/Gx3prfwvEHSw7pjGtZZ/kNn/RRAdAWfCHxdfK3dRwyhH:kYGFNPSsGx5rf+d0qgsRw6a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712911558, "uuid": "125e1955-05a5-4077-b4ab-fe70d74bd57d", "value": 144768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712911558, "uuid": "b1150d43-b724-430c-bad8-46a8301e85c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911558, "uuid": "6d4ce41b-c391-4b0a-9769-124f03559697", "value": "8c23456ca11db2f5e06c7fd271402d98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362bebe4-f89e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712906889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906889, "uuid": "1d6534b6-60e5-41bf-9862-49d4be01c713", "comment": "Malware payload", "value": "c009d4d9d319cf4e11aa99b6d57fb433", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906889, "uuid": "4321cdc6-0bb6-4782-9746-95079503250e", "comment": "Malware payload", "value": "0b3d482dd4c05dafe53de7afbef7d8d13a62c687a7e705c212fcfe536ec22d9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906889, "uuid": "6ce91137-d718-4e7a-8976-532c17079214", "comment": "Malware payload", "value": "448d7e0994c44bb56f95e9073891ccd5c6d51a86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906889, "uuid": "cd29362b-72dd-46c1-86c1-776587cb8873", "comment": "Malware payload", "value": "69a503ddf4fbf8476f9c0463461e445f2706c30ccbe6fb186b0ebb74499e0d59b087265049b5f20108defc6f6dd49e63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906889, "uuid": "bfb005b5-c399-4174-920a-43d3971cc4e0", "value": "T12A649E21B3A3B77DF6221E309959CBE059AEBC105A745657E3BC2A2F1D7C3908933352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906889, "uuid": "a3cecc18-d9db-4946-8e8f-52943066077b", "value": "e03af4c47837fbfefcd192e4bab71da3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906889, "uuid": "bc3bd7d0-a798-417c-8362-22ad4ffbdc8f", "value": "3072:W7oggIL3mnqnjGt4RI5BnqV6olpiaRqUQ5iru5y7qQ:W7HgIL3WqjGt4RiRqV6OlqUuku5yW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906889, "uuid": "f715c6aa-5e07-4e88-80c9-403f7a9cf544", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906889, "uuid": "06209ad4-6caa-4aa8-a0a3-1262fcdea86f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906889, "uuid": "d1bb3743-7830-4433-9d36-d2c4805cc5d6", "value": "SecuriteInfo.com.Win32.PWSX-gen.16966.19531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae37eaee-f8cc-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712926847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712926847, "uuid": "3c066e60-3519-48ce-97cd-32d5f2a0f5c5", "comment": "Malware payload", "value": "7072b92b814507bb5fc0564259d93e7b", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712926847, "uuid": "1177878c-3853-4b2d-9862-11b9a2598986", "comment": "Malware payload", "value": "0b7f99aceda6f9f21f8532f33eb2dd1246b9dbe03d181e1cb5be875172452d14", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712926847, "uuid": "3fc8f385-7333-4a70-9c5a-c8a325540e5d", "comment": "Malware payload", "value": "733783ec5fa00113b97ad36fe54a46e2961bc0a8", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712926847, "uuid": "1d0fb8b7-19bc-4f7a-8f90-ad8462aa66d9", "comment": "Malware payload", "value": "6f94b594a43d6b70c7c013d42b3206cbb02a4436f0d7155166729b8843b71302f7a884f843faa0fa85a01b0d6d2f3ad0", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712926847, "uuid": "be2f780e-1920-4f3a-b0fb-0d02a6391e84", "value": "T1CDC42394EE5DECE8430C6B186C2F3B5E0A125A34DC44ACC697597EC6953BF48CA33A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712926847, "uuid": "5d46ff74-823f-4b40-8d57-9be0dc368961", "value": "12288:HAhTHFIll1qmyQbyPSyWFf8E+91i0de71TVswzpQ:HAh7ell1Dy3ayWFfD+S86OwzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712926847, "uuid": "dfe87f52-93cf-4b08-92ce-4d36a176e40b", "value": 547493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712926847, "uuid": "a70c43f7-4ae8-4301-a61a-a58f01e1f761", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712926847, "uuid": "b83dd82c-a9a4-497b-b38a-2a88d652825b", "value": "Quotation -5582400073.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3480461f-f895-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1712903020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903020, "uuid": "23481309-34b8-4463-b4d3-5471046470f3", "comment": "Malware payload (Stealc)", "value": "ccfb983705bcbf73dc6cefea0b56e5ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903020, "uuid": "6aae9241-86ca-4847-86cc-ddd24b608ad4", "comment": "Malware payload (Stealc)", "value": "0c6163c1a6db6f4a867a10341375f10595e2424c6732d47587789e74628aee67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903020, "uuid": "61ca4c7a-8202-4933-a38b-631a59ae54f0", "comment": "Malware payload (Stealc)", "value": "fb52f97aa87ced93358ef270709e41a25c3f75bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903020, "uuid": "eec14ef9-5f61-403e-9848-d499b3229ac6", "comment": "Malware payload (Stealc)", "value": "711061a34ccef35292f9ad81f96cc36325b32800bb2ba8ff99f964939e8280f9b46c76312e7ba0468a22aaed9c0ffd5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903020, "uuid": "07b89c2d-cf7e-44c5-a771-0d173be65af1", "value": "T10CB4E132F6B0B77DE2720E305B94DBE099AD79619570525B235C2A2F2E7C3908E33356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903020, "uuid": "8be1c92a-9603-4b19-97a4-f81165a5a204", "value": "e03af4c47837fbfefcd192e4bab71da3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903020, "uuid": "f51153b0-94ef-478d-9518-10f0da01363e", "value": "6144:NbZyZEbTZbIrFKmyvy5OkZlCrs322zDB0LtKk0h/QTYIZ5Xagskhncx42u5yonl:XYEfZcJIylZcg3Vh0wf/CYOskDZvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712903020, "uuid": "198be2cf-db1d-4845-90f6-4fc58288af2b", "value": 507905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712903020, "uuid": "e55c91eb-52a1-40fb-83d6-ee0664bbfde3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903020, "uuid": "423ed792-5df4-4b08-a16c-7c29b4bb72a1", "value": "ccfb983705bcbf73dc6cefea0b56e5ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3315a20d-f8a2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712908602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712908602, "uuid": "5671b798-7ad3-41f2-939d-e553bd76ec20", "comment": "Malware payload", "value": "b59b49633661c5dd6921da1c65dfa862", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712908602, "uuid": "efb15f4c-2822-4d41-911a-b25774fc5cb5", "comment": "Malware payload", "value": "0dc9afa5a875c051c3dacf9be22239a41bda5c2eb39fb5e69b1e7059e542fe53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712908602, "uuid": "acf8d0b0-6c17-47dc-902d-818716341418", "comment": "Malware payload", "value": "dcab35c0dd14195e4c205d42d2d0e888b3a66c73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712908602, "uuid": "08ec559d-d773-4ec2-bf7e-c2ea3893550a", "comment": "Malware payload", "value": "b93aac92f3b22c02cc84cee59b1d0a237270f9502e721e86a93d3dab31f6f519b0334a6426d688d9d3f1a86c256f0e16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712908602, "uuid": "23fe42b2-fbab-48a4-8f52-40aed3adac59", "value": "T1FBB4F222D361B77DD6271D309969CBE01AAABC61DA705277278C2E2F3D7C780D927312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712908602, "uuid": "cb53bf61-7492-41b0-b9a6-bb7c8bda61c8", "value": "e03af4c47837fbfefcd192e4bab71da3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712908602, "uuid": "6ee9f8f2-e775-4923-96f2-774792946f60", "value": "6144:DyQs5pHvN1W10cBdjRusnpfBOL22g0rza6whsRwrmXFaMHw/ru5yonu:1ypHvbIdjBfECH0k1rmXMbUvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712908602, "uuid": "7618f286-42dd-486f-9991-8b245ffbd23c", "value": 502273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712908602, "uuid": "4cf1c2cd-73a5-4e96-92da-9812f534eed5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712908602, "uuid": "40f9e7f9-1a4d-4806-9aae-ebcec157e97f", "value": "b59b49633661c5dd6921da1c65dfa862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0842122a-f887-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712896933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712896933, "uuid": "53e7c97d-ca4e-4a00-a468-f0039be9025b", "comment": "Malware payload", "value": "024ef907300c33e3584d390e9d3fec70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712896933, "uuid": "20e240d9-34e3-40de-8a10-dd31881f9e45", "comment": "Malware payload", "value": "0f2cbb39c36bd5d513990841423fad0725828a14a18dd7081a4f60f01a4667ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712896933, "uuid": "f32c4ce3-2943-4052-99b0-ffc79d373935", "comment": "Malware payload", "value": "25856cd6e9e2176c98165ad63280aa55c9139ffe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712896933, "uuid": "51da52a2-96ca-4bdb-884f-7d289b1543c1", "comment": "Malware payload", "value": "f4c096b60cc0919794bca150f09765a85ef2818c52c6e0ee269525e40742d229644aaf8ac1a6416ee6f3a797d200930c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712896933, "uuid": "e5817cc2-b11c-4be3-961c-6e375a5ee463", "value": "T1CBA4AE43A2D17C61E63347739E2E86F4766DFDA08F192B6B63098E1F04B80B1D663761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712896933, "uuid": "a1b13e97-53a7-4554-8229-597a047513f6", "value": "1e46e8c21623cfb4cc47c916f50df8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712896933, "uuid": "2be442e2-bd5f-4469-ab6e-1b9f63808092", "value": "6144:AvL7JMV1I5Z43lT+YXWoON3Yv0mCVCUBjoA5CshRUeMDfzjZI+:iJ+I5Z41SSWoONGCVCUBjoyjMnFI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712896933, "uuid": "411ff51b-5fc0-440f-ba1b-25a03a1e916f", "value": 479745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712896933, "uuid": "68f68e4d-040f-48f6-bde0-64e2fb58b1e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712896933, "uuid": "b76172cd-daad-49d8-a0e2-54cf11914a79", "value": "024ef907300c33e3584d390e9d3fec70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab110b6-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712905957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905957, "uuid": "601ce511-2c2f-4b3f-a7b5-6026456a65e3", "comment": "Malware payload", "value": "5cc963a153af9857e9fcf968f4939eae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905957, "uuid": "f07be02d-51b0-4081-a8da-4d08bc86f322", "comment": "Malware payload", "value": "1187ab34c6540bddd7c77ae1e4fec26dfe83afdd068a45f911dbdb8ed8496606", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905957, "uuid": "3ace2941-994c-4359-838a-c19250a7a268", "comment": "Malware payload", "value": "08c252e132fba1538aceeedf1d0ce2b72a448709", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905957, "uuid": "f9f09294-5a5b-47a7-a874-4602bfe2c8c5", "comment": "Malware payload", "value": "665945415c64f282d9d72e2052a61e741bcbdcd7bd4ebb1a1eb534aee481ca91025215ff2e556102786b0078192b7989", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905957, "uuid": "8840805a-b090-4bd6-a05a-f41385f15116", "value": "T180953384117AC97FC67C261933090CF4FA8684DFC941E0FF29A6FAF56458AF22A75472", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905957, "uuid": "9fc6f7d8-ecc2-4a2a-b667-c6738021cb4a", "value": "49152:TbVtMt3fuLjDZlEGn4PqMbflCgkK9hCxhF9K:TqulTn4nflCw/Cx34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712905957, "uuid": "45bc39ec-6dd9-4988-93fc-9c9f2a3aa5bb", "value": 1927372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712905957, "uuid": "9a371ebb-1b8f-4d84-b83c-28b0cb4e96ca", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905957, "uuid": "023c5a12-97dc-42bf-accc-279383c6a202", "value": "1187ab34c6540bddd7c77ae1e4fec26dfe83afdd068a45f911dbdb8ed8496606", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23302d4-f8db-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712933269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933269, "uuid": "0d74efbf-9311-4bb5-9b32-ee0ed56c2797", "comment": "Malware payload", "value": "f74bd736b30d7410f8c0530a5ba50aac", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933269, "uuid": "805d88da-e1aa-4825-aace-5e6956c4337c", "comment": "Malware payload", "value": "128575c6be5a5ebdb89b30a040a095d89b052c1e343cc3cb5e8387e85d2163bf", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933269, "uuid": "bcb48bcf-152d-48ad-bc4a-b1bd0b93261d", "comment": "Malware payload", "value": "5bf3623518e5860de594762fa5d9845e4f6c2881", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933269, "uuid": "e5345e68-15b3-4e46-bf05-e9f511c4792e", "comment": "Malware payload", "value": "12d766f81cd3d84812168c9473a58cdf32a72cf97a2779f0f04d3b0fd2e44c9843a050b016364939d64b40ab2c11a74b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712933269, "uuid": "61bdb4c4-f43b-45f3-bd62-cc4b56bd4771", "value": "T1E0C08CCC14D350B045A07C2D08CC1800C80B828C50A83050F26434E68FF1C700895D8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712933269, "uuid": "cead677b-495d-4fb1-ba8b-224c9232558f", "value": "3:uwwB3IlQGuYiTO1T9tdHB150cFjf9tzITP0dIJT3PKbIxt6n:ud3IltiTQPFTqCjPkBR3mIr6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712933269, "uuid": "907f46c1-c2d1-4039-b168-1d7244844d18", "value": 149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712933269, "uuid": "7ffdf51e-b82b-4e98-a291-125362393a09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712933269, "uuid": "5c3db4bc-9749-456f-b37c-7af04fbcc965", "value": "VVr5Eoo84.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8caa3db1-f8e0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712935381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935381, "uuid": "61770c8d-ab84-4ea7-964c-9a3680d5da49", "comment": "Malware payload", "value": "33647482b74e46e6735434d6e507bbbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935381, "uuid": "07b8ac75-c2df-4f9a-abda-6d052f8b6416", "comment": "Malware payload", "value": "12903e43e1a386c0148719bb6fbee1cb590238bdaabe591c88b9b543f429d1c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935381, "uuid": "93eab8af-419f-4c23-975e-4dcb76587f43", "comment": "Malware payload", "value": "851d572226f80a3f0c195b80dcd282ee0355d2b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935381, "uuid": "b4fbe47d-79c3-4070-890f-300e092459ff", "comment": "Malware payload", "value": "8ed070b080c59f2a0adaa6e3273eaf9832e52161041e55a2568cdf922961bb4583f64fc1126125f34c63611f7e6f01b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935381, "uuid": "820e88c4-8481-4854-b241-67951c8dbae2", "value": "T1D1D5BF21B981C037E9A300718ABE5BB99578AF30072454DB63D07E6D9F35AD1BA3173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935381, "uuid": "66fd3ae7-760c-4e7d-9f72-1395eb88bba4", "value": "28547ff913ddcb2844452a40fef04b12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935381, "uuid": "ea177b2d-ce8a-4110-a893-2f00957f6f4a", "value": "49152:dOXHR+VZInyyWWoSF69SKCLZjf5rutv987ENH5X3ngbrnL5yzpVM6:oXH8VZ/yboSF69SfZjlOjH5X3ng8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712935381, "uuid": "613b1427-5b7f-4e13-a44f-bfb027c2e8eb", "value": 3017504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712935381, "uuid": "a1eb7a7e-7634-49f6-a64e-822838b99979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935381, "uuid": "91769941-915d-4632-814f-0612ace2acca", "value": "SecuriteInfo.com.Win32.MalwareX-gen.8794.16509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f006569-f8a4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712909507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712909507, "uuid": "61b1651c-6687-4a3f-ae97-afd2988130e9", "comment": "Malware payload (AgentTesla)", "value": "2fb52edad5c6cc33b3026c356519e834", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712909507, "uuid": "12a1149a-0a5b-4f83-aa1b-6d20994ea22e", "comment": "Malware payload (AgentTesla)", "value": "17b618d190771925404e47f7a84ff19852d7cc2b6743d4b958fe8cbeed7d2d7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712909507, "uuid": "b817f224-7c2e-4ebd-9ff9-54e639d18154", "comment": "Malware payload (AgentTesla)", "value": "32e72db71edc888a552e1bf22bde52faf76b55a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712909507, "uuid": "c900da81-59bd-4b71-8a60-0ce97f234631", "comment": "Malware payload (AgentTesla)", "value": "a9c03cd297ac03efa0692ffda57e3482f739ed070b3284a545c0c62e8ccf91563015172ecb85ff5a720bd0a2667b3082", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712909507, "uuid": "49e5a58c-c961-4bf3-bca4-ed007a33f2a5", "value": "T1C4D423833D4D232EFF2A9F791A172A4543FA933A18A5D21D9C463ACB5D267C18492F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712909507, "uuid": "3ce3c049-804f-408e-834d-846258fb88c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712909507, "uuid": "9480f112-d025-4baa-a1e9-eaead6b7b45b", "value": "12288:/kvq31eoWK6gQk93vS5LZhnkVUzcFB640biAaImB99Fml:/eqFxQk98LGVXqmBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712909507, "uuid": "903d056b-581e-4002-bb4e-6946e60ee830", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712909507, "uuid": "65636a26-f4c1-4b24-bb9c-7dcf21a0aee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712909507, "uuid": "f260056f-9443-42c7-8148-a2b74f261692", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1d7b52-f897-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712903864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903864, "uuid": "7615989f-69b9-43c9-bd5c-15305afea200", "comment": "Malware payload (AgentTesla)", "value": "fb6aa45d9686c7449162148150166695", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903864, "uuid": "2f99815e-4178-4178-91cd-34a5c7c75bfc", "comment": "Malware payload (AgentTesla)", "value": "18f2d604285e3f9987eb47ae56cda190d11ae271a5ac05f0413b2c988ae241e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903864, "uuid": "48b4cd0b-7fe9-4586-b1c3-e22684eab9e9", "comment": "Malware payload (AgentTesla)", "value": "3e916e836f807b3f1d8991e96455e8151e20fd85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903864, "uuid": "67c5e955-5c21-46d2-9457-e02198c33dc7", "comment": "Malware payload (AgentTesla)", "value": "aa04f2ba424bb68aa6880ebd5615c61f3dd79dbc875341bd0b41a9c26a119504fced6cf3f36c805e52e258bdc0b5258e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903864, "uuid": "5c19ee2a-ed78-4f6e-9f66-209b9aac7abd", "value": "T199E423437BD7E182C2882E3596D362042771BB46BA23C3AD794F569D0F823F25F95D88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903864, "uuid": "7a280fa0-22cc-4268-9319-e41183a22eb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903864, "uuid": "4577b913-8c10-4ba1-ab82-766f9ba03efc", "value": "12288:sylkvq31eoWRwRutme4ANa+KuHb/xhaPTEd3+PTKHzCpCEqgcsupvbdaSkR:syleqFYwsfNa+T/+PEIT2iCEq3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712903864, "uuid": "b0217247-5e99-4fab-aae7-c9e1a585b7f1", "value": 693768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712903864, "uuid": "bdd94006-76c0-4524-8142-84946a022003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903864, "uuid": "357352cf-d712-49ff-a6bc-92d12e616e0c", "value": "PO_12042024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b19adc-f90a-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712953247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712953247, "uuid": "aab4478f-618c-40a9-bb25-28ce1c219645", "comment": "Malware payload (RemcosRAT)", "value": "869031d5e7abc377ebe084c375ffdf1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712953247, "uuid": "563a9ecf-2bd2-4af7-b73f-7eb744288941", "comment": "Malware payload (RemcosRAT)", "value": "19bdd11ed161fdce1a8e1dbbf3edfe4fb5273072101e711ee371bc0420afd7e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712953247, "uuid": "810afdcb-5bca-4a92-92a8-de4507ff5391", "comment": "Malware payload (RemcosRAT)", "value": "89c16a7d8f1b95c4c0a72d7407f43686c329ec9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712953247, "uuid": "a0806b7f-a966-4ebe-9493-90d626f95d16", "comment": "Malware payload (RemcosRAT)", "value": "03836fe55452192bda65a389441516b7830b3e39fe5718907f6e7dcf448113e06b2053d6d4d7a24f15765325c35472e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712953247, "uuid": "e23dda6e-9b93-4891-864a-ce1ea36a631b", "value": "T1D114228E964870F4C23A17F574F1635E021571E75596ABE2FED10B1F1802162EC4F6BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712953247, "uuid": "3d5332c1-2af4-46e7-8a19-bd6abfec9478", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712953247, "uuid": "5426c389-7cc2-4b16-980b-daa3a8b8473a", "value": "6144:1OSGpTE6C8JaksU4gcet422dSnVE492l9:kSMEfUaMce+22YnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712953247, "uuid": "bef17f88-536f-4acf-82c9-9c946de06763", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712953247, "uuid": "e470ae43-ae98-43b7-835a-59ee9b13f920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712953247, "uuid": "7982213d-de03-4722-b3f9-c56d06b670cb", "value": "SecuriteInfo.com.Trojan.Siggen18.57193.22047.5711", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effcde8b-f89b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712905912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905912, "uuid": "a585d649-8e4f-461c-9003-70aa9ebf76c5", "comment": "Malware payload (AgentTesla)", "value": "6c9188a7d58b205eab311602cf22fcfb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905912, "uuid": "72300a4f-6335-42f6-8ba2-948401e30b51", "comment": "Malware payload (AgentTesla)", "value": "1c92d3868a5a6d2f87a8c0308ff37d329911dd4c43b5fbd654a69773ca6fbbbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905912, "uuid": "f7ebd8a9-932b-4d49-85d3-5d27bdc260d5", "comment": "Malware payload (AgentTesla)", "value": "eebb40179068b595819707b11cf56daedcb33752", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905912, "uuid": "ce98170c-8360-498f-ad90-e054391d99b0", "comment": "Malware payload (AgentTesla)", "value": "dcfe72584d2ce007126d92cc94f9453d53778fbd27b487c254f0d839a0c93c58f1db75f449d2ca85c7cfebc9dbe1b48a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905912, "uuid": "8dd5e277-6f7e-430f-b263-43c8c1618031", "value": "T147C48C85EA8426A1DD18AB716636CD3552237DFDA874E42C28DE3D6B3BFB3D71022053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905912, "uuid": "91776df5-75b8-4b99-aa3c-bf1c6f47d1c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905912, "uuid": "64605854-6eae-4f69-a6c0-80ff1104aecf", "value": "12288:1tWtU3ntVmP6KKHP7r9r/+ppppppppppppppppppppppppppppp0G:1tWStwPNY1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712905912, "uuid": "10d69be6-8033-49b1-9c39-a92cf30e922f", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712905912, "uuid": "28e039e7-63c6-489a-b2bd-f96668bc0bff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905912, "uuid": "fb310192-f49f-4afe-a31a-ea0e8773f607", "value": "Swift_copy.pdf (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e071218a-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712906315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906315, "uuid": "2021bb80-ecf3-40bf-9c08-d897bca57f7c", "comment": "Malware payload (Gafgyt)", "value": "735e467fb13e6245bf8a767d1e71bdad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906315, "uuid": "52698578-95eb-4f17-ba8f-c38064f805b6", "comment": "Malware payload (Gafgyt)", "value": "1da92fbd1215695a94dc09f9d2654433f699441bb1b600275e01099f276069ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906315, "uuid": "be1f845c-cb9a-454e-b33c-ea2de7366c8e", "comment": "Malware payload (Gafgyt)", "value": "b080a2ca3e43dfdfedd1691a153f8b1907464c88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906315, "uuid": "3b4a3439-b497-45cf-99d1-d2555499c7c9", "comment": "Malware payload (Gafgyt)", "value": "0f6037b6d8b3a1d1b7e8f1fcbb68aba2f543a821d2746ddee0b48edea37ee40793ce8b9a96f526aa7f2c49c0a68b7978", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906315, "uuid": "eaff6197-bd58-40e5-bac1-6ef1063838f9", "value": "T11C042934D6504B17C1D223BAA69B424E3F234F97A3D733095638BBB03FE279A0D62915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906315, "uuid": "0558b661-2a37-4e76-afb8-0d6b3ebd69a4", "value": "3072:6PC+RjGkWa6s/qSPeAjQM6PBt9kbPtMAV7sAfymUwwFB7DXNu:61fWa6s/qSGAYPBbkbPtMAV7sAfymUwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906315, "uuid": "f6ce8a57-89b7-4e49-8328-d37992b74230", "value": 181882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906315, "uuid": "5bd936d9-f768-403d-a342-5f4f77f73028", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906315, "uuid": "5642c9a7-5197-4c04-ac4f-6ca19559257f", "value": "735e467fb13e6245bf8a767d1e71bdad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2855a2-f8d9-11ee-a120-42010a9c002e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1712932185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712932185, "uuid": "ff4f809d-8587-4ca6-a82d-f8bcb379c41e", "comment": "Malware payload (RaccoonStealer)", "value": "d0fa79fc637c5916da8d7c2f07948933", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712932185, "uuid": "139ac586-42df-4b71-bbfa-c554dcd1d24a", "comment": "Malware payload (RaccoonStealer)", "value": "1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712932185, "uuid": "8ed73998-25ea-4bdd-8647-c883b232b5d9", "comment": "Malware payload (RaccoonStealer)", "value": "d4fb639fe811739c4adf2e62b5df1f8c9ab35c75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712932185, "uuid": "0c003941-3115-4d98-bdf8-037a25a2c08f", "comment": "Malware payload (RaccoonStealer)", "value": "272cdc6a19ff86697c381c6a60d559b5107ed88ae1656803996a26d37def6746aa9f05611df502fea2fa52802f7954a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712932185, "uuid": "f9ef202b-4d5d-4584-97e8-0cfc194448d0", "value": "T14E930211E33D8035EE3546B59C039FCB12E9E07480A7215FEA636AB6CF56366D81BF81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712932185, "uuid": "143ba894-e1ef-423f-bd6c-18ca89e76d26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712932185, "uuid": "d91ea4e4-f448-4e2d-9f74-a2ea3ce1b554", "value": "1536:2PX4YBLPitzZgglqlwEmnFN+br133phXZ4gDjyAKrsTBLviJYPx5OSbDU9oBdh02:ZzZggAlwEAAbryXsTBTiJYPx5OSbEoBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712932185, "uuid": "274d7d6f-31c1-4ca7-827a-81644dac7774", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712932185, "uuid": "435d140c-931b-4f51-9afa-34d1e0c19385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712932185, "uuid": "d961a61c-c28d-4bd9-b463-f7a35d459ed4", "value": "SecuriteInfo.com.Variant.Lazy.509335.4668.31067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0778362-f8bf-11ee-a120-42010a9c002e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1712921294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712921294, "uuid": "d5020110-2edd-4951-b19e-46e589406fa6", "comment": "Malware payload (PrivateLoader)", "value": "e636b1cca5d4a405df0f618b73c2df0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712921294, "uuid": "5d63de09-7db2-4493-9e39-5b11099b1850", "comment": "Malware payload (PrivateLoader)", "value": "1e1db7c0d0c0e06f59ea26fc0e74c240873594c7c590fd9f3e4f34ecb1408213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712921294, "uuid": "0a98068d-8af6-4e42-b007-77a7b6ea529f", "comment": "Malware payload (PrivateLoader)", "value": "7f5e0a87ef7952693e454fdd4e303d292fe4397f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712921294, "uuid": "55125222-3453-4861-b308-39960b040c9d", "comment": "Malware payload (PrivateLoader)", "value": "8f8b86fa1f1f02afe7062b178dc4be35db5db341d01892a3d3599c2763f8993462e1aa7593d73668cff2dc26bff5568b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712921294, "uuid": "82518c3c-3b08-4361-88ca-cfbab1116b10", "value": "T10B16126B678633F4C20DC7B465766A7C3176F3894C962A016399DA103D6F3692E3B30E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712921294, "uuid": "ef12c0c2-aee3-4fe1-a6c2-f8fe7f9ec746", "value": "023aae353653db016d3a89da454d1d86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712921294, "uuid": "d9758268-a44b-4f89-8c9a-aa02cf034ab5", "value": "98304:h4zguqIX/Z8E5wzOxkAAHmY8obinW9GkQlGpBjpqhXHphaRR:h4zguZX6EaOKAAL8w8W9XrjYh3phaRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712921294, "uuid": "63a1f4e5-2169-48ae-a52c-ce767bf16076", "value": 4284224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712921294, "uuid": "0345a4ee-a7ce-4ecc-9f0b-0f39b8e056b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712921294, "uuid": "6b2c8c24-c2f8-4ee9-9305-a9d734a0c622", "value": "SecuriteInfo.com.Win64.Evo-gen.28136.30716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd90bc6-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712906336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906336, "uuid": "25ee52e8-b128-432d-8c25-936d84ce7ee8", "comment": "Malware payload (Gafgyt)", "value": "34b05aa3f53ab66527aeec04e0502ff5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906336, "uuid": "896b3118-7499-4986-b261-ab82cbad7019", "comment": "Malware payload (Gafgyt)", "value": "1ef92929fa8dbf320b80ad7668184b3db41e45116f76f1738b8af866efe55d70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906336, "uuid": "160b08c8-7a41-4efd-9caa-5dcee832fc28", "comment": "Malware payload (Gafgyt)", "value": "8f150f2da10e644cb1b472a3af728f1f72c4cf9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906336, "uuid": "39f2f29d-e4f6-4b5b-a23e-73313f96f4de", "comment": "Malware payload (Gafgyt)", "value": "39caef0af9eb78d01a77bb57aef9a9e6a7e7dffbc034b3b6a91de2e789b3c1c2659b18f31090cd5d77c0e20fdaf69e54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906336, "uuid": "7bdd1c30-00fe-4e09-bd6c-ddef46052573", "value": "T15FB32B75D212C5B3C4830AF201A7DA3B0D21FEA7077A5A45E32D3EB0AE334C97595B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906336, "uuid": "3874a111-1d3d-4bb0-8145-d3cc80424be6", "value": "3072:SAozJEjhWNDQDECgQcmtdhHvWWImFK0AYF+ku:aVEjhWN0wahHODmFK0AYF+ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906336, "uuid": "b2d1c1ec-339b-4113-b672-d7cb57550a0b", "value": 114469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906336, "uuid": "ea36c637-30b6-44d8-8397-bf9e1dd42373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906336, "uuid": "1f6a5f15-dfaf-4e72-9464-77dd504c5092", "value": "34b05aa3f53ab66527aeec04e0502ff5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88449acf-f861-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712880827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712880827, "uuid": "97b28f74-7722-4bd2-93c9-557adce65ea0", "comment": "Malware payload", "value": "d7e83292ed8eaaca4d713c84c3a83f96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712880827, "uuid": "3bf059f8-544c-4ca4-adab-1b85b4c55058", "comment": "Malware payload", "value": "1fd70528c5bb9d946fc297d324ecaa7a949b4f2239d8765a5164180b40df9aec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712880827, "uuid": "04d1af19-52c0-4128-a337-9cb3e8a6ec1f", "comment": "Malware payload", "value": "f899310a3ec94999ea62008909d3ab21942e648c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712880827, "uuid": "da3adc58-af12-457f-8304-46ab361089d6", "comment": "Malware payload", "value": "83ac730613a9a7779754a1567e4b6c2fe18a0019e0bc1ce31d30b429e861509b364576aca936fcd7c98b9d8000c1339a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712880827, "uuid": "4714f6a9-e4b4-4c61-8352-66216c9fa884", "value": "T1548401037AB28652C44C18B0D9E71C2913F5A7873673E78A7A88518B8F433C59E897DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712880827, "uuid": "6d6a2afd-8236-422c-a35f-4155c508d80b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712880827, "uuid": "473bd56e-a1dd-472f-b0f4-cdf61d08fdcf", "value": "12288:MSfAtuDaQtlcGMW/SIKZKIbBHOlf8yKiRJv:/rcnCSIKZFbZOT1RJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712880827, "uuid": "ec40e5cb-912c-41ec-84c5-9278289369dd", "value": 406152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712880827, "uuid": "2a3adb3b-9fc4-4167-91d0-04f79376180b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712880827, "uuid": "11a9408c-6f52-4de7-aae5-12ca1e17ca9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7581f223-f8b1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712915155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915155, "uuid": "763880de-2650-406f-b55b-04239084f6f3", "comment": "Malware payload", "value": "169a91b888d98c8ef67c2d8dd5001950", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915155, "uuid": "5f54eefa-8f22-4fdf-9cd3-db0b45997be8", "comment": "Malware payload", "value": "205ba28bab34053be3bb4798a4f950839a1c8a6519787c92fbb0db8d1c3ce83c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915155, "uuid": "e96e65eb-72e2-459c-b21e-28806fc008ea", "comment": "Malware payload", "value": "9beb86e0cbfd75043338d2e6ee3bd20e2c1d1aac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915155, "uuid": "6adbe458-193f-40ee-ae06-ea7e89175e46", "comment": "Malware payload", "value": "17d2df73c05beaf39823cfbe64491dd827aace8786343b855ff4e157a6829aa86a8818bfb22e3d7ed7ebe9440833bb3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915155, "uuid": "591817b2-0da3-4af8-b317-06a763c27dc1", "value": "T101649E21E360BB3DDA520E30997BCBE45A6E7D505A7C5277235C2A2F197C3918A33336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915155, "uuid": "fd6cb108-5ae6-4a41-af6c-02f78e9213b7", "value": "e03af4c47837fbfefcd192e4bab71da3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915155, "uuid": "20eab40f-2664-427a-b804-36b24b0699ab", "value": "3072:bakhuX2GiwpKe3u+o0HEN5YcSarFnIx4b81FCgsu5y7qQ:bamuX2GVpZo0HEHZSarxr6psu5yW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712915155, "uuid": "059cc737-b105-4343-9380-0d58b9d61b15", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712915155, "uuid": "f00d5984-1d6e-47cc-963c-6bffb85c9aa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915155, "uuid": "f1994b9a-2c1f-4c41-8a42-3cd74eaba65b", "value": "SecuriteInfo.com.Win32.BotX-gen.23345.1691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a53447-f8f9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712945977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712945977, "uuid": "cce1be68-722d-4c06-8d6c-eaa6a0f12821", "comment": "Malware payload", "value": "ad3f383772f6724130fb989719529418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712945977, "uuid": "53c29ba8-2eea-4270-9f51-ea65abf99209", "comment": "Malware payload", "value": "214262bca02d40e14df803ae7ae69d840a4cac16a324366488d3c3df078de291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712945977, "uuid": "be52e3b2-d937-4004-af21-f906611a96f0", "comment": "Malware payload", "value": "b3b3a3f27fcd65c824e29d5ba1b9bbf8286d12b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712945977, "uuid": "d6691fbf-a826-4868-83f1-2eff8f4424d0", "comment": "Malware payload", "value": "fbe742b273daea1a52651292198bd754bd496e3797c332cf6d91be9125404ff6c1c8879234c557b7aafff83793d4d294", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712945977, "uuid": "bfb47bc6-2fe1-47c2-856a-8fe5addb771d", "value": "T16B251212F293A87FCE671970996EC3F53B5E7C52CA64724B6354363F2E30A80A953361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712945977, "uuid": "c3b7f4a3-7604-463a-835a-d89aa1ee1e21", "value": "2ecca6bf335e6e46e2c654a4a04282e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712945977, "uuid": "588ca6ed-9acd-4dc6-9214-07a71c2e3a4d", "value": "12288:Lv/l4gTPcrUUTIR+lq0BTItlceh5FwXhBpMooFSZ1d88IscsJftqJzmrBf:L17TBXeNcyAF20CzIs3JftgmrBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712945977, "uuid": "e5ab8e21-de2d-4006-976e-1a62358a415f", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712945977, "uuid": "a226d629-9d9c-4101-b2a7-731f69521274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712945977, "uuid": "eeed2060-ebc9-497d-b853-3c060e4df468", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4991eaf-f894-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712902886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902886, "uuid": "d0ffa9fe-e4b8-47ec-85bf-8fe5a309ecfd", "comment": "Malware payload (CoinMiner)", "value": "134c377b4788068041a3a7f1989ec6b0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902886, "uuid": "ce268c7b-205b-45e7-a200-0ffbdbed0eae", "comment": "Malware payload (CoinMiner)", "value": "2252872955020d53a56a270bda711a79e43c026d5c5c4efc14b42d7bb7ff1156", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902886, "uuid": "09c11237-956d-4749-8939-8da6ba847da0", "comment": "Malware payload (CoinMiner)", "value": "36d8921d81c70704b23cff4a44571dc1486c471e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902886, "uuid": "97549b47-2c33-4515-97c8-c3bb35b742ec", "comment": "Malware payload (CoinMiner)", "value": "dfcabc3767e06646a0f4e73617161abe8f2092ab00ddfb5ea603105e28e3ad737a6aef4b458340be4d4cb1866fda0ad3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902886, "uuid": "ee67f0f3-c32b-40e6-b25b-b93df8bd6f6d", "value": "T1BA754D98FA87A0F4DA630DB4518BE73FDA301E054028FBB7DF89DB48E473B5A9209155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902886, "uuid": "1f35f964-ed19-4298-be92-8c39612e2d94", "value": "dd22ec7cf34e40585958967cdce32c9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902886, "uuid": "85274769-927f-4eaf-8f03-112f92af7460", "value": "24576:PxXTADYDZL89t68/kGhluhQkibRRcJ9ltZa9AHjnLwPln5u5h4uhH3eDIOIu4+Wo:PxDD9i68/kuRRcJ9ltrLwPlmhxOwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712902886, "uuid": "58d59822-fdbe-401b-8701-dfe7f7fd4d14", "value": 1565184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712902886, "uuid": "0a2c1e99-e84b-45a1-b688-a0570eccc095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902886, "uuid": "1438c25b-0f98-4491-b304-e36ef7588b3b", "value": "2252872955020d53a56a270bda711a79e43c026d5c5c4efc14b42d7bb7ff1156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe02066c-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712906365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906365, "uuid": "06cdd934-356c-467a-870f-c37b80259663", "comment": "Malware payload (Mirai)", "value": "ad9717b27c386e9d7361f09539c94e32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906365, "uuid": "9ea8b357-cad3-43ab-b475-b4717f14f62a", "comment": "Malware payload (Mirai)", "value": "225ff7e13a72eaab45315bc5b084296fc168646c62b0cdb2ffd8169d1d0e5413", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906365, "uuid": "77331d13-a2bb-47f4-978d-478e548ecff6", "comment": "Malware payload (Mirai)", "value": "078f020763843eb197fbced7ebf4b958cdf3d47f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906365, "uuid": "55a2da7e-bd68-432c-9931-a9859241349a", "comment": "Malware payload (Mirai)", "value": "38b5569e2d0e4e85db7998f34c351e914b6303275f3ecb149d64d13bac7f28d3c4a5ab7d086f6c70d454a6829ddddf00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906365, "uuid": "1b94be03-3ab8-4045-8bfa-dbe7ec48321e", "value": "T19AC32A3790604EB3C0429AF525BB99710F126C930B5B1A94623D77F44B7B9CEB88EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906365, "uuid": "fb22661b-ea9e-495d-b56b-3c8920eaf60c", "value": "1536:vuaMiqPJYdiVg7qwXo/wKg3otPas2edRKHofPVAGvmic092cwDNm:vujx9VEX1Kg4ps09AsmN09XwDNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906365, "uuid": "d0ba1a3a-4bc9-4715-bc16-8af6a132c2c9", "value": 128636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906365, "uuid": "32c6f14a-6ffa-49fa-a74f-271e75e83add", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906365, "uuid": "30530166-3303-4f6a-9624-3f2baf1299cb", "value": "ad9717b27c386e9d7361f09539c94e32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86a8b2b-f8f3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712943614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712943614, "uuid": "f4ddbffc-ce30-40fb-9985-3ea61f9cf18b", "comment": "Malware payload", "value": "898c243ad0e16448d1d9c3a88b4b6e0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712943614, "uuid": "88e11ea2-484f-4d8f-9087-04f6a34e9424", "comment": "Malware payload", "value": "237d663dcb7a045cd78cd15313cf67a298b5c47de7205124b228f0378f1a8766", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712943614, "uuid": "907fe4c6-a797-4e91-b4e1-6525a98c4c94", "comment": "Malware payload", "value": "0897c13b2b192e7f910ae49fff1c291462c1545d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712943614, "uuid": "2e3f3dee-58ce-43c5-a9b0-e68722cc6149", "comment": "Malware payload", "value": "08e62a482fe2a4a1cdbf951333ca6de4a67d939780527994a633d975f707eaca09cdb56fb85bc35a6c288258c70d4a33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712943614, "uuid": "7ae5b101-4909-4b2e-899a-1445241a586a", "value": "T1E1C69D0677D44BAAC46B85388ADB8205F3B1FC45475657DB33B432292F733E04A7BAA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712943614, "uuid": "bec6463b-3414-477a-91f7-b3fce2b1c014", "value": "ca93b28c68a401a2ad5b2e192c7fbd9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712943614, "uuid": "06cb1fcc-cd59-480c-b30c-ec4038b0d6e6", "value": "98304:lxEu4LkMXVDEzYiWhc19oC+gIsgOtqB3m1RC3:3EuuiWhc1p+gO3aRC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712943614, "uuid": "f7a63ceb-23f4-49ee-9053-c4fa66ac591d", "value": 12028832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712943614, "uuid": "6197d14c-c1d7-4238-97b4-26e6a5fd4f03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712943614, "uuid": "c95c2076-5bd0-48cc-8eda-61b5b4be265e", "value": "237d663dcb7a045cd78cd15313cf67a298b5c47de7205124b228f0378f1a8766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd1f266-f8d3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712929905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712929905, "uuid": "034333fe-1208-47f3-92da-7729400f351a", "comment": "Malware payload", "value": "9e7854a806e9af5936419d4a4afb3f5c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712929905, "uuid": "0ffb11e7-3c8c-4a31-8929-35558d460036", "comment": "Malware payload", "value": "2408eeb6a9a16c9ed287472aa76a80d9266fb9b55703cb3eb087d95af35b88b8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712929905, "uuid": "6bb2d65d-0d59-4700-8775-d7346192dbeb", "comment": "Malware payload", "value": "f7dea10f5ba796142691da90ed097a29cb4997ee", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712929905, "uuid": "d9b88c03-aac7-4888-825f-082c3c099706", "comment": "Malware payload", "value": "9fdd43ac75ab0f3492af2034a39f082ab82ed32f550618242876bd6f7e1c9d10160b50f8abe6e09720065cd4a4c413e2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712929905, "uuid": "db425d55-610b-4413-9d72-4b755ab01e99", "value": "T1A79422814DA31F2DC99C428FF52D5A4F3DAA9AC8F4C290562332715B07DDB2CA6CF468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712929905, "uuid": "b7071402-b1dc-4e63-8593-d0fa0647498a", "value": "6144:K8prQWabUPRd7G5w8jBKw0UGbwPEbcLbxM2eaAlj3N/YNRBk94SGMBVcbxQAwV7X:d5eUfiTBKw1/PC2kljdgNrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712929905, "uuid": "a65038c0-98ba-42bd-a457-40340e8d4912", "value": 424654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712929905, "uuid": "52ce8cad-d805-4592-bbac-e3dbba18824e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712929905, "uuid": "d78b2edd-2ac7-4c60-be24-326a3e9a2c8e", "value": "April_2024_discount_Voucher-Unique-d-File.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b83ba3c-f8c9-11ee-a120-42010a9c002e", "comment": "Malware payload (RustyStealer)", "timestamp": 1712925420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712925420, "uuid": "0d10d218-fc09-47fc-96a3-1ac4bbbb72b9", "comment": "Malware payload (RustyStealer)", "value": "cbd28dd5f9bdb848926726b172124751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Karius", "colour": "#010C06", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712925420, "uuid": "618184cf-7eff-455b-ab1b-e71cdfc3d606", "comment": "Malware payload (RustyStealer)", "value": "275be7d414498ed841232cee005cb97dfc1c22977b841b72d674959629d5ce02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Karius", "colour": "#010C06", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712925420, "uuid": "4676589c-6c50-4ee2-a845-c55044ad077f", "comment": "Malware payload (RustyStealer)", "value": "2854cf38e373a60a14927422c5a9de242695ce5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Karius", "colour": "#010C06", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712925420, "uuid": "54cf2d93-72a8-4b21-aed2-8b900457cfe0", "comment": "Malware payload (RustyStealer)", "value": "898f92a2cff627737a56e3b46cd088a1dfd8e61c005165456212c562e2987533f9a36d44457c57a22cc944df23f8201a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Karius", "colour": "#010C06", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712925420, "uuid": "f6571857-3e5a-42ea-92ea-de3ee97fe56b", "value": "T120F55B16B69A44ACC09BC07483464A73AA7174CA0B35BAFF45D482793F66EF11F3D368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712925420, "uuid": "c427446b-5205-4bc1-b301-f7f35b3d39b7", "value": "6fe68d69ef96280313858fd1365b5cc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712925420, "uuid": "3eb444dc-989b-4052-8aca-d35dc3ca5319", "value": "49152:9DWX6UQASeBylX01L6FXA3XcNd2rcX9gUKkDg3PsFNBwi4clntJlMKWr/SALAqWy:9uWA+X4cjXki4clntJiKWz7LArcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712925420, "uuid": "a62d0ae8-b9db-4836-8e85-8f6174c332fa", "value": 3339104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712925420, "uuid": "601992b1-6fdd-43c7-a534-cfb135d7d8c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712925420, "uuid": "ceacd5de-6a7f-43d8-90e6-92ae6b990ac2", "value": "CSI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6b2ea1-f8cd-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712927351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712927351, "uuid": "7a280791-f42a-4615-aaac-8ed7d8c6b8bf", "comment": "Malware payload", "value": "7424d7fcc79475442f0e4146ae7f2557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712927351, "uuid": "cd23ba45-b812-47bd-9587-586fd770b992", "comment": "Malware payload", "value": "2d5f180cf4446fba9ae1485ad5086d90f318e73055b2b143425118db61282ce1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712927351, "uuid": "01623663-1e01-4c93-af6f-b11ed1f29411", "comment": "Malware payload", "value": "92bd45c825273f9ce7f5d403a04a212d05a36d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712927351, "uuid": "7de0751e-79c0-43d9-b7b1-897e0894bb5f", "comment": "Malware payload", "value": "60c397e3bdf49d02c4d429725dcd57f092e6b60f38ecace9b58e5767d99c8e018383c7f945ad4ca8c7866d7250ec02f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712927351, "uuid": "2550ef9e-c59d-4351-aa2c-c7433b78729e", "value": "T10C65234AB3B64515D89822B1D5D71CA94BE2E74B35B3C74A3D8810990DDB3C8DB8F6CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712927351, "uuid": "a50890a4-9856-476d-931d-9a28e94205f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712927351, "uuid": "3fb604f5-18f1-4a70-b49e-d3b3fb709ca0", "value": "24576:mo3igeYUdXlWJNbHawHQroHOV2LzXEiw22btTuvdA/NlPzlJsVbIHzvOd:mKJUWJlP2oW2Lz0iwXRTNlPY6HzvOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712927351, "uuid": "b445e569-8331-4e39-a08d-d531472d9caa", "value": 1462920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712927351, "uuid": "a6cb20dc-f5de-4efc-8c90-668e3ad0bceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712927351, "uuid": "2cf02714-593d-43fa-a58e-543a0c96bf54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef7264e-f8b1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712915010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915010, "uuid": "f6dfab56-4f45-4001-aa8b-bac34e429e0b", "comment": "Malware payload", "value": "ca0a7d7bca2b49d9c2469bcc92bca7c3", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915010, "uuid": "39f57584-4e32-4490-bfb7-da8a66a88d65", "comment": "Malware payload", "value": "2f28d047df0a95501b1df736b88eaee22e0be64eb84ef50a4b9f82a413363ce4", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915010, "uuid": "2747f2aa-abd7-418a-bcd9-fea1116d2b92", "comment": "Malware payload", "value": "52357a1b6761fc1d0be1fd01e0226705db83acb1", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915010, "uuid": "4fb0c5eb-a7c9-464c-a62c-c6060aae1865", "comment": "Malware payload", "value": "522a20ca003a0f5951153657605ae388c6bb4a4170a5abaa82bde8672346e0e211a4191b4783a7c18834576435f74611", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915010, "uuid": "f7136bdb-a5f3-4916-99fb-46d4c30e822e", "value": "T19833F1B582A25C78DF83643D1D41A26A7F06F87B65D4E2CB3806FB4843835524B942EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915010, "uuid": "4b103125-5d0b-48a0-b740-e611d468ff99", "value": "1536:4s1eZDHgM8v42wkYq84lKL7IAnA4xCQH1400U:V1eZcMetF8T7IAA4xprn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712915010, "uuid": "3824c961-fbe8-4d31-8ad7-ab47847065c6", "value": 52426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712915010, "uuid": "28797cc6-8530-40b6-894f-fda8f12f197f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915010, "uuid": "1da5d5b1-f406-452a-8209-35fe39e9e15a", "value": "4_10_AC-1337.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53229bcf-f892-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712901783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712901783, "uuid": "db6b92ee-c14e-4a6d-98ed-7383098e9d3d", "comment": "Malware payload", "value": "d90b030742eb38c643a26e05667b2a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712901783, "uuid": "34d5b5fb-1c81-411d-a4c2-1c2c062dfc21", "comment": "Malware payload", "value": "30928d42db76fa3461712b250b5c03d0daddebf03d74e02665a0d530cdba4216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712901783, "uuid": "64eea184-31ac-40c7-8e9f-9592c9b4be8f", "comment": "Malware payload", "value": "89c016061468e3e9f945682340a8dad63ef00715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712901783, "uuid": "653ccc9a-edfe-472b-ae31-b3290f047617", "comment": "Malware payload", "value": "f98679fac5974cc0a0a972774684b79c9dad97dea37677e3ac7b1b31d4325edf1d82d76a9e904facc8221805b50e8db5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712901783, "uuid": "b050eee6-a0f0-4421-82a9-58101ad145c0", "value": "T1610733E1A3A9D9E7D790403AC587CD349B3E79223B50E58FC25012673FBB198AD21E71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712901783, "uuid": "51b2fbb6-08c4-403c-9db6-f4277785aff3", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712901783, "uuid": "3adf0f46-95c4-4756-bef6-4eee6ddb6a18", "value": "393216:5FAlntYXaPiZ1a56gOshouIkP9tRL54+58jIoCv422q:MltYXaPivacBwouZtRL2qwtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712901783, "uuid": "16cb40df-18cc-448a-8e24-b6c2396b53e0", "value": 17422729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712901783, "uuid": "791a3094-5fc1-4cb4-a309-c45748849353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712901783, "uuid": "99820b67-9ee9-456e-9a94-d617519c9a7a", "value": "Valobot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38452254-f89e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712906892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906892, "uuid": "e7a39c6e-8061-4a8c-8b64-659961baaf07", "comment": "Malware payload", "value": "1a900762ce22432313fcb9b3c8c0a08d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906892, "uuid": "44ff9c4e-fe66-44c3-a416-8ad7b88d0acb", "comment": "Malware payload", "value": "31c3b751a335ba8c9143641bef94e3db486ce2570a3d0a3e9a15f7abf35870de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906892, "uuid": "1613f6d4-88f8-4b85-98a6-866a2fbba8be", "comment": "Malware payload", "value": "c08a40483bae3766a38ea993e3f4a5b5f190a65a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906892, "uuid": "32edf603-745a-4e6b-b005-4afd60c25b5f", "comment": "Malware payload", "value": "c594045609b7645864be67c83845d4ee47adbeb730825e63c27aeb1efd03fc42340b2b35aa2e27c359f5cf2f2208e62f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906892, "uuid": "86c1ce49-cfd3-42b7-b7f5-b86443d59fe3", "value": "T197F6333FB2B8A63EC4AA477589B3921099BBBB51645B4C4F07F0080ECF765711E3B619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906892, "uuid": "81481ba2-7cf4-4497-8b9e-63f9401bd0ff", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906892, "uuid": "83be5012-9a7a-4a70-ad11-7a230cf24120", "value": "393216:h060l4R63NrInvyiwv1ZpvVw7qpZy3WU0R7DnuqUMF:h06a4c3myiIZphyWDnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906892, "uuid": "11f3dbc5-a7d7-4ab2-bad6-786064b228b1", "value": 16540352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906892, "uuid": "097d8626-f3d7-4724-9a08-677305cdbab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906892, "uuid": "0599ea54-13d8-470f-a5b1-b65e4e32fa41", "value": "SecuriteInfo.com.FileRepPup.298.1231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b26ef7-f873-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712888555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712888555, "uuid": "80600b07-5e41-4427-9752-a7bcd4a57566", "comment": "Malware payload", "value": "3135f1c77e01d6df92c04083716c5c47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712888555, "uuid": "cb5cbe8c-86db-4999-b736-f5cb447f5cb3", "comment": "Malware payload", "value": "31d9bd4c734cbfa25036a6947352a5a56d0f9aa59c6fc10cc2f47248d2a15d5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712888555, "uuid": "3389a15b-a7b6-46c6-a0f3-d609558afb20", "comment": "Malware payload", "value": "702887b3703e23c23494e11fa7d30b7d6533f2da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712888555, "uuid": "5c76344f-8e4c-495e-8d1a-4cb243b48fcd", "comment": "Malware payload", "value": "bbe24d7ca18fac8c5dd026f0de359fa610277a75d6aab476356602c514cd664f0069047215454a599c3a7d33cf5d96d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712888555, "uuid": "dfdd125f-6140-4852-a215-f36fba44d6c8", "value": "T19A54F183B7AA4246D94D1AB1C0E7AC2503B59B837677C78B3E8501CD8E423C99E4E7DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712888555, "uuid": "ab181e48-5aaf-4121-9eba-0e39044c9b44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712888555, "uuid": "3129e855-b041-43d0-9d37-16b53f0d6b87", "value": "6144:FptAhnY+Cvu5tt5lj4yIxOLc9xZuuz6ISD6JY:fOYXG/jwz9CXIS+JY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712888555, "uuid": "f2506d71-27f6-43bc-8110-c6d46ae47484", "value": 303752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712888555, "uuid": "6f0b531c-5966-4b20-a66d-0b51f27d0d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712888555, "uuid": "e553171a-22d4-46c1-9163-b556ce671960", "value": "3135f1c77e01d6df92c04083716c5c47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc424067-f892-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712902013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902013, "uuid": "ac11cfe1-d22e-45cf-9378-48a185037574", "comment": "Malware payload", "value": "9395e59d9cbbcfbdb3fb942de4902541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902013, "uuid": "228ae0a8-a5c5-4677-af22-f0926003f133", "comment": "Malware payload", "value": "33542cf397dc68810129498c74c2e067af975d3ea6306d5bfcf5bb31ceb7f012", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902013, "uuid": "8a7553bd-4fcd-4563-a725-71f697a2979c", "comment": "Malware payload", "value": "29ec1be505032b49f9ddc156fadde2d086c3d318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902013, "uuid": "8eae67be-6ac1-4ea5-a4b8-fb7d8679d9f2", "comment": "Malware payload", "value": "d39e9acb85ce9fc52b27e53613f9e1f2503c869470b5c7a6fc58439f846b3ff4706498381187238cfbe3caf90ca37270", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902013, "uuid": "1560d308-fddc-483c-b960-1f1dfb280676", "value": "T1B40733E36E5C54D1F4ED853E880A984A8174BDC43B70984EB374BF2EDE73204592AFA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902013, "uuid": "0c82edfe-5f64-46fd-9922-fe5839699ed4", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902013, "uuid": "a0341125-cd9d-4c06-8b12-891d79baebd1", "value": "393216:M2992LFFh2Jp5qC3njk4fQbFqy9gsVatXGLRi5:b99wFFh50/fQEgVJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712902013, "uuid": "7939726b-7271-4946-9264-ec6642bba2ef", "value": 18057474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712902013, "uuid": "9f7be201-d628-4976-9b12-2d8df95331d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902013, "uuid": "db658ce5-a710-4df1-9be2-4898a7f1090f", "value": "valoranthack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6310249d-f8a6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712910400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712910400, "uuid": "701aae23-a2a4-4fdd-b789-f21fd07138e1", "comment": "Malware payload", "value": "d92f64a6977785c39106928c95952648", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712910400, "uuid": "1b228e28-7030-4f18-988f-ff3106e3d8e2", "comment": "Malware payload", "value": "36c7f5238e3716ffa9039ccaaaf80853b8eca53c03e67baf7127bcd6b9bedf2b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712910400, "uuid": "c0b4429d-f8c3-4dd9-9c1d-fcfbbacd8ca2", "comment": "Malware payload", "value": "b358b860410acfdabb42569210c900a98ad7517d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712910400, "uuid": "3eee64ba-bbba-49b7-8358-af87ed589309", "comment": "Malware payload", "value": "041a750e5281b4b8f99bae46762629a0a1d0be6115645bfd42de7d570e99ba288d075202995a1dfe5dd154744dc992d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712910400, "uuid": "6a1b642c-78f0-4455-9669-35f7497a1970", "value": "T101D5332A3EC14F2BE6DB44B0929F6339551D1E188FE298073628728524B7E7163F76CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712910400, "uuid": "b3e48d08-6b44-4449-be33-323413633f4c", "value": "49152:xXBVq7qvOfDc7yEq9WRhd9Itc71hE7T8XX5UpAH7uidqFWVQzm12RynXkztmaDY8:mqvV5q2t7vGA5bkWEm1euUzwaEk7I0z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712910400, "uuid": "df8ec29f-bc9a-4e50-9ed0-4199012408a0", "value": 2982912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712910400, "uuid": "8507828e-e52f-4ac8-8c84-4343adfa11b2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712910400, "uuid": "ba3ece08-c940-4dbc-82e1-e98ea5deb0ba", "value": "Chrome-Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f41e2aa-f8fc-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712947196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712947196, "uuid": "52009c5a-f0eb-4d4e-bbb3-8d1f69d7b65c", "comment": "Malware payload", "value": "e43cca482b19e8c05daefb2c36a67144", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712947196, "uuid": "4c83da52-4ef8-4a25-a7a2-7e511ef88605", "comment": "Malware payload", "value": "36f2cb3833907b7c19c8b5284a5730bcd6a7917358c9a9df633249c702cf9283", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712947196, "uuid": "a86518d9-98a1-4fa6-b9c4-645da074a6fd", "comment": "Malware payload", "value": "69f71e2f7b4871ef7baa883bc5aee324870d052f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712947196, "uuid": "36e0a9cd-14d7-432c-94f4-620a7fb402b0", "comment": "Malware payload", "value": "09235b00a2f0fa7c762678b79d4534dcb86c409b6848a096f74bb1f63ed5802564d111da6fe8a29e7f107c7f62aab9c9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712947196, "uuid": "8d2be48f-061f-4160-aeda-ff853cceeb10", "value": "T160E53386331208EABDC8A7B7E3D596469D8CE101C2941B8DBE5A07F39CBD5630EF3561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712947196, "uuid": "eba3b6e7-a455-47bf-9902-1050f0361da9", "value": "49152:4aopGG1X94U8+GmtC0FqqH5PcDeNzhCD2lHOOSN64S9AxF7XuRkSr50lqURYODsn:NopPPv8+Gr0f5PoeNluOC6D9wp+Ow0lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712947196, "uuid": "2773e773-a938-4937-971d-53fe32b5633f", "value": 3110276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712947196, "uuid": "6a4bcf57-5801-4ae0-8982-7b01556c8ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712947196, "uuid": "6baa353d-69e8-4f91-ab4b-a1ca2daa5c0b", "value": "36f2cb3833907b7c19c8b5284a5730bcd6a7917358c9a9df633249c702cf9283", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841f1c3d-f861-11ee-a120-42010a9c002e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1712880820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712880820, "uuid": "618bf807-1d2f-46c6-bd0f-cc67b36f1595", "comment": "Malware payload (PrivateLoader)", "value": "d15459e9b9d12244a57809bc383b2757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712880820, "uuid": "2777f4cd-2d4e-4618-9d07-44a28b7cd560", "comment": "Malware payload (PrivateLoader)", "value": "37aef611ec814af2cdcfa198e200cb21ecb46caa30f84d0221a47db1265b889d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712880820, "uuid": "7e11d661-a7e3-46d8-8302-4967f9d54799", "comment": "Malware payload (PrivateLoader)", "value": "4b41e6b5aa4f88fdf455030db94197d465de993a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712880820, "uuid": "88e5bbd0-230e-41a8-b7d3-022b7cdd3123", "comment": "Malware payload (PrivateLoader)", "value": "9bfb53ecdf1511514b55cb82fb516efbdd14d13fa4de329164ff60d83974575d59f91c83032ce8ec9b032ae2a94aafb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712880820, "uuid": "b93c9478-85eb-4862-9ec7-f5de4a7588ef", "value": "T124366D913B464BEBDDAF44B96FD69DCFC12903E10628E1C3E9617076AD82F1607CE189", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712880820, "uuid": "cc6a0fe5-bf4e-478d-b196-32c07c905b7e", "value": "66339aa1913729d8ca27afcaf2b83f31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712880820, "uuid": "c5537dfa-b869-4d77-b6da-b9a30e84e190", "value": "98304:AZ5VfUpCCTIDsAi8LXS2vwJ1EbfdOq5elO:Axf8ivmOfdOq5elO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712880820, "uuid": "57b2d5ec-a946-4c98-adcc-0df0d03eafdc", "value": 5077008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712880820, "uuid": "c1df778d-7df0-40f0-8273-354b81163865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712880820, "uuid": "d2ac0db9-183a-4fc3-a8c4-f6629089083c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150e0e75-f8eb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712939904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939904, "uuid": "7acdbc3d-2081-44ec-8aac-96429fd0d7c3", "comment": "Malware payload", "value": "f784a37155de9b94b4cc67c05c1b6565", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939904, "uuid": "ae23295c-30f5-4a7a-9e69-1296efe52314", "comment": "Malware payload", "value": "3a00965bbf283a653f92e142b7f8ae4ecd757e9d34d844967f7547cacde4f124", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939904, "uuid": "abb754e3-dcc6-4a29-90fb-dd4a7be6c382", "comment": "Malware payload", "value": "c36dda39b7239ac9cce72ff66b01e87552c32c25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939904, "uuid": "cc65fd85-2d99-4baf-8c48-471109784583", "comment": "Malware payload", "value": "61979fa2bd2046a2ba972292f00c0e728b3bae01e8c0696557265f49cb3b4d6a04f0e05d19ec53f73900e1067e923f99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939904, "uuid": "86f0d531-381a-48c9-a23b-2bf4e76a3e34", "value": "T13374BF11F3A1543FDD271A308D7DCEE47BAEBC615AB4525B32943A3F2E70280CA26356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939904, "uuid": "2b05d7a5-60a7-4e2a-ad96-c29b269581f6", "value": "2ecca6bf335e6e46e2c654a4a04282e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939904, "uuid": "838fddc3-8cd1-4421-bb28-0fe4aa3fc882", "value": "6144:Z9+4VSVSOe0xNiiNg+dvEBg05OhrM6VL9:TJSne61S+xYf5OhrBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712939904, "uuid": "aa48d466-b146-4fee-b43b-2c32b6e263f5", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712939904, "uuid": "b411e86e-3823-4feb-b924-a8fca268bdcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939904, "uuid": "5fc99f89-eebc-4d6c-835d-71465336db4b", "value": "f784a37155de9b94b4cc67c05c1b6565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcea1ef8-f8db-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712933314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933314, "uuid": "479e0694-1b1d-4125-a583-025a8bf3df0f", "comment": "Malware payload", "value": "cb10e21f06a55d126b3e1bd1c83c478f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933314, "uuid": "833e2c97-2716-4598-ba73-de5fc1de73aa", "comment": "Malware payload", "value": "3bb5d8c16fa1ef6d4f5d81419e88d9aff19fa2fa8f7920f284261af4e4d8410e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933314, "uuid": "6763a9e4-409d-4134-95ee-78a1b886da5d", "comment": "Malware payload", "value": "501ef4f8c99759c17a91b5110137d33a8b037eb9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933314, "uuid": "64317816-59d1-401c-90f3-3f5f71979f48", "comment": "Malware payload", "value": "9adce79dfb8f83e7dd5dcba0b0791c14ef3239ac35c05db0deea50a82e7ca0b2bcdb85daf9c37c29de50463637d1daff", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712933314, "uuid": "3e3f9876-147c-4bbe-aedf-90cb0ca25f46", "value": "T120C02B5CC34185C030CE170B8338E421600C010C604D30D2F084E0B44081C628713E43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712933314, "uuid": "13988866-94a8-40d9-93db-132bcc1a7697", "value": "3:8RPUI9gFxzlXkyUhWykDV5nHWfkBBIJ/hKdB:8HBPAyMTHWfI+mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712933314, "uuid": "233319a8-6d4e-4666-8394-313ca696a40a", "value": 141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712933314, "uuid": "153461b6-510f-4de5-9d6a-c75280c35dca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712933314, "uuid": "267bb27c-e939-44b0-bbbf-a648cb04c324", "value": "IF175.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067a8701-f8f8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712945463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712945463, "uuid": "9956e17c-0e95-414e-b8ce-e34701e8565b", "comment": "Malware payload", "value": "0c1554888ce9ed0da1583dbdf7b31651", "object_relation": "md5", "Tag": [ { "name": "CVE-2024-3400", "colour": "#5EB158", "exportable": true, "hide_tag": false }, { "name": "UPSTYLE", "colour": "#CCD2B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712945463, "uuid": "a3905801-7fde-4402-9d32-c38b9d20a95f", "comment": "Malware payload", "value": "3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac", "object_relation": "sha256", "Tag": [ { "name": "CVE-2024-3400", "colour": "#5EB158", "exportable": true, "hide_tag": false }, { "name": "UPSTYLE", "colour": "#CCD2B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712945463, "uuid": "1fb61439-1923-4b31-a4b5-1767b66482f5", "comment": "Malware payload", "value": "988fc0d23e6e30c2c46ccec9bbff50b7453b8ba9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2024-3400", "colour": "#5EB158", "exportable": true, "hide_tag": false }, { "name": "UPSTYLE", "colour": "#CCD2B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712945463, "uuid": "c3e4335b-019e-4f70-b65d-0087f75e2063", "comment": "Malware payload", "value": "a49bb516d77869cea7b2a25dbcff2b76199802ccf368f782d2eeb150d02950fbe6ef6d07ef7daf09a13b47a7402b20d1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2024-3400", "colour": "#5EB158", "exportable": true, "hide_tag": false }, { "name": "UPSTYLE", "colour": "#CCD2B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712945463, "uuid": "5413168d-f586-41ff-940e-a11b1fff1c7b", "value": "T1F3B13DEDA80AF8CE8A64C47678BA3EC997EC371FD9A283CC1404774589313A5C3D8975", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712945463, "uuid": "c44d470b-ae48-44e5-93df-50d27bd9dfd6", "value": "96:6nGJh/TGjHjsOzwMBbPo23y2CKAvHfApKAHUIAAGHAHQAHCCHATAHAHoHAH3/HAQ:6ah/TkDsOzZPJ3GvoB27g5vgMgIgX/gQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712945463, "uuid": "337fd268-d897-42b8-b8ba-5b197438324f", "value": 5187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712945463, "uuid": "f0033549-cef2-4375-9926-ffb723a5a8c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712945463, "uuid": "4bdb4a57-a87c-45f5-8e4f-ed69cb6e2ddd", "value": "update.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864526d0-f894-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712902728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902728, "uuid": "b22c5b2a-0642-4295-8213-35e8db93b32f", "comment": "Malware payload (AgentTesla)", "value": "a04d211606044f391c048a14b3a81495", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902728, "uuid": "7bb0a33a-9893-411a-8779-2b8ea2d8bbbb", "comment": "Malware payload (AgentTesla)", "value": "3edd3fe6434d631459584bfef13f646c14866e7d99121a3067d10f1e330b28e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902728, "uuid": "13ab747e-007f-4a55-b292-664f26f04166", "comment": "Malware payload (AgentTesla)", "value": "a7aee6a40ff60f08a9211d361c17924427d674c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902728, "uuid": "10c4ca95-b874-4d4d-a0c4-11a149aaecc4", "comment": "Malware payload (AgentTesla)", "value": "97079970304a6571dac7646cde2e061d340f13d33c7b63bbec3432ae8686d663b50d3d9980e8d61a06fa5ae0c8052e56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902728, "uuid": "65701748-a930-412d-807b-f4dc039052a8", "value": "T1A4E42295FB57E26AC2586F3286DB504553309347B023CB4BFC8E534D8F437E29A8AAC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902728, "uuid": "509c63b0-89ca-47de-abbd-9939be3c1e7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902728, "uuid": "b0d2f063-a588-487e-a8be-7568db8ee7ed", "value": "12288:+Gkvq31eoWw8zUoGJO1DkcuaCKLYCpBROhjblsUblGNOwkiF3dOukR:FeqF4zUoa0AcuaCKZpBROhjaUbQNne1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712902728, "uuid": "22bcfb7f-0616-4251-bcca-c2259981ef1a", "value": 692744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712902728, "uuid": "86240642-f9e4-4242-97dd-6db2dda3e2d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902728, "uuid": "1ec2dd4c-7cdf-42e2-8dac-7a124b68a5bc", "value": "SecuriteInfo.com.Win32.PWSX-gen.4829.13097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d902ba6-f8d9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712932188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712932188, "uuid": "911aecfb-ac47-4ad1-9f69-e878f3d8a987", "comment": "Malware payload", "value": "5d7b9da421658f33351f06363824f55e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712932188, "uuid": "cebe722e-1259-4269-aad7-7c6157141a3c", "comment": "Malware payload", "value": "3f8f0d64baf178553077b5ec1285f71f9c0d8ee8526f1f2a40a52f7ee69fa233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712932188, "uuid": "22f85254-49a1-4772-a7b7-9f61d207375f", "comment": "Malware payload", "value": "fa27ced5b98300294f11173bc5cf3878205a573a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712932188, "uuid": "a219d476-3fd3-45d6-a53a-11d61baab29a", "comment": "Malware payload", "value": "2c1e4c96bea726b5fd62be8e54eae27cbd009ad5c6ff9d5902b2c265b237919e6cc32d9c7b18181c68236e24d0e42ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712932188, "uuid": "9cecd123-aba6-477d-af5c-1e1ce7768769", "value": "T1C3A633F16E95587ED64313F4C96D2E493075EC0EADA88DFF1748B8257E3CA02D209E29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712932188, "uuid": "da7372b3-0bc5-4c19-9a35-4c1e8e6bf2e7", "value": "566f5c85807dea7c87c5720cdd1c9f50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712932188, "uuid": "4407f761-1747-4faf-879b-32b0b17b6101", "value": "196608:SVE+GeP627g9rdo2gCxr1bIZq1W7gaCl2e1zEy7DJWZM62usyLNLRmOQWS:SVE+Gei27cdo2gsxbH1QO1gyXJWZM625", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712932188, "uuid": "5a809d10-7a94-4320-9bf2-318f7783dbe9", "value": 10185424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712932188, "uuid": "a52910fd-5426-4464-93be-58ded4f853e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712932188, "uuid": "0dee21dd-f3cb-4def-97bc-35afe7b3ae3e", "value": "SecuriteInfo.com.PossibleThreat.PALLASNET.H.5966.12499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14f3059-f882-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712895096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895096, "uuid": "8c3b37db-8bd1-4774-8347-a8a04fc52962", "comment": "Malware payload (AgentTesla)", "value": "fed1b43e8844404ebb3298bb81487aa5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895096, "uuid": "ae4d5aa4-5dcb-4dc5-a4b2-30ff12fc745a", "comment": "Malware payload (AgentTesla)", "value": "3fc06effb5e0bd08a2099d9c508b4e0deb65b0d6f1419972681f39e0184f90ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895096, "uuid": "c798e0a5-1863-4e36-8463-da2a45eb6ff5", "comment": "Malware payload (AgentTesla)", "value": "da49b2f96a11b2ed26934ee28f490e974b3815ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895096, "uuid": "b10cb903-322e-4c8e-aab3-1d3b5f1816b3", "comment": "Malware payload (AgentTesla)", "value": "8032797ce87064864b8dd3e6979fc0188df0efb25b2b50d13f4c2cf01dae01b6850afbfce44ec0a083865b44f43f052d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895096, "uuid": "f3513e7d-114a-423a-8556-d268a43d6b3f", "value": "T1DFD423180A5F633AE02DDB37E67D3A0EF768DA0D6371AB29954021D79A16780CD1BF1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895096, "uuid": "143359a5-56a7-4153-b5e9-03ac35a92d1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895096, "uuid": "d6786bbb-2f68-4a5d-b439-822af9d50575", "value": "12288:Xkvq31eoW0LNUsfqklekKIc+SxVDAvri6mrEXvQTTFZqTT8TAz4vOi2KfcMP:XeqFjvHeD+ri6PYFZmwTA8D2Sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712895096, "uuid": "cda0bb9f-b7d7-49ad-81f1-6b2f7a3a5cc7", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712895096, "uuid": "2c21ee2e-9dd1-4278-ba59-ef294c39301e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895096, "uuid": "bb15a935-f592-4c16-a3c6-384292644b1f", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f510bd2-f8d7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712931332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712931332, "uuid": "eff164d5-b19d-4f03-8d27-e1b59380c74e", "comment": "Malware payload", "value": "fb04518bbd936b17da317673442c6d41", "object_relation": "md5", "Tag": [ { "name": "CleanUp Loader", "colour": "#54298D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712931332, "uuid": "bef7c256-ee72-4ed1-9089-4140d48112bd", "comment": "Malware payload", "value": "4001ca434aef1efa8738bcdce056820150a9abc45e8ce3690d9cfc2188e96f0e", "object_relation": "sha256", "Tag": [ { "name": "CleanUp Loader", "colour": "#54298D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712931332, "uuid": "2120f4d3-9cb7-4cb1-ab55-e99a92373f9d", "comment": "Malware payload", "value": "495477fa62f592b4afbdd07611b0a8d37113ad45", "object_relation": "sha1", "Tag": [ { "name": "CleanUp Loader", "colour": "#54298D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712931332, "uuid": "62710a8b-59a5-4a2b-9357-90029a98040f", "comment": "Malware payload", "value": "0c6284ccab037c73eab95791146dfc6e4331b98b84f80f361d9291b8dda86379876e8a22b69a38d014a755bcfa1d82ee", "object_relation": "sha3-384", "Tag": [ { "name": "CleanUp Loader", "colour": "#54298D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712931332, "uuid": "96ce421e-ae37-439e-81d3-d393120723f1", "value": "T16C65CF11B982C432E99E02B0653CE77B147D7A320B6244E7EBC82ABD6C741E35739797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712931332, "uuid": "e0f2a200-eed2-4b90-bdfa-394ed102243f", "value": "42dd31ca86c177758d73ef96895182f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712931332, "uuid": "def0bf6f-f278-4511-aa00-245233f6d8a8", "value": "24576:72mj42MEVQPFEorkSYuX/7DkbSrh/qtoT/cghZlYPL9t7B6oTubWbfws8Sn:fjnMEVQ9FkSLvkurNqtoTkgjcD7B6MuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712931332, "uuid": "58d59715-2c62-4784-8dd3-221911fad357", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712931332, "uuid": "d8993579-f2d5-44bf-a89f-7a4f55e16020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712931332, "uuid": "3765d070-9fd5-4c63-91e8-f4b124d0a9f3", "value": "TerraMoba.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5dd4306-f889-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712898164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712898164, "uuid": "ef7b827d-6d39-4912-a494-b0b7a0adffd5", "comment": "Malware payload (RiseProStealer)", "value": "56cbae1a65ee3326a433192aa1b5f1b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712898164, "uuid": "ea8c9dbe-d95a-4a54-9e72-294fe9209a53", "comment": "Malware payload (RiseProStealer)", "value": "412d9445f2cca40ae2da8f0be6ec8e154e5aa9d76aa3c4a78db383596b940267", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712898164, "uuid": "c684d830-77ff-4bee-8777-53432c7aaf75", "comment": "Malware payload (RiseProStealer)", "value": "51226221541a91d545fcc0c4e69f7d6d8d074079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712898164, "uuid": "57daaadb-c817-402e-b1c2-0b4778378417", "comment": "Malware payload (RiseProStealer)", "value": "78713b3795ad60fc5831e6352557e264c995156568facda2314df25efedb4f7bddd9a4227f875b6081c1e8f2009c93e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712898164, "uuid": "672de526-cce0-43e7-b33c-85b4b1a9297e", "value": "T1B766239D3AD700E9D8C319B49B1B7BE622F36BA105D64C393AC1348974F6FB6602B453", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712898164, "uuid": "589d7cac-2995-468d-821f-0134c41cfa92", "value": "38a29ee91bd602e22dd44f1ec8a6ec24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712898164, "uuid": "26d83a09-560f-4dc7-9449-dc0a5b473592", "value": "98304:mjy+24RUPKknDlL37eRx5hy2LCZDmCm0TOltkpOp/lC6ouW6tAdLX2JJGH:oyYUPPDRL2Xu/AjC6op6t8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712898164, "uuid": "0e8697de-520b-49dc-bc65-aa8f625c44b8", "value": 6803456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712898164, "uuid": "138ff41a-55f2-494b-8d69-a98487294dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712898164, "uuid": "f8701981-b63d-425f-921e-106f4623a8fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d530e7-f89a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712905231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905231, "uuid": "a7bd6958-d4eb-41fa-b454-65904a50b144", "comment": "Malware payload", "value": "9551edae6aca09b1ab0b91b083829452", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905231, "uuid": "4af79c2b-d708-46cf-aa16-ed577040351a", "comment": "Malware payload", "value": "469d85d9054fcadb19384ecb936c4f4f7fc2f6e062d738e61acdaf0add020a49", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905231, "uuid": "f146276f-225a-495a-93d8-45d528ad5763", "comment": "Malware payload", "value": "1288dd39ab015040c5ae9af61b2b600b88d14073", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905231, "uuid": "ed2e5092-18a0-42ac-9dcd-5e2ddeee0d69", "comment": "Malware payload", "value": "b99f4816dbc51dc59e27d8afd8431d62d84ac7c3bb5e63d1e7db632831eefaf48c8dea9bb5c95c2891ac8ae10526a01b", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905231, "uuid": "137de473-f2db-406f-a060-a36f0c2eb818", "value": "T117440F037E44EB15E1A83D3782EF6C2413B2B0C71773960FAF49AEA52451652AC7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905231, "uuid": "bec1e080-d02a-4d6b-8dab-18cc29348cd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905231, "uuid": "ba8346af-0df6-407f-8edd-954ac1fb6be6", "value": "3072:+AdGil5lBlJDEELPw7azDlNyAQA+Fb5xgZmPdA:+Adl5lBlJDEELWaz/QXFcml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712905231, "uuid": "9da140e2-4ad1-47ec-a5f4-7b6a44f2eb4c", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712905231, "uuid": "b2d96e15-e033-4c57-86f9-bff27ea42d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905231, "uuid": "07915c50-4d02-4005-96a7-0800b9956226", "value": "17129052285907bbffa1e06db9a2c2be9b124dbfe370dcce33488c29504b5286529b8a6aa8471.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee167500-f8cc-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712926954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712926954, "uuid": "caee1987-a0dc-45e4-b0a2-1835a7309ccb", "comment": "Malware payload (AgentTesla)", "value": "9ca70ad1c68cd06bcb340e621e8103f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712926954, "uuid": "7c05d872-7530-40df-997c-e4127b8197ae", "comment": "Malware payload (AgentTesla)", "value": "46b2799700fc2cf5efdb3fb2826f432891deb9765a73d8e14047ba6ed2e90da8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712926954, "uuid": "697e4b9b-4d26-4c52-a2e0-2b41bb7fcd69", "comment": "Malware payload (AgentTesla)", "value": "69bbc2be2782a1d0b1104b89081f9d8543af2819", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712926954, "uuid": "1564e14c-0072-4e24-aa0b-6747b6c3c6d8", "comment": "Malware payload (AgentTesla)", "value": "8ebce25591e1ca7ccbaf5d946abf9d0ab9bc79e1248a8aff8d36142c7a0200643c70e6a3ef418bae67b220d752976e30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712926954, "uuid": "8ab62277-5bc1-4b0b-b9e6-8856f577c25f", "value": "T151D4235A53BA17FBDDAE03F83B57EB0097F9FB6B1A10C9191D1A90D58931B02C493643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712926954, "uuid": "2dc932d1-e711-4fd2-a203-524d0a290d0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712926954, "uuid": "cd5aa0eb-6120-403d-8e4d-f0a00c375ba9", "value": "12288:qKkvq31eoWR/GFFIl7M1N2iEBC2IUqoodIRptETfMRVtO+sin/dGDrGJkW4B:VeqFNFOM1NvJUqoodI3EkjtO+sinkrNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712926954, "uuid": "fa402648-1463-4c61-abf3-a9c7f0777085", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712926954, "uuid": "c22f2459-2ebe-4ff1-8c11-9d8ce1fcb60e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712926954, "uuid": "68b31668-837b-4154-b1f0-0d09e277a0fd", "value": "Quotation -558240007300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad16a6a-f8ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712912507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712912507, "uuid": "0e44cfb0-92bb-40a1-8578-3fb1626ddcba", "comment": "Malware payload", "value": "4a8a3ce41654eca4fb51b360e4c34006", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712912507, "uuid": "ad4892ee-f68d-4512-8fd2-a9dbe58622e3", "comment": "Malware payload", "value": "4bf681d9d33768255dd82ebebae98d1a95f93c2c522bf58e8feff495537b6884", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712912507, "uuid": "da5459b6-88d1-4164-ae1f-a3625a99177e", "comment": "Malware payload", "value": "5cfa26542f975800a06cb6b430c91575156e6790", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712912507, "uuid": "e176b76d-26f6-4002-9880-dfcabd75b9b8", "comment": "Malware payload", "value": "1905b023f58f5310eca0cdf35157ba68255ba8117bd1076c6a7ae300bba36e37a7bdccd4480db7b13908db7de0cadd88", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712912507, "uuid": "2e56037b-451c-401d-97aa-0fa093fd708f", "value": "T15164E051FE41870AD856473149F74AAB6221FC419F924B0F325CF72E3DF43A82E27A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712912507, "uuid": "ec4391da-c48d-4f3f-852f-0222df55618b", "value": "6144:cWunJGbEvY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVhiMIatq/cluBxZK+Pd:cHJGbEy3bVhiMI2qEmI+wC2px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712912507, "uuid": "aeb4d9ea-ddae-41b2-bd0c-2fc30a6bd933", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712912507, "uuid": "1b4b7ab5-0082-45aa-8eb3-fe7566cc8710", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712912507, "uuid": "58365ec3-8c82-4510-898e-81b3fe3c1999", "value": "Booking copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f688f288-f869-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712884448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712884448, "uuid": "9f8f997b-bf55-4382-9242-37e55cb28c23", "comment": "Malware payload", "value": "7749ef190d55e7cebfe8a345a5ed3756", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712884448, "uuid": "baac9328-c8e1-442b-acab-6e4138e1a8c9", "comment": "Malware payload", "value": "4dce4b8e82d08c5714447cbad8fe62c4576f2362715bfeb4876c0bd07f90f239", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712884448, "uuid": "1d3e6e59-508d-4575-aac6-be5fe4bee956", "comment": "Malware payload", "value": "4918fa5ab5e2ad4022c7c87abac995823636ed3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712884448, "uuid": "d56498c7-5e2b-484b-9430-d8cc989de665", "comment": "Malware payload", "value": "99b455a41fc32d35cc13da8776e3623258cfb3cd147b9c77f22f65bbc2cd42b3f0a847a9c8fd1d4cf4d7d5b7410c137c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712884448, "uuid": "cae941a0-fc5a-4070-add6-c6d53030fc8f", "value": "T111566B47FE9145EDC4AADA3089669223BB71BC484B2423C36A60F3382F7A7D15E757D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712884448, "uuid": "03dc2fd8-c4ae-4875-a02b-1a984ac43e91", "value": "c595f1660e1a3c84f4d9b0761d23cd7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712884448, "uuid": "dc0b7591-8861-40c7-99d2-f8342a0d8a1f", "value": "49152:73UVYQ6WKxmWHwTr6RmWQdqzDyfaOk8dHTwhPfYESvLiPLjs5EVx3bMkh7fCazJq:Xmew/fWhHmdHkKvHEVvui4e5H+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712884448, "uuid": "dc885d14-6fa0-4d97-bced-31c031e88914", "value": 5936128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712884448, "uuid": "29534187-7cab-4936-9867-95618344290d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712884448, "uuid": "29485a0f-d00c-444a-90ef-891cd02dc773", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2656a6-f88b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712898762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712898762, "uuid": "54d9be98-0994-4ccd-92bf-74e4cda5901a", "comment": "Malware payload (AgentTesla)", "value": "173b817d93e7526b91f356ce9369fa94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712898762, "uuid": "020c3083-5895-4ec9-b2bb-1e516b508bf7", "comment": "Malware payload (AgentTesla)", "value": "4eb9baaa8aa5227d1e989c3f6eee284ce0e00758db83a35ade3e243dbc5e19b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712898762, "uuid": "c49e986a-0d8c-458f-bef8-de9acce1161b", "comment": "Malware payload (AgentTesla)", "value": "bb92ff2cb5b7f902839ec5ab9efd55241bf5a25d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712898762, "uuid": "ed850217-ddd5-4886-ae81-8ec98b712280", "comment": "Malware payload (AgentTesla)", "value": "7b975916263f542d0d2117fb39478beb1c474fa07286844c57e2f1ab9af1c2885c722adc1f38a91c9d57794791555e42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712898762, "uuid": "43c2eac9-0d2f-49c6-93db-a34a379e935c", "value": "T1C3E4232AB346C6DAC254B776A4D354486330CB1BB177DB2E308E23154FA77FA8CD9684", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712898762, "uuid": "db66898e-ed84-4290-977e-6c838c424d8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712898762, "uuid": "ff20e226-783d-4e1d-a781-2303a2032b23", "value": "12288:9kvq31eoWWtumuOL1FUUmPYE4W/3Dk8DM6DDJyNQ2fT4GX+3sUw:9eqFJL1FMYE4ADhDMQeQ2fTd+cUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712898762, "uuid": "049765b7-4363-459d-8739-5f66c6ca89d2", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712898762, "uuid": "819e16ed-7165-4f81-8abb-64598f19aeec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712898762, "uuid": "da11664c-de5f-4ba6-b0eb-a694ae5684d5", "value": "Bank Receipt.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f77f8dd-f884-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712895737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895737, "uuid": "176762ab-90c7-4d35-9cde-45ef9fc0a5aa", "comment": "Malware payload (Formbook)", "value": "a4092bb94a165935a7690022c88f5a4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895737, "uuid": "0830f8e8-a801-41c4-8099-e3b9a38d8235", "comment": "Malware payload (Formbook)", "value": "5087e1fc9eae1748862d5cd3075b13eebb5a8983d637695e4e28835fef0c5f23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895737, "uuid": "6140205e-f32c-4129-938a-56b528f00da2", "comment": "Malware payload (Formbook)", "value": "c438f1f84fa5416d5ec8962813ba98f7ed6c2651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895737, "uuid": "4be339c1-0496-460a-8e95-cf296c1fe97b", "comment": "Malware payload (Formbook)", "value": "25d5a8fcdb129fb62b7756ed2554f790eca421b7189c28efb338db12e4ea9f0500ce9778bbc3418f03d08ff9ae3816f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895737, "uuid": "6ad365d6-82f5-4304-bf1e-fca158279d87", "value": "T191E42345ABDDD22FDF780E3DFF6227501792F213553AA22CC62DC403AB56FA61846D90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895737, "uuid": "d29aea1d-9a44-4f3a-84fc-eccf20c0f644", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895737, "uuid": "14e8138b-ebb8-42a5-9d01-be9a7fcff4b0", "value": "12288:Jkvq31eoWrz0NAieNuV9wrICp6XGLapfCInSHjoXEX2mhzZ16QngX3b/m0Y6ALxE:JeqFI29mZyG2R5nSDoXEThtfna3boGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712895737, "uuid": "678a2bfa-8099-44d2-8554-623ae76d4676", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712895737, "uuid": "85dd95cf-5b3d-4f8d-8673-b1bc77dec290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895737, "uuid": "b991cfe4-98a9-413f-ba33-4c0aff935743", "value": "SecuriteInfo.com.Win32.TrojanX-gen.8353.13897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87b31ff-f894-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712902893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902893, "uuid": "2cc3a1c8-944e-46e4-8a1d-b07dae2e77a3", "comment": "Malware payload (CoinMiner)", "value": "69e405e3247269f0dd6175a4d3aa317a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902893, "uuid": "f8ecf375-f80e-4b18-a4ae-59d30d5e7d45", "comment": "Malware payload (CoinMiner)", "value": "50ef5b97ef444c4556641b252aeb8f211ccb985d6247f9993c316e34b79aa967", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902893, "uuid": "fceeb54c-725f-43a2-beca-f2250ecf5b61", "comment": "Malware payload (CoinMiner)", "value": "0739e413f7223158cc210d5dfefe03ef1dbd2e9d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902893, "uuid": "6f68114e-851f-419e-a569-c7af373e6167", "comment": "Malware payload (CoinMiner)", "value": "22c8696f627e115336b3cf075dfbc189b5f66f9986efab280a80e2da256d6bcf2a2f704a1dd94dbf0e980d21ef2f5933", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902893, "uuid": "2f93d8b9-8f1a-4159-a3c1-63a243d64362", "value": "T12D754D98FA87A0F4DA630DB4518BE73FDA301E054028FBB7DF89DB48E473B56A209155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902893, "uuid": "31b3bdee-7c02-4099-a25c-8b5b53e540fc", "value": "a12d186f65c99f872323a61923ce70d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902893, "uuid": "a0bb1fbf-9567-4f2b-bc37-13bae96f4309", "value": "24576:Z1txXTADYDZL89t68/kGhluhQkibRRcJ9ltZa9AHjnLwPln5u5h4uhH3eDIOIu47:RxDD9i68/kuRRcJ9ltrLwPlmhxOwVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712902893, "uuid": "674f0a81-3d98-4945-96e3-251ab6593543", "value": 1624576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712902893, "uuid": "2f2e024a-82c2-4c1b-8319-b75d178255b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902893, "uuid": "f223ab36-8c4a-49e4-9517-7fedb5aa88c5", "value": "50ef5b97ef444c4556641b252aeb8f211ccb985d6247f9993c316e34b79aa967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bddb7bb-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712905959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905959, "uuid": "1f261fa7-e4de-4276-b780-38f89c3e85c0", "comment": "Malware payload", "value": "f2d1afe45cb60feb5fa694b270d057e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905959, "uuid": "52c67bb9-b479-4593-9559-17c3b6c44f63", "comment": "Malware payload", "value": "53396bd0d35162ed4cabb87b951f9cc1a2a72d10af9643a44818064e076176fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905959, "uuid": "db9b66f6-16ad-4751-9da1-45901a4a9a17", "comment": "Malware payload", "value": "d106a1d5cb44c4094086154db136473aae3c6efb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905959, "uuid": "50aa9ff9-19d4-45c9-87f7-5a53c3a6193d", "comment": "Malware payload", "value": "4828bbad00e303a95f02aa206b5048809dbfbf21f57a31773795a97cf04bcaa5d11afebe7fb48430e5c30efe52849ffc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905959, "uuid": "ec378aab-4cab-4526-935d-edf39c7c2c91", "value": "T15D9533CEE9DBD578F14580FF6E01E464BA54D2685C785A48C7DB203E98DE3C9EC39282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905959, "uuid": "c7792961-6130-41dc-9679-af8dbf66629f", "value": "49152:I6tmwfvu0eNy59cLNhoDq43JBOEofIx7bXzM/t:ltmwfG0eNy59uNhoDq43bOESIx7LY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712905959, "uuid": "747d772d-dd83-4481-9510-1e1b8bd94eb6", "value": 1904272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712905959, "uuid": "4612d4fc-d86e-4475-911e-c2f620ef0310", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905959, "uuid": "eac8c20c-ff5a-4d55-90b8-af8fcb775128", "value": "53396bd0d35162ed4cabb87b951f9cc1a2a72d10af9643a44818064e076176fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761c7a5e-f8b1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712915156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915156, "uuid": "37930d19-2ebe-489a-8719-1f6b1973fd38", "comment": "Malware payload (Mirai)", "value": "8608417615a23cffa4caa807c4b05807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915156, "uuid": "cbdb0391-58b5-4aef-86aa-e5613c117d82", "comment": "Malware payload (Mirai)", "value": "53749f9e38e32eebd2284757899d0984ad55bb35f4ce62c535ec79706c630085", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915156, "uuid": "742be857-8ec6-4a95-add3-a1648c57411f", "comment": "Malware payload (Mirai)", "value": "2ff3d6d15b1fecea198f7e084d6691b97079dfb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915156, "uuid": "26a01351-c91e-44ad-86e5-11732697516c", "comment": "Malware payload (Mirai)", "value": "5bdd367f7293256b974e55dd1388d5d8fbd80109665bcdf4379d15762b656a18054cb5c4986ff448db896fd8a31f6732", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915156, "uuid": "d51b58fa-fe57-480e-9468-89614c9ccacc", "value": "T1F5211F3BFBBF8716C850927A4E6333117620C85C0018D23ABE23691EDC22721AF862F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915156, "uuid": "807542cd-e650-4ece-ab05-4a11f80c2c3d", "value": "24:3z/Dq3N0yTK69k+/sNMA/mlhCbjSkvs6J9lEY7NTawqVU:3WVTrZcMuDvT9nNu/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712915156, "uuid": "f8b45eba-c857-4901-bf53-a4500e49cc37", "value": 1288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712915156, "uuid": "1e054e5e-a3b1-4217-b370-fcce5b16a8c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915156, "uuid": "b0a745c9-fc62-4923-b4c1-0e7f21e173b8", "value": "SecuriteInfo.com.Linux.DownLoader.535.32081.168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6bde13-f901-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712949745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712949745, "uuid": "f8357c5e-d88d-483a-9ceb-c9bdbd4fd00d", "comment": "Malware payload", "value": "71c8cc4a3eb667dd784ff6a7137b832a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712949745, "uuid": "eb21702e-123a-4ab6-baad-349ab2bf23cd", "comment": "Malware payload", "value": "5389c84f22e61bb925b3b06b2203f9020160ca67681dbb852aee64765f0676c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712949745, "uuid": "69217a07-8f07-4e55-b882-008461072401", "comment": "Malware payload", "value": "4f38bd2fa2c466a33001023588e17020079561b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712949745, "uuid": "9573d21c-860a-4f16-a147-ef65fefc7c74", "comment": "Malware payload", "value": "5ce733474cf171d4c2e783d46bf928dd9582db318417979aabee4f5fdd433e397f52f997d63722dfb8f8f6fc84277c3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712949745, "uuid": "9ab4c69c-f6a1-49b1-9e4a-6f9425260480", "value": "T19EC523A2BAD70832F8B55934C876D110AD23BDBA04F1700B2DF4ED4E6DBF6D16835A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712949745, "uuid": "c4452ef1-9a3d-40dd-8bc0-d767b0a290a1", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712949745, "uuid": "44dd144e-9386-4bc7-9888-fbe1941ccfaa", "value": "49152:0h6ncCeDq6ij7wLEC8miAqmMB23orOmRT7w+eOlMHQkXZMNRtqbwdcy:HncCcqnwLkmiAe2YrOmRT7w+ZMwkmNRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712949745, "uuid": "d5af55cc-2804-4555-a5ce-f19cc951fe8b", "value": 2727320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712949745, "uuid": "b6589570-4a1b-4148-9a5e-d08cc7ff6563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712949745, "uuid": "50a05820-f751-4612-b8b7-afdac26277a9", "value": "SecuriteInfo.com.FileRepPup.2542.22578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6a3d4a-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712906309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906309, "uuid": "8f344c35-f99e-4540-88b4-89dad38f8053", "comment": "Malware payload (Mirai)", "value": "e784214e537151cbf2b0366f92144d6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906309, "uuid": "1dec2b0f-1bf6-4cda-be21-ee028160eed7", "comment": "Malware payload (Mirai)", "value": "54686f48734b957079b373a44f07cad3ddb19e78e5a0b7725bc9da108f122520", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906309, "uuid": "0eeb38e4-a34f-40bc-9056-51cc4f3972b9", "comment": "Malware payload (Mirai)", "value": "73a92295931b8d5984545da120afa08b46ab4eb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906309, "uuid": "e6b3a2d4-48db-4e60-b180-4e166c3ff3c6", "comment": "Malware payload (Mirai)", "value": "8f88d7d930f785da438e388aded5fde340c46597afb18fa193c89595afe91336e45911bd0e91fc03334e54cdc514bb0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906309, "uuid": "612c7a83-4622-46c0-b814-8df84a8e7b5d", "value": "T13A04B53677A10DB7D80ECE3301A685220C8DD99712D96B6BB274EA5CEB6BD4F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906309, "uuid": "b11315dc-05ac-4564-9d6a-b80790fce313", "value": "1536:CLejsz2WUWqT/IeB4V9Q/VYDIGXGtQrTFLY9fHr8ZzQG4mBixv4vnaNu:Cnz2WUL/6IGXGtEh6r89QFmB0v4vnaNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906309, "uuid": "3d8ed5d5-ba64-42fb-ba75-8a11d611daf7", "value": 181137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906309, "uuid": "e4a4ad5b-cd60-4553-ad6e-4c75255d85d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906309, "uuid": "8360e657-5478-4926-9702-ec434ea2e794", "value": "e784214e537151cbf2b0366f92144d6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cee7887-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712905961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905961, "uuid": "e88eef21-6044-4323-894d-a3963f13b482", "comment": "Malware payload", "value": "88b0b164ca7f172d39873f2d4383fa31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905961, "uuid": "c58a0785-1c86-4a0a-b8f2-9511b47d2bfe", "comment": "Malware payload", "value": "54c71c984bf1049ff16b56c79007391f4855b6241cb229bd6c1c5cf577d4f253", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905961, "uuid": "d5af9297-fbf4-411d-860f-632eaff2a357", "comment": "Malware payload", "value": "f19e42ba288eaad2ade7790cf263ec24ebfaac56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905961, "uuid": "44cdd949-5452-4d03-8e3d-bb598b6fe1ef", "comment": "Malware payload", "value": "c621b2477967ce1b30340012dff44cf7f65941cac42a2e1e6ffa6c0d762045801e8a21b970a631aa185571ef8b2d32bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905961, "uuid": "63ddf653-e62a-4e4a-8de7-16117fd1c7fd", "value": "T1DA5533FEBD4EAD77645F16E06BE08A449032ADE641275C82BF0E2799DADD003DED241C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905961, "uuid": "149f5c9a-a778-4119-8da9-7796a05b251a", "value": "24576:oP4ZIlE/xPNdBCEXUbNHDjqLxe5HI2VS6SxBlnHte8WbJhpNP:c4Z1ZHBC1H6LxeG6SxY8apl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712905961, "uuid": "b59f7343-01ba-4259-9d6d-0ca0e083295d", "value": 1299724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712905961, "uuid": "42733eea-5893-4d83-b7bd-246d49aa4296", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905961, "uuid": "a76c7cfa-cbd6-424e-b807-6a9016d7f65f", "value": "54c71c984bf1049ff16b56c79007391f4855b6241cb229bd6c1c5cf577d4f253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b68fe1b-f8de-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712934305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934305, "uuid": "b47341c1-ce0a-48d6-9cf9-5a37a5ff72b0", "comment": "Malware payload (Mirai)", "value": "91be0d665f1c822c9206ee39f2d8fe9a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934305, "uuid": "547cfc87-b521-4d21-ba3b-80d1bd7b7125", "comment": "Malware payload (Mirai)", "value": "55ba400d7bb063fe2291e640e36dd32c69c79c2e7ca3b8e3148999bd08dae9c6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934305, "uuid": "2ffbb07d-1e4a-4c53-8124-4871aa62a11b", "comment": "Malware payload (Mirai)", "value": "b71acfae532e890d7cb37c02eebfc60ef4640dab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934305, "uuid": "bd89a524-9662-4980-a0a1-5b1420bad964", "comment": "Malware payload (Mirai)", "value": "718f4fa2c12dfafd9edc6b6668b841e2cbebfb63d5dc10d4effde6b8a08d839b942efaa2568e61b7bc21baa947d75e10", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934305, "uuid": "8c01ff29-2892-4f16-b13e-67d4378aa6e4", "value": "T1D8934B85E262C5B3C9C71B7402F7EB770931F8E2175D8A06E3A8EFF56E03694704A649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934305, "uuid": "5067a4be-bd94-454b-8c06-47a66d84d3d6", "value": "1536:R6B5rFr8Xe2EUdLHAFXtQL2ZLnN/1WmGeA0FHEczN:wB5ZouUdLgG2BpocDph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712934305, "uuid": "9cca7a9b-4572-41ed-9de5-89045eb2272e", "value": 91028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712934305, "uuid": "56e7639e-c39f-495f-b015-f76e61a16fdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934305, "uuid": "6a8231fe-be9e-43cc-ae6b-917f35a70875", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f1603c-f8b1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712915160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915160, "uuid": "c396166f-882c-4d8c-858a-a0b0197b13c3", "comment": "Malware payload (AgentTesla)", "value": "5089bdd7800469656b9c168b03fdc27d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915160, "uuid": "aca854f4-86f5-4603-a794-652cbc8ccab9", "comment": "Malware payload (AgentTesla)", "value": "5702612caa2cfd626ce28bb1e173d884d5314e0922bca28d979e7bf5158441e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915160, "uuid": "b5c49198-4b7e-4dc5-a2de-9f54528c6476", "comment": "Malware payload (AgentTesla)", "value": "b45a3f0b53d072f579c19c7029f0dad721a6f9c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915160, "uuid": "46cd4dab-3dc2-40f7-b6a3-f684a1a2d822", "comment": "Malware payload (AgentTesla)", "value": "9a69be17c530284a581f372b0d65d3f096cae1d701847a8c9344f847a54540a33d76a225fbe3554996166e446185f1eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915160, "uuid": "f097da19-2dc2-41dc-8ff4-2bc21750fd1e", "value": "T102D42389210933B6CAAD4771A11BB904D7BD921B5B59DB2B0CB92DD3818F3924C53FC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915160, "uuid": "6a8e0bc9-190f-4228-9b02-e0138592d3c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915160, "uuid": "69c15f90-6ccd-4059-a8d4-6ec725932528", "value": "12288:5akvq31eoW7/Nj0iNWbgAS1xGPJciw3bVH0NgOaBWRvOLoE:5aeqF6XFl0y9BYvOLoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712915160, "uuid": "b4c64309-3100-4613-9d85-0ac4606258b9", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712915160, "uuid": "688ae681-0de3-4154-b5c5-cb6a34d610c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915160, "uuid": "bd15b110-8af9-4773-96a1-b81f61c3b8a6", "value": "SecuriteInfo.com.Trojan.PackedNET.2794.22805.19245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15548318-f88a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712898244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712898244, "uuid": "07b683af-0a63-461e-8cd3-c4876602facb", "comment": "Malware payload", "value": "f10c7df77ddc6029e03d97dbe304bb3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712898244, "uuid": "d79c5482-6954-42ea-a404-7190bb5deabe", "comment": "Malware payload", "value": "57945af0d77fa4daeee98904f837f30a559aabd1fa381fd812706045c2dad70c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712898244, "uuid": "59ebca47-a798-4083-a7fb-86d717b25fe4", "comment": "Malware payload", "value": "b5697b24555236c8fdfbadf22d67a95f12f3d55f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712898244, "uuid": "f8ac468d-d14f-492d-8695-e9246b80e340", "comment": "Malware payload", "value": "16989166ef4fb8e34cb0d02c3ae1fb3e277a5b85dd0b6c86e019d0c6b64f76925318ce2bf72fffe066773216e396ddd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712898244, "uuid": "3c2ea1f9-7aee-441a-8507-9fe8d44c315c", "value": "T1604633AA9CD71982E85D91F02665FEBC38F05EE540708D5AB8687EC6FCF707A2437046", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712898244, "uuid": "0266e66a-f4e4-43b8-91db-d34df60382ac", "value": "fce2185f86316405847dae4f4adccdc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712898244, "uuid": "20ced13c-1706-4205-8f09-ee505ad5321e", "value": "98304:CL3QrkwEs+iytjMY2ztpOAYGZn41Eh69vKlWkKOTF1GQVANmxt26IkPkRiYXMfJx:Y3QrkwEFiytgY2zcCcELIOTF1GQVAN+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712898244, "uuid": "706d4c03-bc07-4479-817f-4d5b0392371d", "value": 5716480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712898244, "uuid": "532147f4-1788-4de3-9369-c1f8be3721f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712898244, "uuid": "3e208854-5e73-4480-8598-37ee0b2d882a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e0601c-f898-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712904419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712904419, "uuid": "2dc07ed0-8ae1-4695-86b6-13304f0ecda6", "comment": "Malware payload", "value": "b47a6b9fed2a61efe164a130b4f55881", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712904419, "uuid": "25d20628-b9b3-4ac8-a8b3-30702d5fdcce", "comment": "Malware payload", "value": "58827ff2fffbefadc96229e71154d5c6f3a4176e7f364e531e2a935845eebbbd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712904419, "uuid": "00af57a0-125b-4602-a5b1-35184ec6b7c8", "comment": "Malware payload", "value": "15e372e7e69b8b9084b9dbcb0518b3a8ae8e586b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712904419, "uuid": "5a805876-897e-4e49-b1b8-1fd274451701", "comment": "Malware payload", "value": "ab180e3e2f72be13ec5be55e48b191018d6be168304838454909e6572ed2fbafb60a64aa59cd81ee2bd801b04d9fff4e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712904419, "uuid": "2dc9c81b-2e47-4ca2-824d-fa42c8e57365", "value": "T19453F129BE83D275D2A7A5724845932BE9FC86AF478CA4A72CF0AD87C0175050F0BDDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712904419, "uuid": "4a8b3a81-3917-4818-ab25-fb160f587193", "value": "1536:78VCTm8IlFW+TD7xIia9WCPCc/8C9icqKBDeGCMQOulVOBXTANyWc8liB:7gqboFWU7CikXlevMQOulVYTANyWc8YB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712904419, "uuid": "25abac5d-14ab-4b39-ab26-c9d5f33735ef", "value": 66509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712904419, "uuid": "15c7118b-af0b-478a-ad9b-6f6c2dee4a6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712904419, "uuid": "54e6f3d8-bad1-4efa-9fb8-78d1f699dfaf", "value": "SOLICITUD-DE-COTIZACION.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494410cd-f89e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712906921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906921, "uuid": "f4cf6226-7732-4a7a-9483-ac707939f4dd", "comment": "Malware payload", "value": "62e8a4be7df38db5e0b3306d36b37b8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906921, "uuid": "f20e5c81-c6c3-413f-88d5-7699ea13ee44", "comment": "Malware payload", "value": "590f028838c65087a6638aeb7630bf667c6d8ac8238374d741c7568b2bf64b27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906921, "uuid": "62a75c32-36de-4f5c-90bb-b98cbf032172", "comment": "Malware payload", "value": "c0fa8d516e10c63e0455e0c3e631e2ae51b4aae0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906921, "uuid": "a69fddbd-4205-4ac0-9eaf-85156df32cc6", "comment": "Malware payload", "value": "d55efb70e65233f3e629ed426d9fe396ced490fd437c03288cbde37e6f3f9db7cc30144b71e282f7b1459d23a0c5a8c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906921, "uuid": "1c307156-5ad3-4ff0-8a9e-2a4ca0e9f8a8", "value": "T1089533FB667D11BCF14FA674DB6A70CDEE9C8057BA2DB9B11648C0381A124C3E4E1D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906921, "uuid": "82ded46f-3922-49af-9a97-6cd317e38d5d", "value": "49152:sL/mOKbF50eDD8I+DRoG57IrerrgVvwdnYVkG6PE71:sL/mNJ5nvWes7werrgVvwBYaG6M1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906921, "uuid": "7535e79f-ad27-4c26-ba06-a962600a74c7", "value": 1922384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906921, "uuid": "772b23ed-f656-4dc9-9fc0-88b6c0d236de", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906921, "uuid": "57d7e055-c865-4f71-9343-95a1d75d2cc8", "value": ".1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c3ab8f-f897-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712903794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903794, "uuid": "561fe0de-4bb5-420f-a8b9-738257f7a4e0", "comment": "Malware payload (AgentTesla)", "value": "e41e77ae8e9f30acf7cc110d198ab611", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903794, "uuid": "319daf21-24b5-4fcb-a363-24a5e3b3efe5", "comment": "Malware payload (AgentTesla)", "value": "5ad07d5c373f4ddbf435b4e8a310bbf9a4c88faf481185392e2176b557f9f61f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903794, "uuid": "e050dfac-9b49-4bf0-8f5d-f71ff69257bf", "comment": "Malware payload (AgentTesla)", "value": "efccadeb961e591c1ef93732cc84961d7009d984", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903794, "uuid": "9c28aee6-e143-4466-aa27-55ad40942397", "comment": "Malware payload (AgentTesla)", "value": "e7fdc213185d9c70fe26a3f5b2e4f254676246ad524b78170959a8840dc5d0c0fbfe77bb91b2c93961183a60d8ecc4cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903794, "uuid": "1ec6fe1a-05c4-4fda-82c4-3152a2addd6a", "value": "T14DD433028EDC237FDDBD4D33A25B470D1B72B472A5E3F746CE402E4E66623A48562D92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903794, "uuid": "a108fded-634d-48e4-a0aa-4f8adf7b2d6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903794, "uuid": "e965effe-4dc6-4a1f-8a0f-035a72c48390", "value": "12288:bqkvq31eoWJppAPD2lpF9qEG7lOs4RHQHo7JF6m4BOilaF/iiNkjdb5G:WeqFSOPK9OlOfHX7fSlaFiiNkjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712903794, "uuid": "bbcb2751-2a3b-4e9c-ab31-957b16837d35", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712903794, "uuid": "3d3fa8c1-5552-43ce-90b4-dc7428736f1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903794, "uuid": "e415c4a5-75a0-41d9-972e-f3bdd0aa69e9", "value": "httpswe.tlt-gbqS8lgkw9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3991242b-f89e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712906894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906894, "uuid": "cfdfd906-cd2e-409e-909c-0d05524e959e", "comment": "Malware payload", "value": "c7455729fab9baebab2de4150242b09e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906894, "uuid": "429c84c7-48dd-47cf-990a-ce9dc6f2653e", "comment": "Malware payload", "value": "5b45970bb42e4d57fd97c3087339e72c25b79fe66a4ec0751a3f873db911cea7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906894, "uuid": "dd670245-aaa3-47c0-9520-3f9fee0633ec", "comment": "Malware payload", "value": "12b6b30e45c93d047c5842076f9d0402b6bf25d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906894, "uuid": "8cad402d-105f-4717-9991-7abec3db12cf", "comment": "Malware payload", "value": "935a13b5ddc1d8bf4bcf0cf17e9b8296fe42f65d740599056ab531e22d0ae85c2c8abf280e18e88108fb7cd2564dab9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906894, "uuid": "1c40432e-8545-4437-bcd1-a1e84e22aba5", "value": "T183A6233FB228653EE4AA1B724973C220597BBF62641A8C1E07F0690CCF765715E3FA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906894, "uuid": "8aad3ab1-66ca-4fcd-b253-ddea0577aab3", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906894, "uuid": "7e29ad3d-3b05-46de-a10f-3bb4402b3d6e", "value": "196608:er2ENMoBnE7ZF671H9zomVVqcK7Ql8BjuHToIEiF1cnXu:er2ENTBnb1H9zoaBKxBj+oN/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906894, "uuid": "1405e241-eb02-4eb5-b08e-55bba1659dd9", "value": 9818136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906894, "uuid": "d97decfe-0c1f-41d5-8333-70a064fdbffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906894, "uuid": "a76906bd-b1d3-4b53-a20f-6008c47b378b", "value": "SecuriteInfo.com.FileRepPup.22468.10265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dfbe1e-f898-11ee-a120-42010a9c002e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1712904608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712904608, "uuid": "d8939e9e-b157-419e-85b6-078a3ddeba89", "comment": "Malware payload (Vjw0rm)", "value": "b80b8a440c0bfddf98adc2d97a2abb8a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712904608, "uuid": "dc6e2c78-eca7-40ef-88f8-9f75c2b2e777", "comment": "Malware payload (Vjw0rm)", "value": "5b60d41253adab08bdc9b8ee9b290944d4b1d338591f93c51b555b110c04e339", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712904608, "uuid": "6a5c0729-ed43-46f5-999d-04af82614d2d", "comment": "Malware payload (Vjw0rm)", "value": "9680478f6fe08675bc590ae5debbe0358278f0d8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712904608, "uuid": "cf124ad3-9d38-46d8-90d2-f613ab7d524a", "comment": "Malware payload (Vjw0rm)", "value": "61ebe1bdd1f35f0a14a638cfb79d88fa071f78bda4214ee673adeb6df5733a253f90f5c5d3c49491510be579a512d88d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712904608, "uuid": "9a90fb78-3f13-41ad-a67f-6b4b5f5ca1ee", "value": "T119250ACA15F83E1E1363E56CC7029BA2EC74D5172CB769C279C47A4EAD36C586D3EA00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712904608, "uuid": "1f08cad5-a77e-468f-9a45-93463835ea63", "value": "6144:XQo8jJ+7XR8D8+ocrU1VQJqTT7RC8wfQkNba4aJT+HKZbq07iMoSorEovlie3PkU:gXHKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712904608, "uuid": "dc0a3b0d-ff7a-47db-a429-7b2acfe85f78", "value": 978179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712904608, "uuid": "ed944df9-0978-4a8e-8738-cd8ddf828956", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712904608, "uuid": "37aa3803-2d3c-434a-9b7f-b4c03e7880e2", "value": "Trommels.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72315dbe-f8b5-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1712916868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712916868, "uuid": "62eee2b4-56d4-43ae-9a33-2e60300ce45d", "comment": "Malware payload (Stealc)", "value": "5fedc184c069ab2decda1df07370d975", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712916868, "uuid": "0a279ed9-0fde-457d-9366-514bee02b3ea", "comment": "Malware payload (Stealc)", "value": "5c37285d2e3d6ea69597038ad9698681a52789095ac609e629ed2945c598cd45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712916868, "uuid": "92c2e77a-0d59-4177-99b6-a2f8b14b4582", "comment": "Malware payload (Stealc)", "value": "20b378b9344dcbcf5b739a864c58cafa18512440", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712916868, "uuid": "5b8b3ace-8f8a-49e4-a20f-6806c4bd7e62", "comment": "Malware payload (Stealc)", "value": "4f30ee9fec35d240a1ce3e178da62879fa0012c3786200e4e02c819ac71092441e035a464dc672505d4042561a861181", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712916868, "uuid": "41216dcd-6d64-4047-a1ec-98c90cb92944", "value": "T101B4E021F2A1B739C62EDE309D69CBE01ABE7C505A745547233C292F2E7C3A08627752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712916868, "uuid": "66d806e0-da5d-4a57-abc3-3f2e3008bee4", "value": "57ee09ec7f3b746f797e6d79c9f45749", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712916868, "uuid": "0cf3526e-a319-46a7-8785-1f009abc715f", "value": "6144:lYUeVgtTScFOk6xcE1nUOzLlcr8SorZeatuCxD7nu5yonr:RKgdSQODxcE1nfcr8SodtuSIvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712916868, "uuid": "2dd2573c-094e-4abb-bfbe-24b5ce4321ae", "value": 502785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712916868, "uuid": "be117893-29e4-4c3e-a1c4-6f404f526168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712916868, "uuid": "7572a483-0d44-4ab9-b1fb-33257e0a3d0f", "value": "5fedc184c069ab2decda1df07370d975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f75c51-f88e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712899958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712899958, "uuid": "472d723a-1181-430a-8ccf-d9a3c1a93691", "comment": "Malware payload", "value": "b9d811ee1a97db8ab9728e49b789a35b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712899958, "uuid": "020d2651-95b2-4f88-ac42-70ce353ad31e", "comment": "Malware payload", "value": "5c8023462909af11ef3cbe972e772c4c8b824aa2c255b2c7b6802bdef08630cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712899958, "uuid": "a79122a1-7844-4445-80ad-b6e06ec87b77", "comment": "Malware payload", "value": "f880cf93ccb74bb7fb0f65a8288eb6e05c3b48f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712899958, "uuid": "68e51485-0528-43cf-94b1-ba517fc510d6", "comment": "Malware payload", "value": "66cf658450864d4b2ba56d71596dde841838ab4ba67bcf7c06af534dce31bed714e41df8eac3696ed9353123b9fb5970", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712899958, "uuid": "707ff1b6-3e9c-4f94-b3a3-fe9e367ab4b5", "value": "T1CFB4E1E1AEA0B7EDE2614E305919CBD016EDBD50EA305687235CDE1F2A3C7908A3F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712899958, "uuid": "78b13ad6-c273-4613-8e9e-009951d07c3a", "value": "1b0af0470af4d888c83defee61420444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712899958, "uuid": "c123572e-641c-48db-a50b-f95d7f68b8a9", "value": "6144:9rdSsbVOr4Wk4bUVkHUusMvdK0c9IftMIyVjibSnZVEWbZ/ihreKbVd5bzu5yoP+:/FbVORGVmUlwda9Iftgj5nZvRKbOn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712899958, "uuid": "0e1aede6-d33e-4458-aefa-5867502c9b3a", "value": 535041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712899958, "uuid": "2c86b739-3c8b-4335-8d50-781b7f99f140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712899958, "uuid": "bf455129-d5f3-4430-beec-eee813165780", "value": "b9d811ee1a97db8ab9728e49b789a35b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afaf415-f8d0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712928291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712928291, "uuid": "dbb4d7fd-3093-47ce-8f6a-453b3a2e30fd", "comment": "Malware payload", "value": "a3090bfd61aa4920917a51d41fe861ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712928291, "uuid": "2c1c9e74-f789-4885-9c6d-b7f84c8eba2a", "comment": "Malware payload", "value": "6218bb973aaa65c3dc3c32ecfc92b4fc7bcd45b41f92b5b6b5441634a1cd1fff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712928291, "uuid": "0cff2627-4648-47fe-b573-a726841b1f28", "comment": "Malware payload", "value": "b979412f3f350019ea01c0ce29edbc251a25e5eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712928291, "uuid": "af0f99d2-da51-41b3-980f-9d80987b44c1", "comment": "Malware payload", "value": "8cfad99ee70d61ae03f988e2e4fc8008559be2d023e429eee8d7f37a6b92b9ca7f45178e3edb58441b962bf7de16734e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712928291, "uuid": "ae19cb9a-2766-4d15-a056-1356ef5e55e5", "value": "T1A674BF21F392B43FC96609308E69CBE43B6E7E515A76525B2F503A3F1EB0690D932351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712928291, "uuid": "42511c42-0bed-427f-a779-ec590d138cd0", "value": "821bd9fb95c98aaf3bf53dd773299622", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712928291, "uuid": "3d29bd44-6caa-483f-9f0d-253832243c35", "value": "6144:g6iHf01YWmMlsL9qHpp6KRPyFgpD619isrM6VL9:Zi/0iWm0MMoKV9ozrBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712928291, "uuid": "1a8ac273-22f6-4960-8b5f-a4788547efc3", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712928291, "uuid": "6bf89175-e1e7-4c51-93b5-4edd71bbe97c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712928291, "uuid": "a8f5190b-5f27-4592-b1b2-e999b945e290", "value": "a3090bfd61aa4920917a51d41fe861ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d2afde-f8de-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712934314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934314, "uuid": "0b4c9eae-6e5d-43e5-b5e7-f398f4d76da7", "comment": "Malware payload (Mirai)", "value": "697a6f814294b5fb47b3e7783f756931", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934314, "uuid": "ed725d2d-fc7f-4f55-9640-1205eb57c3da", "comment": "Malware payload (Mirai)", "value": "6444b3a34abe5583a1fa7b5467fe73356ca0be864a0f8498bd7975e3566303be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934314, "uuid": "77307332-4eb9-4549-8041-bfe6e99ac50c", "comment": "Malware payload (Mirai)", "value": "1294cb2dd53a39d3f1214d3753780ba7d416e8bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934314, "uuid": "72e9600e-527b-42c4-a65c-a51a9c625fb1", "comment": "Malware payload (Mirai)", "value": "3d916fe219ccf90025ce076f1f10c9ca27068170925c3df5aa9442898e25bf506cbf31d43d213bca0808d6a37fa9a606", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934314, "uuid": "3d20692d-60ea-460a-8cb0-512649cb80a7", "value": "T12503F891BC824E66C5D4037AB67E16CE372063E8D2CFB203D9215B647ACA94F4D32ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934314, "uuid": "a7f9f21e-d533-4ba0-a8cb-c0c6e5d724c0", "value": "768:mo5iDmk8PFqTSzgCk3mjTlmS0FqlRwhX+l9iORB3Cg5W1sToHPQwQv4I3QE2fw2:mo5iDmk8P4CkqKEfn1Bl5W1aoQwQIU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712934314, "uuid": "523a88b3-26c6-401f-883b-12030400b9f7", "value": 38824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712934314, "uuid": "978f71d2-6338-4c88-9009-da52048b3c64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934314, "uuid": "2ce835e7-08c9-4c76-baba-38826bfd72ef", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839f9598-f8db-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712933218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933218, "uuid": "e64cfbf1-eedf-49d1-8697-a79d364ee19c", "comment": "Malware payload", "value": "a2e87c58d2b5a475b3de8444b5c0579d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933218, "uuid": "53ca57f1-ad45-4f73-bbcb-18870cce74b1", "comment": "Malware payload", "value": "666ca43b1a31fafd02fb5b9f46b9f4c396d714b4bd828e0e25f0cd8258ac9064", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933218, "uuid": "2a05f01a-14ec-415b-8943-88a640954c2b", "comment": "Malware payload", "value": "e27ae4758dbe30f65cf4d9bdf4dd28ec8ee704a9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933218, "uuid": "a3fcebc7-1deb-48c7-b504-0ae69f828a79", "comment": "Malware payload", "value": "8e7c1b6908605e201286c3e7817d5a3ef9a3f51fc2bfd5aaf7b6f76b88077f4d5c288799cb74e7e3f6dbc73b4ba29460", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712933218, "uuid": "d3af21c4-cf5f-4a0a-ab81-960c299828a0", "value": "T158C02BC480D0C01801DCF8E30C0830418B2EC41C413C3598E00488558000C02A1B5F25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712933218, "uuid": "ba85a2b4-2e87-4edc-a663-e433a8703db7", "value": "3:kuCTzHffuRdJqvXJOgx4nh8WV+EuN87B+Je/huXtKn:jaGRvqXA0LS+rN8UyhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712933218, "uuid": "b9d54735-4f62-401a-ac18-94d1d910d6ff", "value": 141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712933218, "uuid": "86d06b2e-bea5-423d-b82b-5aba44f3324b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712933218, "uuid": "149eedd8-dec4-4b8d-a8b4-b4f14bc28fef", "value": "V4Mhvhr77.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a446f6-f8a8-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1712911233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911233, "uuid": "60538da9-cae5-41dc-b788-87f9ca7ffabc", "comment": "Malware payload (QuasarRAT)", "value": "75f9c243e05b307d9523405d80b8e87f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911233, "uuid": "15b3d358-4fc9-4c2e-8c56-08cf4897c92c", "comment": "Malware payload (QuasarRAT)", "value": "66b4d726c5af4b74ddfc16050395aaa5b4c2848c706f9f88de7375c6ffde75e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911233, "uuid": "1845e184-98e9-454e-9319-e0cdf9d0c065", "comment": "Malware payload (QuasarRAT)", "value": "f30100809ca96f7f19f0a4e90f0cd38dac58c8dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911233, "uuid": "e5493c38-e0ac-45d8-9645-48ffa5423620", "comment": "Malware payload (QuasarRAT)", "value": "bc4445330575e997729464f1e56ce02d71c0c3e75b86d543c31a2407d78b82f7908f14c76158d304bac45d148ed367b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911233, "uuid": "e8e59576-b3a7-4819-981e-748950528ed3", "value": "T17E868D1267F85F2BE0BFD7B295B1101693F0F82DB3A3EB0B5591637A2843B4059427A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911233, "uuid": "ec81ce13-1eb2-497f-afe9-9797d9b9e51d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911233, "uuid": "f2afa682-d1c4-4718-bca8-8acd66a49b78", "value": "49152:VGQxpRUQM9Gdyd1hSparhzALoMwxrh/jmj92dqM/b34TwTHHB72eh2NT:V/xpRlM9Uyd1hS45ALqxrxmj9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712911233, "uuid": "3be9db03-001b-4939-a0e9-836681015a67", "value": 7967740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712911233, "uuid": "4e60da69-e6eb-499b-aace-c1d85363c0bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911233, "uuid": "8f0ec9f5-5331-4fe6-8ee1-155bbb00915c", "value": "75f9c243e05b307d9523405d80b8e87f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798ae103-f86f-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712886815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712886815, "uuid": "46b746f4-ba69-4dc2-8cb5-385b08a87d60", "comment": "Malware payload (RiseProStealer)", "value": "2e5fb8ee29f80e65c39de6629edff22a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712886815, "uuid": "d7df4953-2553-4335-b8a9-e57b4ed76f05", "comment": "Malware payload (RiseProStealer)", "value": "67ebbb63377239963d1fde9ad7f57c2f0f07f77e80ff770f32088055c8bfc5c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712886815, "uuid": "d37c47b7-30c7-4604-bdd4-1a91f75fda6a", "comment": "Malware payload (RiseProStealer)", "value": "65cb61eb43063f649f7f57c835b8a770806e9786", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712886815, "uuid": "226897c8-c99c-448a-a611-057797c2137f", "comment": "Malware payload (RiseProStealer)", "value": "ce149df0555b014d1e105c8940de7872aba591a1a273bcf5f2d2f223ff42fbe20bf3d59879493d4a3f0b722417c53b9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712886815, "uuid": "d99e129f-f59e-4732-9cdc-98f505237a41", "value": "T1484633AD9BC6395DC98E0730170BFE7CB4BE1EA502A19D78B4B03BC5ACE350B2536255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712886815, "uuid": "56f5aa5a-9817-466a-ad01-e19261ba40cd", "value": "fce2185f86316405847dae4f4adccdc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712886815, "uuid": "80ffd9fd-801f-4412-ba46-c6b4bd115216", "value": "98304:KBQlFsY+LO1y0TGUiUMxkp1XX3ARfwv6K5IoH7dUxv:ccy0QJ21H3h5IU7Oxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712886815, "uuid": "b990cc13-336e-442b-bd40-0fa6e188374f", "value": 5849088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712886815, "uuid": "04f43f08-490b-47c0-9674-1791a2b45dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712886815, "uuid": "46bbc9ac-ff7f-49df-b9fc-20af36b588c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a81c171-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712906010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906010, "uuid": "199c5afd-b295-4dd2-a946-a01339221cb4", "comment": "Malware payload (Mirai)", "value": "af3d9dbb2b7c36f8f612d4cf417bab54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906010, "uuid": "2d825741-6631-4306-993c-ffb221dc6fd6", "comment": "Malware payload (Mirai)", "value": "6a40ad020390fee9c9f4c237c719847f53ea7c947e2fa4ea8132dda116b60ca5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906010, "uuid": "a668c1cf-3ce0-4c9f-b160-761cd6c52c1c", "comment": "Malware payload (Mirai)", "value": "c50226d75ca38f226d23a98958154e4d39f1b18e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906010, "uuid": "8a1042cb-ee0f-4883-8d6a-b7083bfd231c", "comment": "Malware payload (Mirai)", "value": "e080eb47281256c721f5b7d46d90abb1c50d0c0e99537718e973604e71fc0e3b520406d80c3c241ab4c644242a01876b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906010, "uuid": "6751b394-7776-4cc7-b553-0b9a7443e50c", "value": "T185E2E1B2AF8DBD61C2F069B57A7447056F016934F3EB705A168C2738E28506923F8B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906010, "uuid": "abbc07d8-3e31-4758-9007-a4e24b46862b", "value": "768:zao/cvQoVK2QJgZ/Z0tND1uNjcS7hmtghYh7WY3apP7Ass3UozI:0QoE20z8FGWY3apPspzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906010, "uuid": "f96133b7-7523-4f95-9a33-ea9fb3a37e96", "value": 32064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906010, "uuid": "00f270e2-66b4-40e8-b5cb-20b4fe8d52b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906010, "uuid": "6ba9aea8-8226-4907-81d3-8e6f8f6fbf7d", "value": "af3d9dbb2b7c36f8f612d4cf417bab54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f66ce9b-f8de-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712934311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934311, "uuid": "bcec848a-2a61-4813-870c-e861efa005a6", "comment": "Malware payload (Mirai)", "value": "36b0022b730e6ca19a8404138ab7a287", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934311, "uuid": "2cf1e32d-d61f-43c1-a751-9d28b6dce1bf", "comment": "Malware payload (Mirai)", "value": "6afe80452180fd7de8cf033710a334a85e6282fece1d8689d433d2b30109164d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934311, "uuid": "82cf057d-6526-42cf-ab5a-a2209d926793", "comment": "Malware payload (Mirai)", "value": "15b8d57d603cb703950ebb28f0c7cbd4b638306c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934311, "uuid": "74fb7da4-a328-4588-a6d8-aaf0e4cf32a4", "comment": "Malware payload (Mirai)", "value": "f38f6d02d8f36290ff4969d06815481b93db90da20ffa226d493e258123561342b3116ddcee0a8d0554553518c95d2d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934311, "uuid": "c6580cb7-b9d9-4fcb-8401-da31990ca5a8", "value": "T197D31916BBB10FF7DC5BCE3302DA4722148DE956239267367138EE78B64728A15D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934311, "uuid": "55c2c46d-87b4-4901-bcbe-d2e9b97ee0a8", "value": "3072:4vV8QW2EwXByDCMmczk3mHpJpe4XtrndOV79FczQbPVPw:4vV8fBsAR+csbdPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712934311, "uuid": "6fc82cbc-2eca-43bc-81a7-72696f9f111f", "value": 130741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712934311, "uuid": "5b85e592-7739-4cce-a660-be7f171e4e26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934311, "uuid": "bd850f38-5ab8-4b0d-81da-e083aba3b287", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0e8f8b-f924-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712964450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964450, "uuid": "101de759-b134-47d4-a8ff-d08731b11542", "comment": "Malware payload", "value": "cee92e8d53b13a0d65bb984eea98906b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964450, "uuid": "391ffa18-b9c2-4222-bfb5-e2aba6c74698", "comment": "Malware payload", "value": "6ec70c7878c3ddb6ac6746370ad6783cbe46f68ddfb93e4ea02f2d6344df3f3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964450, "uuid": "16522694-f925-43e9-9743-5251d2227c9a", "comment": "Malware payload", "value": "acb15fd3fa80de883cb71c6df7aaf5034102219c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964450, "uuid": "2ebd5db9-88e5-4aab-9b9b-fe20d1817a31", "comment": "Malware payload", "value": "80896fbe5c5accd6e80f996d9cafdf96bfd5891f4aa40691cce571d552d6aa06a5e0181d1e68ab6c0e1296f46c63ee57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964450, "uuid": "d776cfc7-ed36-4249-bfa6-0a232cfa6cfd", "value": "T117A5F107F3838A2DE39972758C2493B19652F434976AC7E7FBC94B29DC482C01E947DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964450, "uuid": "78ac2ff1-d371-4c7a-8a21-f2bebb6985bb", "value": "2f413c392ae5fa86a960b47d95ea0c17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964450, "uuid": "8a0d53a9-2f72-4b56-8d76-e4294c1f29ad", "value": "49152:DnfGVq1VUjqmhdhB3tgNlOzU2lOspjTXaUSuBIjreTc:qcQhfJtgNkzUBOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712964450, "uuid": "2116f8b0-da8d-4a62-82ac-9d550ebb47b5", "value": 2146816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712964450, "uuid": "4c5de930-a264-425b-b6bb-19837da2337c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964450, "uuid": "7beaf93e-87bf-41dd-9ee7-92e6cb70b88d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.10324.23151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17993916-f8de-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712934325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934325, "uuid": "2a0f05d7-ad8b-411a-b365-be260cf35c47", "comment": "Malware payload", "value": "bde39b0550bbdd1dcfe1c2a24ca7e1b4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934325, "uuid": "e38c368b-44ab-4192-94d4-f68d78c3c29e", "comment": "Malware payload", "value": "6fbd89f59987ad6c5b4bfa6bba882a57a4181b8092bcbf5c8847ffeff00e0266", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934325, "uuid": "f3d563ee-1812-4aba-b62d-008c6558f4af", "comment": "Malware payload", "value": "b44033c2b0eb3c7b294066f6f376e89f4b1486da", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934325, "uuid": "dd8acc4b-ee7c-4cdc-a600-40200446e0c6", "comment": "Malware payload", "value": "d9ab0095b3f03d41e7be79399b690cb4cf03b183fbbe4f80a65cc5a9147931ce2fc9c96e9155ef618ea406431d554151", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934325, "uuid": "5900c4b6-9a84-42f8-a831-fb029b7f124f", "value": "T16B732955F8818B52C6C526BBFA2E428D372A27ECD2DA72139D215F2033C792B0D37D95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934325, "uuid": "7ad4999d-a046-4dcf-9c8b-ccc1ee2b186a", "value": "1536:TruVQcr1T0o2cJxwjI4xcGwsvd+4Z44B7F7xC5pEtAnrfWvh2P:x4gqYjI4xcbsvf7tF7xepEtAoh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712934325, "uuid": "5a323215-9ed8-4325-8ef4-c84e10143a94", "value": 76768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712934325, "uuid": "a225b95a-9331-4b7a-ac4f-ccfdc9503ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934325, "uuid": "b0fda818-6d36-4a03-aeb3-d1d784dba1de", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef105d4-f924-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712964590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964590, "uuid": "924c7d5c-1cd2-44ac-994c-c19e8112c7c7", "comment": "Malware payload", "value": "f9e504af0dc1bb6663a1a8c00894107c", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964590, "uuid": "22f7eec0-9227-43cb-a8de-004dd8afe599", "comment": "Malware payload", "value": "71e9cdfeda654457417b3575189000d11be9937a99d1c8a9f7ee51dc3c84108d", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964590, "uuid": "3bce2c35-fa09-48f9-9287-f951ced1580e", "comment": "Malware payload", "value": "a2c3290dad8a713c6a418b7a67010bf2c764794c", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964590, "uuid": "26f13956-18d8-408b-b88b-de4a52355c32", "comment": "Malware payload", "value": "53960996e115cbde1f676ab0319e88bd2b8200e4f02fda7822d91885930ad631dc922a19573b711b7ef3f559fc4538d9", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964590, "uuid": "29ce246e-0138-42a5-8c45-dee19a94c0fd", "value": "T19D03E624F5A6C84CF842F902D16C35BD4B9CB2FBB6CC64A21D6C4BCDB00D915E6632A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964590, "uuid": "a0c3e22f-4cf6-4fb6-8271-63db5bed2d4d", "value": "768:umi5Dd8vzgccdAdudodxdOdkdydxdId2NU0ZzBdy7NX3wqVNymS2iL1qSntyBmNH:KmqntycC0M57EQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712964590, "uuid": "210b8751-ae9a-456e-beef-82811218edf3", "value": 37756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712964590, "uuid": "83374f1e-91b2-47ac-8231-3f546cb2798f", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964590, "uuid": "e06f57ee-eef2-47c5-8338-8fcdd3667021", "value": "Ansible.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4723d2c-f8b3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712916147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712916147, "uuid": "ac28ec25-829e-40a2-bd37-ffdb499186ed", "comment": "Malware payload", "value": "a591a2393d3a964197ae4f5cc9eb43f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712916147, "uuid": "49bcee26-3940-4df2-aee4-0693fe52125a", "comment": "Malware payload", "value": "71eeccf7acc3bfef9998435a00b53589f2de91f538310f94b9a8a9fe48a8e060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712916147, "uuid": "f743d1ab-58d1-47a0-a1f5-cf0889e32d69", "comment": "Malware payload", "value": "8e1f98d128a5c16e8302a8107d6e231d0a303f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712916147, "uuid": "50a3dd5a-9eeb-45cc-a51f-bce9fcfb2a34", "comment": "Malware payload", "value": "14a55062595322db4458a229b524618967b588887c0dbafa904ee72eae905fe0e47fc0dc3625b1099a4cd0b208afb565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712916147, "uuid": "85cced5e-16eb-4042-8714-dfd17ee9e758", "value": "T1EF54F10776975606C90D1974C0E39D2547B9AB8737B3E78B3E8C819A4F023C9DA893DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712916147, "uuid": "6969d966-75b2-45e0-9961-c42eaa2aad9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712916147, "uuid": "77d94e48-f40d-411d-ad9f-79ce882ef2ed", "value": "6144:uj7XNEYdBNKx/5G3gB0hTY5MFJ7mxxjVp2jkKimYbopeu4:gXjQx/1ylY5OFmn49ivopeu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712916147, "uuid": "b4ed5a3e-6988-42b7-a51c-972d8804c88f", "value": 303752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712916147, "uuid": "faf9f868-d806-4d29-8bdc-6cc2a62d8c41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712916147, "uuid": "2be8fa37-b1ef-40e5-833c-1c467d415f2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a7ee12-f8e6-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712937830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712937830, "uuid": "aa5d9914-697a-4f4b-a800-6475f2f21151", "comment": "Malware payload (RiseProStealer)", "value": "d4ed75e302757c04f44bcb0ed2c71289", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712937830, "uuid": "5ea5c8b9-59a8-44f3-912d-9ef0f7a6f5a2", "comment": "Malware payload (RiseProStealer)", "value": "741a57f4f51fea521f298405db9c606434981be450183da6dd2798d3363998e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712937830, "uuid": "409a114f-baf7-4ba5-93f8-931b369a7e51", "comment": "Malware payload (RiseProStealer)", "value": "7210706009b5af6390ef6bebc1e5e67c3b18a26b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712937830, "uuid": "eef5c7d3-c26f-40d8-9d04-0827224cf3ba", "comment": "Malware payload (RiseProStealer)", "value": "8fd34dfa116dbf4f2dbfabe185b392e760795f0c10e21bad3735d34781dcecc0d2548e833623e91b98508c7acadac51a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712937830, "uuid": "d481fd92-489c-4ef7-83aa-ac98fb165952", "value": "T18C66331F89C2141CC86BD1BC4693FAFD3A7AEDA4C1F19C2E94141AE5E8F71781A72D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712937830, "uuid": "0f8991b7-8abc-460b-9069-6c1531318139", "value": "c959ab5e76f65820c55fd6008599fdae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712937830, "uuid": "1f5843ec-4eb3-44bc-8efa-58ae8e191da4", "value": "98304:Y+LWDN6CMUQ2v8flni70ijXghljd73vI6ITLnVge7IY9bg5fSgYtQnXkNjsjymK:YlZ6tUQ2vMnGjghbw6ITLnVyfm1Ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712937830, "uuid": "026f9b7a-a772-442a-8080-c2f66e569148", "value": 6546432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712937830, "uuid": "b93abd1d-dad3-404d-9ac5-0a623d8b6628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712937830, "uuid": "bb10ee1d-7c64-441b-86ae-c83f967a349e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfaa3d3-f874-11ee-a120-42010a9c002e", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1712889051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889051, "uuid": "82a8700c-3faa-431d-b83f-778bf639fcc2", "comment": "Malware payload (YellowCockatoo)", "value": "3ba33f5e77f10a4dccde8ff90ae690a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889051, "uuid": "ddc0eac8-ef7a-47bf-8c81-4d5bac7fede1", "comment": "Malware payload (YellowCockatoo)", "value": "7434cd049bd0ef4b5edcede1faa95fe0caf3b802c1997d5a21fe67f076c95f9c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889051, "uuid": "43dc4b5c-48bf-4966-9e23-d01a3af76765", "comment": "Malware payload (YellowCockatoo)", "value": "468c9cf18ee3a3c92dcbc82e6f3583e0eefef1f1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889051, "uuid": "c9edda27-77da-4fe4-bf05-adca7f614fa8", "comment": "Malware payload (YellowCockatoo)", "value": "c3a265a360059cb4b677df22142675477e710515abb531b07b050e7d18d807e2a2fb0dc39da3b27c53a5397295ab1660", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889051, "uuid": "451271b5-5ebd-49b4-834d-002b37b5a0d4", "value": "T151353904336ED980CBEC5BF4A89F5F376B20D2B3E6C2974F3AAE5971374A92544488C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889051, "uuid": "60b19987-fef5-4f4f-a400-7cc95e158f21", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889051, "uuid": "a537673c-0128-44bc-bcd2-4d129ecc9f6b", "value": "12288:qiCjMcvOxBQmtXjcyB6CwRb+GUtkYZMRJOvgK6FS7YZFhiRD8gYyZMkPf:qi+ODt/i5sOFS7WiRAgnakP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712889051, "uuid": "7ee5a4d5-fee0-41bd-a084-29e4b1aa26e6", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712889051, "uuid": "3a146f7a-f031-4257-bcf4-eb6ab589d2d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889051, "uuid": "68d5db4b-d52a-4af2-bdf7-2c9eb18062ce", "value": "bABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZsRC7qKEYr_QNLYIT0EHLaB.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db56229-f8e0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712935382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935382, "uuid": "1a9f876c-05ce-4bd4-ae06-c749cd1da958", "comment": "Malware payload", "value": "6e45b98d4ffb2d2b229f395272e35f99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935382, "uuid": "49a31eb7-e60e-4a4a-925c-a636a99f7a58", "comment": "Malware payload", "value": "758600c927adb10386bfad3863e5fd950edf6340214628e5ea9260ddb994ac86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935382, "uuid": "dcdf52c4-4a53-495d-90be-f1f808b3bf6e", "comment": "Malware payload", "value": "d8492fa2ca7ad3f1bd081ff43aa326fc65fc4311", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712935382, "uuid": "d6447023-0cf2-4020-a05f-898356ef2380", "comment": "Malware payload", "value": "e108256d3764d3bf255f6501a5d68422301f2996cf87153700e237b5755c678483fc88713e0146bc337ecc95201c73f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935382, "uuid": "521c6edd-155b-4783-bc0a-cbd35bf04d96", "value": "T1942539031BB8852EDA8E19F5965A450B6D98C74F5683F3FA326129B867773CE3D0F201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935382, "uuid": "427f67c7-9a48-4f29-bfa8-60beda9a8e6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935382, "uuid": "63477ab1-4f9f-4c37-a59a-2003c185af69", "value": "24576:sBe5pdi9+vEJzbFHahHGP9S648nOUdP0P:3ezZahHL1PUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712935382, "uuid": "50cd9b9e-b385-4441-807d-77df602d290f", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712935382, "uuid": "77718cf8-d99d-448b-95b7-45fe6b6a863f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712935382, "uuid": "2aba05d6-6cbd-4e2b-a687-7ebb836265e6", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6ea717-f8ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712912459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712912459, "uuid": "47e634cf-3446-40aa-9b45-ca63d4e6bee8", "comment": "Malware payload", "value": "2dabc45014d84fe821072f4bbd26b46a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712912459, "uuid": "189075a1-3bdb-484e-bada-5f285fd18503", "comment": "Malware payload", "value": "76bf2e55717eaf6510291933ab201b42cf793273612c838216212dd2255449f5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712912459, "uuid": "58191be8-d09d-4d61-9fec-7e8737e45657", "comment": "Malware payload", "value": "24e31c064df6cd465aac228c3036036740db0a35", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712912459, "uuid": "296bac33-38e8-4950-8ffc-a79fe754d9b1", "comment": "Malware payload", "value": "087bdeec07315870ed303be4be35f67bcee94e0d0225e0b156830a6ce35cab3af520a4b522dba09fa2278691fb6f6008", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712912459, "uuid": "752a6efe-6da7-4985-a96c-91427342329e", "value": "T1E3F27284B3C5B89113875F367A1FF0EAE56F0AE974C4040FC254F964B97DA1AE9D1930", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712912459, "uuid": "6fab77fb-338f-48d2-bb6f-cca8644fc756", "value": "768:mq0a4YhyCDcnSiRB3qfNYytpG3Cl/Wmi9eWdF90PYZDlMOIsH+quIE8MeSc3gXuT:8zn4qHZZ0bfz2GQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712912459, "uuid": "dfcaa61b-5dd9-4e9b-ad69-afd4e9882223", "value": 35321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712912459, "uuid": "2a4f673d-4a21-42f8-8ba0-314cfded1323", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712912459, "uuid": "55f22255-9c77-47b3-935e-8c8187d1f031", "value": "FGS3963.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0666c78-f894-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712902906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902906, "uuid": "f24eebde-7b31-4a45-ae2f-0588dfa7423e", "comment": "Malware payload (CoinMiner)", "value": "ad121dd2df633239d4321f52a4c8bfc0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902906, "uuid": "69234e2c-e822-4c37-b4a1-4df3d97b86d9", "comment": "Malware payload (CoinMiner)", "value": "77e018bc4ed0354cb6391be242517fd069a343bdb7c663087f9e0e852f6b8da1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902906, "uuid": "5b3d19ca-ec3c-4f3a-ab17-d1bed19155d9", "comment": "Malware payload (CoinMiner)", "value": "3a3e176293d621efcd75035cde70f56f18331371", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902906, "uuid": "7d7d79fe-d8ff-4133-b4a5-1caa78d92678", "comment": "Malware payload (CoinMiner)", "value": "c05c9916169a36c9648705ddc7a1f4fa1c6478de1f2011029b5de7e44bf1c04b3567254a45ca32b505d91e3897fd4601", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902906, "uuid": "e073b91b-d9d7-4cde-bf2d-385821b4fe2f", "value": "T1AD754D98FA87A0F4DA630DB4518BE73FDA301E054028FBB7DF89DB48E473B56A209155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902906, "uuid": "a6b21bca-170d-4281-b9cf-41c97f9f454e", "value": "a12d186f65c99f872323a61923ce70d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902906, "uuid": "9ca7eec7-2d6c-4ee4-ab7d-4eb35c3cc0bf", "value": "24576:h1txXTADYDZL89t68/kGhluhQkibRRcJ9ltZa9AHjnLwPln5u5h4uhH3eDIOIu4m:JxDD9i68/kuRRcJ9ltrLwPlmhxOwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712902906, "uuid": "8378f728-74bc-43ae-8740-0ddb835597dc", "value": 1624576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712902906, "uuid": "4f94afd1-a5f6-4333-9f96-4aeff06025f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902906, "uuid": "2ca7f209-f201-47b2-a7ef-73ef644a81e0", "value": "77e018bc4ed0354cb6391be242517fd069a343bdb7c663087f9e0e852f6b8da1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb39b0b6-f874-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712889073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889073, "uuid": "51f2ef2f-ed3b-4c1f-b228-1a3e0594fda4", "comment": "Malware payload", "value": "2558cdc9fb257c536633df3f8f042beb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889073, "uuid": "b9a8ce7d-fc27-4430-94e2-9dd21b4da79b", "comment": "Malware payload", "value": "7b618b6ec494159dedf18de3074fe60a8571bd69f714a457ea3e10637f61d0aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889073, "uuid": "896ad54b-469d-4fa6-9267-22e225fd4a06", "comment": "Malware payload", "value": "72ec80a91a8d581d2e558e98c5485c911de7512d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889073, "uuid": "9122a0e5-107e-42bf-82b7-e5f843beaacb", "comment": "Malware payload", "value": "2197ed35e89482128990a9f972204e591c2daf4c2d8a298272ca17523e03d4b733e6761d22c99f67827655caa19b8cc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889073, "uuid": "1bbae182-bc6e-468e-9fa2-69781fa8070c", "value": "T12B163399B342C0F3E315AAB26C77854CC5F63466CAF817853468EA0F0B43B65F549B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889073, "uuid": "18b82f5b-0894-4fca-bf70-86bb6abcc4e0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889073, "uuid": "6d4e6f41-cd06-496e-a42a-45c88b20f514", "value": "98304:Cqyc0EnP2I0N6y6UZm1CHlDUFOhLnef6CgGi+u4rhDlq4O:vyQCzmI5iO1+gx4rhDg4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712889073, "uuid": "ea74b2dd-a86a-4a69-96ba-394501376f1f", "value": 4169531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712889073, "uuid": "ea24894e-bf59-4a82-823c-116c71fd4e44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889073, "uuid": "ece3853f-32e2-4358-aac9-f290a8ffc09f", "value": "SecuriteInfo.com.Trojan.Win32.Crypt.19298.29782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454fc0c0-f923-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712964037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964037, "uuid": "5283ba8d-7ed3-41e5-b872-0910c8108997", "comment": "Malware payload", "value": "c0e1412a621eab1679381dd067c34f23", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964037, "uuid": "d75c113f-03a0-46c9-a020-c5dc85661ff6", "comment": "Malware payload", "value": "7e398849354ed00565665b2ecbc207ad305cd3fd4bd0ff4691abfffbba217ea2", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964037, "uuid": "ef118f75-35fa-49a3-bf80-d567fc6f0aff", "comment": "Malware payload", "value": "27af9f0747c2145b65ff9577c229e36d4ba70956", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964037, "uuid": "0f1ab366-8aed-4975-b0f7-ff99a6eaf73d", "comment": "Malware payload", "value": "8cdaba27209b1f14d759686e3045f18b2e05fd3f63d539e49a7514bbcba16cd380fa69347b1f88d4c8f0c693f150da8d", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964037, "uuid": "7b149866-d5a7-4380-b606-a6accd7d19bd", "value": "T1DD84BF54F0D9CC8CF482F63A956D306D4B5DB1E7A9CDA8910D2D8B8DB00A9A1F7432D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964037, "uuid": "949f7224-5744-466a-9b15-756a91849a60", "value": "6144:BvuVMRdZ1e+S/h/k73cVHQayXKmrm3D5bp7TBkTnXx9Q2JPKBW0OcVfMajP:1uVMRX11S/lk73QHQjNo5k1LKBjZtBjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712964037, "uuid": "cc8d99fe-a2fe-4050-ab31-ecbe4dc88ed8", "value": 379545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712964037, "uuid": "ee86c010-19c9-4ebd-bcec-87a31f0d57ed", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964037, "uuid": "c11b770d-e178-4bcc-9857-bb7aae8fad4d", "value": "Overview.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c3fd94-f8d6-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712931131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712931131, "uuid": "4871e558-7625-4ded-b81d-0bbc1135b7e2", "comment": "Malware payload (Formbook)", "value": "47bb645643daab0fe4f3c163c6d02ebd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712931131, "uuid": "3c7e20d5-5b04-4e6f-b908-984a480610d6", "comment": "Malware payload (Formbook)", "value": "7e638eba3ebb8495e3205270a8ff7f7e55994c188799fc5b8e31eaf9e318e691", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712931131, "uuid": "b517e1d3-794b-4dd8-b540-e1d811d04e23", "comment": "Malware payload (Formbook)", "value": "0aa818c05308ed0b3eae8c18353d594640133665", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712931131, "uuid": "cc71cef4-fd1b-47ea-94c6-f2af7b7d595c", "comment": "Malware payload (Formbook)", "value": "903e514175f9c0fe7535c91822fa898b3316fe0f74f5cf5e7e00502f8ece28a76e50b3798804c83d47e430f01c7fc0b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712931131, "uuid": "5765b37e-c4c8-44aa-b5a5-3858f32a2a62", "value": "T18435CF027381D062FF9B95334F9AF6114BBC6A260123E51F13A81DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712931131, "uuid": "74b9cb73-136c-4e68-880d-487b2d936e82", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712931131, "uuid": "ffa0d7bb-0492-4510-9406-4a2d6a10f57a", "value": "24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8a10C28HKp:zTvC/MTQYxsWR7a10uHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712931131, "uuid": "e081dfcd-5220-432b-b4a1-32d6feec2208", "value": 1160192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712931131, "uuid": "2527a38d-065d-499e-944e-9a9b8125e481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712931131, "uuid": "fd456897-e060-46f2-95ad-ab3f446d674e", "value": "Documentos adjuntos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0e229d-f8f3-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712943327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712943327, "uuid": "70892644-98da-4e03-9e8e-d8cf9aabbfdc", "comment": "Malware payload (CoinMiner)", "value": "b7250436469d05b646b54b00ccb74d7e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712943327, "uuid": "8f3fba46-6e75-4695-a0c1-1a39d62eb914", "comment": "Malware payload (CoinMiner)", "value": "7fd525394f449871ea7be96a66ddc1ff6cb498aaaee85549cae392a782670780", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712943327, "uuid": "29bf9e5f-7b68-4e03-a7ce-5078aad5c324", "comment": "Malware payload (CoinMiner)", "value": "7ad840124e69004c862d0cf3f722b00cbfbbb9d3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712943327, "uuid": "caf7bd78-10a2-48a1-accd-d58472b0f4ad", "comment": "Malware payload (CoinMiner)", "value": "0b348e853e146e77913587b34b5b68be77730ce39b99784bb1068808b3bcc061a5a8b20149002c9bcc86f4a8b48469f0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712943327, "uuid": "c247b7b3-1173-49cb-8967-fbeb8d85d3d0", "value": "T1F916334537E49CB0F02125712AC53BBE67F4EF990F18A1E3EB980A58AC751E5543E2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712943327, "uuid": "b3dfe1a3-ba54-45aa-9486-da75c72678e8", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712943327, "uuid": "4248c579-1262-4c42-b597-c7458c203d2e", "value": "98304:tt5Uqm7J/F8CAXFSubtgfzlM87bnHzNLhs5rugOyMhKGiDy7:ttw7JrAVRclM87bnTNTgOywUy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712943327, "uuid": "5e3ddc70-0f61-4d9d-916b-46798d6d474b", "value": 4377472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712943327, "uuid": "5d5598f1-d46d-4d32-ba5f-f73f1c4949ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712943327, "uuid": "835d0ad8-380f-46e1-9fd0-ebb775646216", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d09b00c-f872-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712887949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712887949, "uuid": "7aa179c1-56c3-4ff0-8b76-bb950cd9f722", "comment": "Malware payload (AgentTesla)", "value": "ad90774782a758359f6ea16317a754f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712887949, "uuid": "65bef9da-06ea-4efe-a8f7-b91d72ee4b0e", "comment": "Malware payload (AgentTesla)", "value": "836130d92fa30a6cfdef9e8b66289d99f89ab55dbc3dbaa3cc409f565db5457b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712887949, "uuid": "a4de0938-1fc4-4f72-ad7b-0299d30e4fb8", "comment": "Malware payload (AgentTesla)", "value": "81b0d75be9fc14c58b557aa2b79ae3d4e21479fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712887949, "uuid": "7875448d-9679-4fa7-a4f9-c39718c5081d", "comment": "Malware payload (AgentTesla)", "value": "4ec0e35e498d61a9bef100bcf273c8ca103c0f30fc47167fe97487d6918ff4e7146f2abf3d31302d678f473702cfe7ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712887949, "uuid": "a841a9a4-f609-4b28-9185-f06cac98a18f", "value": "T1AA74122197692727D26C5179A7B2930463F34876B03AE3DEAFE574DB0B0B78F49211B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712887949, "uuid": "ee9d1d16-b611-4808-815c-034dd87e77f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712887949, "uuid": "0a9fe8ff-54d1-4cbe-b8f7-10d4f04dd918", "value": "6144:HeF5ZaVZrRpssF2tL4vswffk0z8YMvF9NPnRvWd+zFkNmfpPt7q/iJPl6Y3b:AZwssF2EjffpGhnR2Mbf9tPd6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712887949, "uuid": "c9b855b2-d97c-4d71-bc8e-c948dafe148e", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712887949, "uuid": "aee0e10f-4d2d-423b-8948-bff44fbb5fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712887949, "uuid": "6cb73582-53b3-433b-ac6c-0d5e58f32f0d", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b42219e-f8a9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712911568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911568, "uuid": "f9088f3a-88a3-416f-9a9c-15d6bebdde92", "comment": "Malware payload (Mirai)", "value": "42b9cd9fa9667fd6cb816ffa07dcee9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911568, "uuid": "f1184d4b-938b-4a3d-9534-b1bd00d1f78f", "comment": "Malware payload (Mirai)", "value": "8472cbd1b9ce6cbd04a09e175be0e4c6d3ed885ef597fb4883a6633bbf283cb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911568, "uuid": "25ad226d-ffd2-4071-afdd-4d56bb381109", "comment": "Malware payload (Mirai)", "value": "1b52eef315405838f8f805b34984925ff08c3a42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911568, "uuid": "23062cb9-fe56-451b-9cff-0becdb85509b", "comment": "Malware payload (Mirai)", "value": "da7163d69b6b3d8671ffd76ac84c4da903c1816c60b52eb06c9390a7ccefdbb6b23eecc4d4393c66da6075aff3d4b96e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911568, "uuid": "0fbf9fb4-6b2b-43ee-8a12-e1d12a53642d", "value": "T191C37CB2D8192FA8D024D8B4F4B88FB81BA3A58581571FF965B7C3B40487D8DF504BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911568, "uuid": "0d590c43-bb7b-44f6-8db4-53c4b5ffb301", "value": "3072:6R4zUjpm+l7hEjRLZgGx8T/cKllVlXAi6S:6UUV5YRL5Kl1Qiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712911568, "uuid": "0c3ad791-81d3-44fe-b269-9128782fd083", "value": 126180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712911568, "uuid": "5b4a5ca7-87f0-4335-94fe-fec91409678f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911568, "uuid": "296306d5-5fa9-43e2-b873-625c02c0f3d8", "value": "42b9cd9fa9667fd6cb816ffa07dcee9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d84930-f8e7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712938406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712938406, "uuid": "89ccd6d0-1549-4815-b470-d103d57f1d5f", "comment": "Malware payload", "value": "87731dd3ef153213b8c84fe9433014b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712938406, "uuid": "d657d56c-fdce-4dec-9463-4194dd76b6bf", "comment": "Malware payload", "value": "84c4d32dba431dd107652a42986b25a621382aa711050509c19ea68a436aad6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712938406, "uuid": "39f61e5e-14f3-4834-bfb0-df061f9ef934", "comment": "Malware payload", "value": "2efdda829f631cf400d9619070047cfabd2ba185", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712938406, "uuid": "4a260d49-f8cf-44ed-8f10-735a7ce607a1", "comment": "Malware payload", "value": "fc742f23ab1e03b897fc1fd94d3bff5eb105fe4fd5b0978afbf496fe565e8634c22d059b486ebbceecd0f0e84abed468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712938406, "uuid": "ba40c678-8f11-48e2-be7d-1834e2646ee5", "value": "T11FA62803F89541E8C5E9D134C6359263AB207C889B3463E36F60F7B42F76BD4AAB9354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712938406, "uuid": "bc983711-32d7-4c1b-a172-c6db4db4b08a", "value": "65892a964106b5e0c6c363fdf21975eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712938406, "uuid": "add944ce-fcdb-4ee0-9dad-a32216daea37", "value": "49152:V8BznNpHKrb/T3vO90d7HjmAFd4A64nsfJLFZSGd/yvou0NEA0+E8baQlKqklPNf:qXHu4uouQnUlfIQq0B8VVEVL23LFF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712938406, "uuid": "71981e52-ca32-49df-b9fe-2673a8fc475a", "value": 9801216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712938406, "uuid": "0673977f-49ed-4517-a90e-7bdbf9f1388a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712938406, "uuid": "43a2bc27-e8c1-47ef-90d7-195aea041b75", "value": "esbuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd8afa8-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712905962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905962, "uuid": "3cf74544-f5ef-4f90-8c7f-41aef4faa670", "comment": "Malware payload (Mirai)", "value": "c25126b16bd1c063911afc5384169d82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905962, "uuid": "6635c62e-96c6-4f66-9852-485dd3453f75", "comment": "Malware payload (Mirai)", "value": "88b943156e7c0c73712fecb95b544ca8dbaa31707cdfee91d7f5c3e1ca90b55e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905962, "uuid": "9f07b0d0-c7b3-46ce-978a-c64ba08fd6ad", "comment": "Malware payload (Mirai)", "value": "396b6abe211d01b6a5fd2e1ff966206124364304", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905962, "uuid": "8d91217c-5f27-410f-a15c-50b5ceb1460b", "comment": "Malware payload (Mirai)", "value": "d602a8a4244b62f15414439e0c9285b0a4dc948e055364bfbfa8e9b6bd3a7e398ca43d095bbba587d6e7adf1a3de403b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905962, "uuid": "b4888370-fc5c-4d46-8bf1-17970ecb11f8", "value": "T169332B03A94140FDD485C1709A7FD537DA31F8BD1135BA4F27987E612E32F211A6EAC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905962, "uuid": "9474630c-cb1c-457f-a310-e17f9ab8ffab", "value": "768:NHe+Ivf1+MMkgblDzZ4zC5tKfRA1XAwh0k7pW7ZoRj/LkZ8AQJguF3st:RIvgkiuC54J6XAwhxYFajzk7Tuut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712905962, "uuid": "b3e93aed-3a0d-452e-add7-a4e0f7638796", "value": 53584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712905962, "uuid": "98d85f09-3711-42eb-bf5d-1d0fdbaa66bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905962, "uuid": "726b3d64-a927-41ff-be80-7d2be6d15ca3", "value": "88b943156e7c0c73712fecb95b544ca8dbaa31707cdfee91d7f5c3e1ca90b55e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354d8d96-f8a2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712908605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712908605, "uuid": "e75b4213-9ce7-49bc-b501-e2f2a83e12b1", "comment": "Malware payload", "value": "c138ebe56c9e9620360e3217e7e1f967", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712908605, "uuid": "ad4723a9-5273-4d1d-8633-cb0a7ceedea9", "comment": "Malware payload", "value": "88d32117d679bcfb1ab728f34abbaa9cf6edfcd6955c4924de8bf4c730a713ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712908605, "uuid": "d0965266-bc7c-4a01-9e10-fa530191d760", "comment": "Malware payload", "value": "853fc4fd3e2b8b3d907489b13e349b791d2e172c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712908605, "uuid": "b57f46b2-115f-49ab-a104-bdd6c7b5d033", "comment": "Malware payload", "value": "f436718ad7a7ef472272b3b8ffb22c15ece706a4adca126e9692814198cce2a67f2e4b6cd114e864404ae8831357884a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712908605, "uuid": "b2ce1341-1518-4202-bdf8-428c43da5397", "value": "T14CB4F222D361B77DD6271D309969CBE01AAABC61DA705277278C2E2F3D7C780D927312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712908605, "uuid": "5e803d7e-d9e3-409d-937b-57aa44409f12", "value": "e03af4c47837fbfefcd192e4bab71da3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712908605, "uuid": "5c78da12-1537-4fad-966e-0b2518ef7495", "value": "6144:DyQs5pHvN1W10cBdjRusnpfBOL22g0rza6whsRwrmXFaMHw/ru5yonr:1ypHvbIdjBfECH0k1rmXMbUvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712908605, "uuid": "477105c8-a100-4d5a-98ac-03933544815d", "value": 502273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712908605, "uuid": "1655d5e8-23ce-4ed2-8bd5-1ebb2e0aeccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712908605, "uuid": "4df543d3-05f3-41da-9502-0e7be293e646", "value": "c138ebe56c9e9620360e3217e7e1f967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15279e4e-f8aa-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712911987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911987, "uuid": "4b180296-6e57-48cf-af07-667ed068e1a3", "comment": "Malware payload", "value": "b1930d948295ce3f3dee5486eba533a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911987, "uuid": "117a23d5-012f-4710-8707-bb1f85930c40", "comment": "Malware payload", "value": "8958e79e7edf7c48b97c4ee2a9cc22b4306fdc16a0395333af2054ec8460c868", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911987, "uuid": "14139cc9-044b-434e-9af7-b84df2dc8790", "comment": "Malware payload", "value": "299bda27302ad6134b97040de67c628ff64e9895", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911987, "uuid": "bc32c21a-5cb3-4b3f-89ca-9b58ee0da5af", "comment": "Malware payload", "value": "f6313ef3e09e3b90f13dd1f4b9849dd51b2029fc42cb0c72a11b60f176eca7a7803adf08b390d3639621bd1f6e35b643", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911987, "uuid": "aa251c86-e278-4dc8-bf4c-0a6b877c3331", "value": "T13313C68072C4B48617876BF7BF2BB6D5ED2B88D8398C4017E514FC64B8B6615E9B0E31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911987, "uuid": "862afa04-c7fb-4361-8ca4-39eb5cf27dd6", "value": "768:mP3uLuaZHr73BcdSj8ekIOJZsxqgn7oZfoLJEDvR7e813hg6d8od+pBlQe8zO1JS:bRZAtXla8aI0ldcQID6D6N5OAE0fmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712911987, "uuid": "37b26156-41bc-43c8-9814-a777e18375c5", "value": 43419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712911987, "uuid": "1c643fae-73a6-4dcf-9182-aa3e46d04bb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911987, "uuid": "5987444c-2c76-404b-bdd5-75b17c068204", "value": "FGS82.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5adadf0-f863-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712881762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881762, "uuid": "f96d21e2-389d-4ddc-b4ce-9a209b9b4488", "comment": "Malware payload", "value": "bf6fd5cb8b501e97aa675beea8425d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881762, "uuid": "466caecc-b909-4a3a-9323-c70cd14980a6", "comment": "Malware payload", "value": "89c57a4db59ab44a20a5ef66659c149f73ba632a08d3fb21fcc5c0b641fbcaaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881762, "uuid": "87fc4d34-f2d1-430a-9b45-724218452cca", "comment": "Malware payload", "value": "e92c74aaa85fe547a0ac67c833fae0887350843b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881762, "uuid": "53a92150-7d4f-45f0-a271-91cafd1a2355", "comment": "Malware payload", "value": "352e6a8175cf03b5030940d4debaffae241354dc6133772a5eeeed9a44ca84c402e5be6d412cde6c626820960cfddbb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881762, "uuid": "0a812e32-c97f-40e7-a0b1-6d8544f38e02", "value": "T19F3733492706815EFA2107B1D363C94B8324BF44A3853F8BADB9BF5F7738D406CA6256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881762, "uuid": "50b9796a-6c5c-4d93-b6c2-d3beff55f718", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881762, "uuid": "a809e439-4ced-4e48-bbd4-1fdee4433b68", "value": "393216:sNEADSfxHlqCSh2vYiuP/TAITlBo907uaSZl6rXD9W0z/VkII/lbLDj+S:sa5FqCSh2oJ77AZ89W0z6IwdTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712881762, "uuid": "64623aa1-b18d-4447-b629-8d68c784c527", "value": 22573720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712881762, "uuid": "dc07dc1c-5a35-4a6e-a9d7-f604784178f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881762, "uuid": "bd3eab35-8e22-4dc7-8ce3-2e45043d389e", "value": "SecuriteInfo.com.Program.Unwanted.3168.16542.713", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec42c958-f894-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712902899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902899, "uuid": "cce80953-b995-499f-8e58-0717d97421ff", "comment": "Malware payload (CoinMiner)", "value": "d210f774eba07788bfb68450a199ed67", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902899, "uuid": "fb195fc8-139f-45c6-beaf-a7e5594d2f89", "comment": "Malware payload (CoinMiner)", "value": "8ab1953675c219c460f81c7184bad4dd82775d58fc7c3504ff00f7af46b09aa3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902899, "uuid": "46ea7370-cd49-4573-9839-5f8c15c66724", "comment": "Malware payload (CoinMiner)", "value": "62401586a71ef4116f7d120864ec514a0ca475f9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902899, "uuid": "6b726f7f-fb08-440a-a8cc-b540a245f59d", "comment": "Malware payload (CoinMiner)", "value": "92d6439ec1362aa72151ff7ced021a8c0f632c40ad239214c93412eb18b13dd6d2731ce3c027bbcab5c0dc220385bcf7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902899, "uuid": "12a4c03d-215d-4330-8de5-ff1deb01b959", "value": "T1C1754D98FA87A0F4DA630DB4518BE73FDA301E054028FBB7DF89DB48E473B56A209155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902899, "uuid": "e3b1a594-7601-4921-a748-5cedf3b7e9ab", "value": "a12d186f65c99f872323a61923ce70d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902899, "uuid": "fda8245c-e25e-4869-ba87-c90416970588", "value": "24576:P1UxXTADYDZL89t68/kGhluhQkibRRcJ9ltZa9AHjnLwPln5u5h4uhH3eDIOIu4o:2xDD9i68/kuRRcJ9ltrLwPlmhxOwVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712902899, "uuid": "3454e080-0501-45d9-acb3-e2843be8f799", "value": 1648640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712902899, "uuid": "c189d0d3-6461-4398-a1dd-b5d2ba5db8e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902899, "uuid": "c163b164-c953-4b74-b14d-759261681c3e", "value": "8ab1953675c219c460f81c7184bad4dd82775d58fc7c3504ff00f7af46b09aa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c6dfdf-f8ab-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712912525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712912525, "uuid": "9ff72dad-cd43-4175-9b4c-6eac16e070d8", "comment": "Malware payload (AgentTesla)", "value": "f771b1cb194b90822cf0858ed1b8c53f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712912525, "uuid": "65cdaf4e-f5e1-43ec-b833-07f533dd8fe5", "comment": "Malware payload (AgentTesla)", "value": "8aecc332190993a0043dcac503a2ff433066f21601de80ba833fb6ddb4e71b96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712912525, "uuid": "642c5c57-11b6-49eb-a629-e3bf775acd5f", "comment": "Malware payload (AgentTesla)", "value": "04323e1e488de40a050072de500713cab3a766e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712912525, "uuid": "b82e118e-351c-4138-ac17-e2186c0a4698", "comment": "Malware payload (AgentTesla)", "value": "cc581c600927de1a333d4a171a87657ae587c359f133daad6025b8e8cb6de823569471c952c5180a862a616934fa465b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712912525, "uuid": "b664ccec-4ffa-47e9-a67e-dcbb7e24ee39", "value": "T13BD423A418DC63A3CA55D3B02EBB308033B8F69F3991F675699269CAD007F429917F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712912525, "uuid": "27e6a537-5e80-4abe-8366-46a90efe2d9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712912525, "uuid": "8ff09c45-594f-430f-b9e4-da3908b84d3a", "value": "12288:Kkvq31eoWllo5kgwRDhSF3pJYNJB/K5stWpI0e2u7qEbmdu6LTdK5QUlIL:KeqF8gYFSF3XYrdK80LjLTdK5Lla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712912525, "uuid": "c5927428-6632-42d6-9f61-85cea314cbcc", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712912525, "uuid": "2eadcfdf-77ba-403b-bd68-ca0578d4f3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712912525, "uuid": "3429b3a3-018c-4432-afd4-3436a3a97378", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c45ad5d-f924-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712964452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964452, "uuid": "a9d07348-945b-47ef-9692-4077754db3d1", "comment": "Malware payload", "value": "911515ad0d18a5963dcfa4871b54f7e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964452, "uuid": "96c8ef9f-5af2-400d-81c4-3b755fe288e4", "comment": "Malware payload", "value": "8c72772fedf64247249c06502fb78dedcd3b33284f9305c3636bcd6257e43320", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964452, "uuid": "76c736bf-9ebe-4a33-bfc9-e6594cf0d9bd", "comment": "Malware payload", "value": "b7976eca8e900904301ac1466acf55622645b433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964452, "uuid": "86a4e4c1-7083-454c-818c-224a9bdee3c5", "comment": "Malware payload", "value": "8f7e0e0095dcb9bada25295fb73602cdbf20a5a2b44dd820755e84fc68d49d74b89debb63c83814ff5d8f031530d3c45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964452, "uuid": "f24f16f7-a912-4892-a08f-1f0065103190", "value": "T1DE863316D1B0186DDD750EF319BA8BAE2C19BC28BC70F5DE2F2A71AD87B31C2045D994", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964452, "uuid": "3022f36d-8935-4bcf-86b8-f41e026a7c2f", "value": "b494ac5956b5aeff6b87ae60113ee269", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964452, "uuid": "a7bae005-b88c-4fe9-8fd6-d34b6df8563f", "value": "98304:dvQkqRQrDB4/nvQBGZ8IlnTvhm3sPsViCMLf4wJHI6p5Vi:dYHurQIB+7yGfQwJp5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712964452, "uuid": "a7964c74-2f36-4a8b-8205-14baa0660209", "value": 8385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712964452, "uuid": "67fa2d88-150d-4f65-88f1-c0935cc73398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964452, "uuid": "2386ab87-c904-4d6d-82d5-b92f4b10f6ee", "value": "SecuriteInfo.com.Win32.Malware-gen.30016.27473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01dadf4d-f89d-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712906371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906371, "uuid": "011d4a9b-42bc-43f4-8b13-8bce2d813a03", "comment": "Malware payload (Gafgyt)", "value": "583fb42a13fa0ec16a6e26bf327a8a10", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906371, "uuid": "6944a39b-f977-4514-b544-1c05387b7693", "comment": "Malware payload (Gafgyt)", "value": "8ee0b4f393548cc8f958e6188ec57674a13435c4a731abd5c156ca8fccb55f66", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906371, "uuid": "666fc8fd-a5c5-4684-874f-b415e5a1d480", "comment": "Malware payload (Gafgyt)", "value": "3ece6de13a9e7d586f256bd6c543052b14fad075", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906371, "uuid": "250daef8-e97b-4e5e-a3a8-a63d787e58bc", "comment": "Malware payload (Gafgyt)", "value": "7a6f68811579704e16d64ba8c390ba68b0cdfda0503563725ee79d5c2d9939a856d93418188a23d80bf82841898e1941", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906371, "uuid": "a35ce5a2-8419-44ac-80f1-7ba060a277be", "value": "T1B2D30837D654887AC04712F11BEFC6229D23BCFB0731215723987E605F378AA9E99B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906371, "uuid": "f8098365-2225-4681-a1a6-6d809ad751fe", "value": "3072:7GGZgLD3hhI2fKGHOZOSp6iKoKkSmr1zwTdWNn:ODBvchK/mr1zwTdWNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906371, "uuid": "f778bb24-65b5-4883-9674-c0a9efe3f3f9", "value": 132185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906371, "uuid": "8c197463-273a-4a0a-bc2d-d68b80ba301c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906371, "uuid": "c506b805-4dac-4236-a8b8-fa5ce365c052", "value": "583fb42a13fa0ec16a6e26bf327a8a10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0e8f15-f91f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712962248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712962248, "uuid": "42c3c7c8-49f6-4056-8625-75fcba636347", "comment": "Malware payload", "value": "ba1859659089253621e5a65181ea94cd", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712962248, "uuid": "79c642a3-ada5-4f34-beab-64bbc354285c", "comment": "Malware payload", "value": "8f8abfa6717ad2043a295d16b5aeeac3e7084b7994f6eec8351e18a9a3c59997", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712962248, "uuid": "e4373b82-2728-44d2-91ef-442c3b41e04f", "comment": "Malware payload", "value": "724f4cfcb3a8701328b4bbef43dd94a404fe71c9", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712962248, "uuid": "d32dfc46-042a-4f27-9ef1-2f3dcd06e3a8", "comment": "Malware payload", "value": "35100f4f4103631988e1ad853116a23425c9e43b6dfb1c407067fa44b0b37b84917c026089d017a18a5951c16c77e502", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712962248, "uuid": "839829a6-4b37-4f7e-af22-c18d0db8f59c", "value": "T1BF137AB9E43AFD90076BB1D045BB7D8E34A5A1738678C4E8B7900D49B610A677F3C05E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712962248, "uuid": "4dba4d7f-6ee5-4ffe-ae33-18186f0d349f", "value": "768:J9ayMjsGxl/1feyDltGtlCs7PYXJ/A/ne4gj3MUc5BxKtwXPNnz:PnE/s5zxKtCPNnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712962248, "uuid": "918a3bf7-ab5e-4deb-a6d2-960286d73cdc", "value": 41781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712962248, "uuid": "d072d5a6-f1ad-4259-981d-86dfbad47b07", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712962248, "uuid": "d3425e6d-25aa-49b9-8e38-c77b3976b849", "value": "DPO_SEC23-1_OMA_P-3_18-ENG.pdf.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d0f642-f8e9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712939025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939025, "uuid": "0ed43be2-45a2-49ed-9801-d80bee54a01b", "comment": "Malware payload", "value": "868294552bb608267507ef69efd24249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939025, "uuid": "f21dba47-33ab-4b09-a022-4e7f99f89eef", "comment": "Malware payload", "value": "920799e24ec5fab86578062a9eaafc2838d2d91aeea428c6c34ecb6f4f9eeb36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939025, "uuid": "c4253cb3-bc1e-469f-81a3-90f6029bcc75", "comment": "Malware payload", "value": "dd4bddb410ac9913aebcc71ebc8e949fb20ba0f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939025, "uuid": "c56a7beb-cef7-4022-8a11-8d8a74bce1e4", "comment": "Malware payload", "value": "66b84164107fa6be9b7b3141f21e5a03f0441e3f4befe4f048d99a8de4999fce11835dbada1e22611a59640e297c243b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939025, "uuid": "68501b73-2c23-4db1-861b-ce083b609691", "value": "T127C6BF12B285507AD8A70AB6482FE6A4653FBB703B324DCB27B41D8C9F356C15E39707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939025, "uuid": "c33f9ec1-42da-4e48-9a79-738bcd5da72f", "value": "54996a3237ee9488c1e8915bed6d19ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939025, "uuid": "25c4ba28-a0e0-49e6-a477-74c2791b9c7f", "value": "196608:poGYg+uqoXh8V2KQqGfyxXIicOExzUx8Bssun3f6B2+Hvrxjfl8uWlYj88W:qGYtMh8V2KQH6uBsc99TOlYj8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712939025, "uuid": "651845f4-f329-44f8-b659-edeb4e7ad7c0", "value": 12147284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712939025, "uuid": "07d9467c-0c73-4e7a-98fc-8d69531cbd97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939025, "uuid": "aec188cd-12c6-4acd-adc1-f9ecaf13d4f3", "value": "SecuriteInfo.com.Win32.MalwareX-gen.23084.22184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6cb935-f8a8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712911226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911226, "uuid": "b5d2af62-1253-4d99-8ef5-b7d4d70ed1db", "comment": "Malware payload", "value": "9fb615daac3943f947eb3e58ba0ad619", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911226, "uuid": "44543140-3691-49ec-a841-ab3a2ea5e0eb", "comment": "Malware payload", "value": "9237495e0ce63c60224091d7e83285b745272e3bd276efe2dd0153c8dcd67f29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911226, "uuid": "82ba08a5-a5ae-462b-9fa9-88af5b5144d7", "comment": "Malware payload", "value": "8a697656564befa506cab0d2b9c83bd1c4ea0957", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911226, "uuid": "26541393-2e35-4ce5-933c-f297c1c4dd27", "comment": "Malware payload", "value": "0d59569905f8fff803e93ad304d3d8e5e816c59e58f049e11a89dbaedaa0d127bab2d842b3a1bc8ca06c2abd0130349d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911226, "uuid": "ded5df83-273e-412c-9675-056b3c8c4ff6", "value": "T1C2B4F222D361B77DD6271D309969CBE01AAABC61DA705277278C2E2F3D7C780D927312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911226, "uuid": "71a02b33-6ee7-45b6-ac74-6fc7d974da2f", "value": "e03af4c47837fbfefcd192e4bab71da3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911226, "uuid": "4fd2433a-06bf-498c-8a99-4bc8c1d023f6", "value": "6144:DyQs5pHvN1W10cBdjRusnpfBOL22g0rza6whsRwrmXFaMHw/ru5yonl:1ypHvbIdjBfECH0k1rmXMbUvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712911226, "uuid": "35b68d49-95b4-4a7f-9089-0a50497452b9", "value": 502273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712911226, "uuid": "3e85ef06-2d98-4284-b6b6-6d9ac65a2aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911226, "uuid": "97bf1a42-deb1-433d-be28-9b175c368c18", "value": "9fb615daac3943f947eb3e58ba0ad619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eecec67-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712905964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905964, "uuid": "14f9534c-6c22-421e-bfa0-5545ab108c9f", "comment": "Malware payload", "value": "8886568ae8409dc2bdfcd1e30b82b25b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905964, "uuid": "3ce67a44-0833-4587-bb59-851e24ef8d2c", "comment": "Malware payload", "value": "93bde742b00660bcb0e125739cc082bb448a0380f3e10dc10f1095e3ae2591e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905964, "uuid": "1346a55b-5d19-48eb-87ee-d78e41c9d2bc", "comment": "Malware payload", "value": "062edf09dbb587ee939f20e42adca0b6f1043f2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905964, "uuid": "81c39431-b840-4e85-9a09-87ea0d8baefc", "comment": "Malware payload", "value": "45713faf2228e1175f6aeef561a4ddab60d11fe34a4ee9b8b553a7c86c40e80d70095018e646a69e17ab569cf94ab85f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905964, "uuid": "0585f83f-0b75-4d10-a74c-b8100e8f1d8d", "value": "T176753378E7DAF05398E235AD4967C941F88871821001FC2B6E56B2296FBF4417CDAF6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905964, "uuid": "1591de77-18ae-4983-99a6-f6d36805f5c0", "value": "49152:4HFOL3DUwYhjsXoYhzdLnaAbTZKF0QCsWg+:MFOzIwYhjUzL3JKF7CsWg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712905964, "uuid": "b095949e-fc6d-4502-8414-50e25b31bc1e", "value": 1610548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712905964, "uuid": "5f0e632f-04f8-4275-ab8a-57740510574e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905964, "uuid": "d989401b-801c-4629-94de-18ca169bb9c5", "value": "93bde742b00660bcb0e125739cc082bb448a0380f3e10dc10f1095e3ae2591e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1521c822-f8de-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712934321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934321, "uuid": "c6fc7100-a9f5-43fd-b8c8-f2fa7f78f04b", "comment": "Malware payload (Mirai)", "value": "e1d862be03722dc0f5e18ed220255ad3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934321, "uuid": "34e0490d-c0c5-459e-b2d9-25479f1b1c79", "comment": "Malware payload (Mirai)", "value": "965b2f50d8cadb8d716f06941efcf721eec75124741a84be0fbf73993b3790e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934321, "uuid": "2883745a-ffc6-4e9b-9653-2df9c9a84681", "comment": "Malware payload (Mirai)", "value": "7b2e1911f0b6091baa9bf4e92bdc03519cbd871f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934321, "uuid": "bc74857d-7e59-45d1-a839-ea2e552555e1", "comment": "Malware payload (Mirai)", "value": "6f198555b6a64ccacf6b28c65aaf171ebc4849c083ecb11e8250cc179af8bfc1ace5bf16f7cb0e5dc90881128a5606db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934321, "uuid": "935a7c61-2091-40d0-b4b8-b7d06ef528ad", "value": "T127E33B56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679E0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934321, "uuid": "ea721d6d-d340-4243-ac45-2caebb74f289", "value": "3072:aJrc+XJSlE7GaGUOwRNaXipxsox1l/dXkkTM/9k0Y:aJrc/IGaGUOwRNAippn/dXkYM/9jY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712934321, "uuid": "7c8365e9-9974-4a89-8c1e-05e6b93edc3f", "value": 150626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712934321, "uuid": "15bfe116-5ff6-4a5c-a58c-765e27f2a884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934321, "uuid": "6583bfb4-91ad-471f-af18-ab7d626cb6a4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24efe5eb-f8b1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712915020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915020, "uuid": "16e60fac-4d05-4e2c-b9fb-f4cd6443a6b1", "comment": "Malware payload", "value": "299cd4b4a7538e5a3aff97990522020c", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915020, "uuid": "f455cc60-6902-4434-93dd-b502d3161856", "comment": "Malware payload", "value": "96e22fa78d6f5124722fe20850c63e9d1c1f38c658146715b4fb071112c7db13", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915020, "uuid": "e2770028-48dd-4105-adce-08f39e9703f5", "comment": "Malware payload", "value": "637b17432cf9c8620284fca2356e472ccda61be2", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915020, "uuid": "7254be4b-5359-4d29-89b1-5b46e5a42c9d", "comment": "Malware payload", "value": "a61dde1c5f9563766600ad1a05b6f78becfe384681db0b9edf95d0574a334fb29dcbc2431d7d177daf70ff2cc6b97e9c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915020, "uuid": "da8ce1bb-e502-4679-a024-e583af80315e", "value": "T114E261593C4761660A37F27AAB7BB509FF75803B1201A140B85D836C2F70E5052BDEEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915020, "uuid": "80b3d8f8-f044-4849-909e-cf219e7321f9", "value": "768:8oOhcMYC1hXQBYtZ4kHqv1TQCfCxc5KTPBoMqS7j8frPWgtZPnCUQpBNgZnFFQEB:qtFXZ1OQCfCxc5KTPBoMqS7j8frPWgtd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712915020, "uuid": "1cd2610d-c052-4524-b3a9-34a42cbc9fd7", "value": 32876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712915020, "uuid": "0641297e-6ace-44f2-be1b-2ca4de323f16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915020, "uuid": "e9811f97-ff8a-4ddf-94ba-37c6eab246ab", "value": "EXCEL_DOCUMENT_OPEN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1ef207-f8de-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712934308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934308, "uuid": "6b9019ab-873b-4f60-933e-82251887fa0c", "comment": "Malware payload (Mirai)", "value": "06312365f07403e792d912fa14b480cd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934308, "uuid": "1e7b9b18-7067-4a05-a456-71f1eacac7b2", "comment": "Malware payload (Mirai)", "value": "97345c71e17a2593d6d821982a3cc7225b6a0fd2860695241ca637122e4a05a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934308, "uuid": "8174e37b-968b-49b0-a5f4-d77cae4cb526", "comment": "Malware payload (Mirai)", "value": "a793ad37db9bee72c3caa81a048636170f131d9f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934308, "uuid": "44fa6faa-df73-457d-8a3f-cd55a937120a", "comment": "Malware payload (Mirai)", "value": "4e659b223bc5bf52c26bbfd6d8fb6084ca159d3df3d23d94f27b82da113d080c083e54e4688607210b289e52bba3b40d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934308, "uuid": "a41514fe-e411-47ad-a015-5ff6aaaf9a36", "value": "T13AC3D72A7A119F6DF69EC63147FB8E21966527D127D2C140E26CDB102F2138D684FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934308, "uuid": "066de4eb-e083-439e-ac05-f6f55ded8d57", "value": "1536:zbzrMvOLw+XgBL2pwmlOSOGnPOk19vHirKZCeVahBrqFDsfNoY926O+QCBSX:LrMvtk/Fl9KAarIsfNoY975a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712934308, "uuid": "a84f5536-9420-4c07-84ff-b509479cf90b", "value": 129669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712934308, "uuid": "e6437bc5-bb12-4b95-bf65-14aeeddfde9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934308, "uuid": "4fffd0a5-4276-47af-afa7-1c066806790f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bec868b-f8c8-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712924910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712924910, "uuid": "e40f11c3-acc0-4c37-9fdb-1996803cb9d1", "comment": "Malware payload (RemcosRAT)", "value": "58d7c309074a22de4d483eed6644e178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712924910, "uuid": "0b0d87e3-6792-4880-96e3-d51c5368d85c", "comment": "Malware payload (RemcosRAT)", "value": "9942af44037bcfef5830dd71011bbd6ecc4c79c8bc1e62018eadc3ea4012e38a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712924910, "uuid": "21a46566-47a0-4540-b86a-21cadfeaca82", "comment": "Malware payload (RemcosRAT)", "value": "3efaf0578e1d791aab2327bf6dc798edcff51e40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712924910, "uuid": "3a6c6f19-146f-4f51-96a5-3c88279727a1", "comment": "Malware payload (RemcosRAT)", "value": "66c4c2f7decbe9342bb810d8f02375ce79346790cdc3edf6a5d19063f4cd243dc2971472a6242c135250c64602791e21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712924910, "uuid": "efaaa21e-9ede-4c52-a5b4-3ba8e2eff700", "value": "T16925238567948741E6FAABF0249047012335C1AABE32CF6E8CDA60CE45DBFA11171EDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712924910, "uuid": "d7bf971f-4aba-47b8-8a0c-672317d75aea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712924910, "uuid": "cf2bf7e7-3d1f-4c6f-b737-160930dba54a", "value": "12288:8uPrxJ0ozI33GyvaWLRqvrEuHeZIKKSjh4W5/l7QnfwpzIeQ8pICdgAFsZWbkR:nT0osnGwaw+F+YSlGoJQ8pjdg3W+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712924910, "uuid": "cdc28f75-744f-4418-a2d0-f520bd37cd2f", "value": 984584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712924910, "uuid": "75cefb2e-231b-4687-94ec-2eea4db8cbb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712924910, "uuid": "b7169e95-ea56-44cd-9e53-e514dd90daca", "value": "pdtzx.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe2a63b-f874-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712889074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889074, "uuid": "a85a9862-edf7-4c5c-80f3-54608929dfc4", "comment": "Malware payload", "value": "00d8e1844ec529593272eb9d902e3d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889074, "uuid": "b750ae6b-a6ed-4d4f-8e8e-1f0214e20a93", "comment": "Malware payload", "value": "9b85ed923bb979b15c593a99e759cdd1cfb4a43d7e9f72b6117caeb39d8b335f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889074, "uuid": "88723811-3003-4a0f-98dc-bfb2cbc35df5", "comment": "Malware payload", "value": "c7162c4ea4bd6b5d1318a9b1c9a31806ca4f845c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889074, "uuid": "e544384f-caa2-46ad-92e9-f51f88839abb", "comment": "Malware payload", "value": "3333194e011992e0fe330765045244b235273f09907d850120d70ef69236b1fb9f46c3813f8a9a8c412dd59fbf438d61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889074, "uuid": "d7f14e72-45b7-40dc-b729-40e9a5280b49", "value": "T14254C9626493CD41E816BB7E9C73F0B5D61E2E32F9D39EA268E07C07B772D9169C0061", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889074, "uuid": "37955f48-a480-4954-9b94-ae1ef243472b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889074, "uuid": "b5e1ab47-9da2-4ba1-afb1-914ae8065215", "value": "768:3WQA/X1gIWTVVV0kinKE1Bkc3kKCvyq1UOadTS8SEIUgD5yK5Czy3:3WpXqykinDkc3kKCvyqqOa5SHfGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712889074, "uuid": "25bf42c8-ed7e-4a62-8367-3ff14f46826f", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712889074, "uuid": "980eb2b8-e2c1-4104-8c4b-c70c87061f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889074, "uuid": "c5ae6f1a-2111-4c96-b71d-3c944487111d", "value": "SecuriteInfo.com.Win32.MalwareX-gen.9488.9320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c155c7-f87b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712892116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712892116, "uuid": "14ea1f1a-e1e8-44bd-9a7f-9f54c2b18c8a", "comment": "Malware payload", "value": "f6602c1b43b86e19c3f080a6dcac7974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712892116, "uuid": "4363afe3-c807-4505-8aa2-436a93358bf2", "comment": "Malware payload", "value": "9c8271340f2dacad0ee15a97d9db831eab0928bca99b17d2733f2ae82d41fa30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712892116, "uuid": "0ec1080a-e46b-4597-9c53-75a8b9d8b9c9", "comment": "Malware payload", "value": "bb99ef9d0fbbff97692d4d173e97d579d2710393", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712892116, "uuid": "062a4166-abb8-46d9-af6f-b972966711d9", "comment": "Malware payload", "value": "72b4b514e7877758d90a529a117ba36531d15e8667fa49972e0cfd1df366d5642d65afca6399c43af5a2e93b299d791f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712892116, "uuid": "4fe1e748-7d67-45c7-a794-3ac25b16f0c1", "value": "T137163319E3F3C271E82056734BABE05C65563F6289A31EC04379180EBFE35C4D6B66E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712892116, "uuid": "dfc4d717-b2f7-4d48-a655-f87fd07c40a3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712892116, "uuid": "151a5e39-667c-4402-9f5d-17986cdd70ab", "value": "98304:CtUfIi2ub+s44l0M9NNgCze0l81HNbW83X1O:uyAubZ44mOHgC60iTbW8VO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712892116, "uuid": "c9095e58-20ee-4dcd-a57c-772ac138bb77", "value": 4164977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712892116, "uuid": "9b4cbb0d-bf0e-400c-9a49-6086c6f7d0ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712892116, "uuid": "11874aa6-9444-4fe3-94e2-7e8bedba0f9d", "value": "SecuriteInfo.com.Trojan.Win32.Crypt.19930.13722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0f7a09-f894-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712902627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902627, "uuid": "e45f9cdb-3725-419b-a7c5-ca851eae32a8", "comment": "Malware payload (RemcosRAT)", "value": "9be7960f23ec1182ae6a05e262c10400", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902627, "uuid": "21242327-7187-4981-b8d2-26fe2fe1325d", "comment": "Malware payload (RemcosRAT)", "value": "9cde368e6a25d30c4f7863bfd6dc9a6ad84d932b495974c69bfb0a5dfafe4a69", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902627, "uuid": "f5dac24e-0edc-4763-b27d-73c1dc624d5e", "comment": "Malware payload (RemcosRAT)", "value": "69c1ee81ec20e33686f6851ab811006c6e90626b", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902627, "uuid": "cce8d59b-d99b-4f76-85df-aa1eae9651e0", "comment": "Malware payload (RemcosRAT)", "value": "99a46d3a3a00769df06603517613856b5274d6c70ba2493755b387d25994b72cb0388cd4101c019f1b1e7d7f886e8f7e", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902627, "uuid": "1c7c4da3-7739-49cd-9e11-a275786269a7", "value": "T195B49E01BAD1C072D57524300D36F776EAB8BD2028364A7B73D61D5BFE31190B62AAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902627, "uuid": "abe84ed3-0a95-40a6-ac08-9a79c12a0dfd", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902627, "uuid": "607b8de4-b901-428f-a1b1-6873b81cd775", "value": "6144:AXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNJ5Gv:AX7tPMK8ctGe4Dzl4h2QnuPs/ZsQcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712902627, "uuid": "f1f23945-f429-40c8-a33c-986cbb75c3d2", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712902627, "uuid": "46a0b7b6-b64d-4939-ab26-21cf9b2f61ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902627, "uuid": "e1c5997a-efc1-4f95-95e6-006dccc32a12", "value": "1712902626233df64f4eba73a089709b256c68241013dcfa8291717d4ed3615a576ca4f565438.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a810612-f8db-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712933149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933149, "uuid": "9c9d6d35-41b4-4687-aef3-61f589fea26a", "comment": "Malware payload", "value": "a04ce34c1e4f898de353f5de4c21d73c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933149, "uuid": "4a56baf5-12fb-4397-9d4f-443774e6630e", "comment": "Malware payload", "value": "9eb057d95ac2466833ccec04095b0b657a35a51de5d98823b9f92b18d1e2e45a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933149, "uuid": "918aadc6-0f02-4ec7-8ebc-1f48ac9aed9a", "comment": "Malware payload", "value": "116b5d03cc3fce687f3fd85fb729458b48c79570", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712933149, "uuid": "a7c8ad7b-6111-45ed-abbc-49b6e83a91d9", "comment": "Malware payload", "value": "73ea8df92b0bfa757696926a917de18d3099fb595882dbcbb46cf7309bda3d3a05426b2feea16e5896a6034143c812cc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712933149, "uuid": "45ddb379-dcba-4a77-a54b-896d574d050b", "value": "T114C02BCCC081C0B31185DC42C829484B480C038F701C31D4F2704080C491B8114AE474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712933149, "uuid": "cd57cf23-c655-4438-908f-266a3f634b41", "value": "3:XTsGIxHRtrdrbw/xTW2aCx5I9XX8B+JdaAbWPKPcB:YtdIxaJ9w+uwWacB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712933149, "uuid": "880d09ed-a802-47fa-80d4-2163b8b61655", "value": 137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712933149, "uuid": "a0d244be-2660-4efa-9f4a-771f5506f3b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712933149, "uuid": "58e6cd18-6e68-4b40-b6d8-fa8aaa07d6fc", "value": "Bf5V99.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d6ce34-f8c7-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712924630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712924630, "uuid": "e221f0f6-9eff-40a5-88d8-d17e0ecc49c8", "comment": "Malware payload (AgentTesla)", "value": "1c65c8f56d2190393ddc0109cc37363a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712924630, "uuid": "b0c699d6-a5d4-4e1d-8754-a5eb6a3f22b0", "comment": "Malware payload (AgentTesla)", "value": "a3781631c4e416fa9efb09310bca25a02f39f13fe0e33fd715b7be946324b389", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712924630, "uuid": "3fca1e46-a9b3-4184-865e-1358ece555ea", "comment": "Malware payload (AgentTesla)", "value": "a6753f38700e4ce6afb21dd505918a4d06dc7e1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712924630, "uuid": "4106ff1a-3b7c-441c-88fc-8d24c4df2e81", "comment": "Malware payload (AgentTesla)", "value": "eb4afca0f3da15f659c58c25f0be430205c03e1cc826947326ef0b8baa4413f1f63eda05d581392c00357a4bfd750c3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712924630, "uuid": "f2804a5d-94b7-4bbc-ab16-361b8e7e6ce6", "value": "T12FD423061998B7B7E9A8A37151AF7B115FB0F66B6172D10E0C865DCFAB7130A8C12F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712924630, "uuid": "dfff748f-202e-4dc3-a4fb-1edae5e1122c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712924630, "uuid": "1eb22244-f890-4b0a-85ab-2ab546632a66", "value": "12288:9kvq31eoWORUTcDi748SJdw21PI+OgqLblLV7e7PfX9:9eqFswi8Dd8+ufKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712924630, "uuid": "f5d52f48-3750-41e1-a89d-76ed842ae2df", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712924630, "uuid": "087fb219-45e0-4694-bdbd-7caa389506c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712924630, "uuid": "c05f6932-5175-48db-a89c-9ed580c8d87e", "value": "SecuriteInfo.com.Trojan.PackedNET.2794.21912.2151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bba37e-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712906329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906329, "uuid": "94b31f62-1017-4563-8788-2bb0d5ad5f7a", "comment": "Malware payload (Mirai)", "value": "930fb39b59ae66a9ab90d7ec776b780f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906329, "uuid": "d8be5b05-feb3-4c34-9816-fddd723cdb9d", "comment": "Malware payload (Mirai)", "value": "a3815445721859a4623cd54ea71edc935e36514fc83a6c28f5e8dc00e8c8b112", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906329, "uuid": "3369bd9f-034e-4873-9fe8-a19b3f66c940", "comment": "Malware payload (Mirai)", "value": "46470f3e3d0025253c18ffae9ac411f4d86ba7e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906329, "uuid": "29929a0a-7bbf-4eee-9a7c-79cb195d7e5e", "comment": "Malware payload (Mirai)", "value": "ee8d28ef39c68939149ddce0a9988a6562ec674b6763e8f292c77628f3f32447c55b947e209ea616fa71242c50e59cd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906329, "uuid": "04f4da4a-d587-4cd5-a698-4aa53a93fa05", "value": "T141D33A3B922C0743C49B49F038BB77F34F69ADE312A651805619FF904B73AB22546F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906329, "uuid": "40f5c665-0287-4bad-a8a0-019fa6e818f0", "value": "1536:6wOSvD2GpFQBhrqMd5BoGRQyGB/ND+36IzkzIZgWmLOh0nmJ2VNu:6LqyGpFjMJtRQho0kLmLK0nE2VNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906329, "uuid": "2ccfa839-661a-426a-bc27-0b5ce2e62ced", "value": 134902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906329, "uuid": "93e0d878-a7f7-422e-8277-3f53841442a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906329, "uuid": "55472aa6-6e2c-4236-9ba8-1d409cdfc95a", "value": "930fb39b59ae66a9ab90d7ec776b780f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f12004-f89e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712906883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906883, "uuid": "abb1794a-a016-4c77-92b4-b177bb1dbf4c", "comment": "Malware payload", "value": "c1cc6000c6eaf1fe6347124647ab3ab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906883, "uuid": "9038f5cb-b2b0-42e5-bde5-7e64b4d7d4c6", "comment": "Malware payload", "value": "a3f5cc3d35bc13597d7d7b9776e0f0e597f00dac3e6cc4c6512cd180019294e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906883, "uuid": "90087261-8a56-41cc-babb-b097f43501d8", "comment": "Malware payload", "value": "9925f96090c97b327bd3a63524545ed030e465d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906883, "uuid": "9c1b6b34-6914-4177-8299-1dbe758a8f29", "comment": "Malware payload", "value": "a0d883db6769498782bf75e80bb4c561aed55357d2af96b66782f9be590efc404987efca9c69572f600fcb59eb4362e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906883, "uuid": "1da17910-f865-4fa3-b979-60a4fa4bb349", "value": "T111463309F6F5D073F0A278709EBAD419CBA3FA32CD65E0421E7619D2BA4393C4657346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906883, "uuid": "b6b2dfd5-fa82-44d6-9998-d44a2179c1aa", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906883, "uuid": "69ca69ca-3f0b-4039-9439-7173fc069c1a", "value": "98304:C82GBZjmMpd1bTRYeUY4h4JydTLhr7lQShe2NXSAZ+2gcspFc7W5io6wG5f4:gqtd1HRYeU2JETtr7lW2NXSmngcUO7qD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906883, "uuid": "93dd39d2-760a-49af-9427-a1ad033c77da", "value": 5465640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906883, "uuid": "70a9051a-c8b5-4364-a6be-864a81a9ee60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906883, "uuid": "208b9417-00ea-4adf-bde3-35f46f284089", "value": "SecuriteInfo.com.Trojan.Win32.Crypt.13043.16981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f501293d-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712906350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906350, "uuid": "ec7f6612-35e3-40ed-9d14-80c63df25013", "comment": "Malware payload (Mirai)", "value": "c30bd0c34b2a8900562fb158a7a67ce4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906350, "uuid": "465ffe4b-c0b4-4635-897c-5d92252ac3db", "comment": "Malware payload (Mirai)", "value": "a5706126d85a61ae255d160dabadcba23cd01a155846fbab04dd94ea0c17a51c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906350, "uuid": "deb3cd80-43b3-42ce-886a-a979ea76e02a", "comment": "Malware payload (Mirai)", "value": "a5dc13acc67aca8304cd5447ad12822903f6e769", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906350, "uuid": "7d55dc8a-363f-479c-8e72-b5909da902ee", "comment": "Malware payload (Mirai)", "value": "cd4774f4f50c63522a4fdf64daff9054622343bb65ed62d4aec9b92cdc63c2d2998514fd91b2287e6cdd0a016df34943", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906350, "uuid": "4a2b4fb8-ec6a-4683-b639-e32cba56313c", "value": "T100B31832A290C472D14706F101A3CF7B0C32FEB7176A5A96E36C3EB0AE3258575A5E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906350, "uuid": "a73800a7-b2ea-44ea-9504-e4140c7b86fd", "value": "3072:tMmr9U9u2GC9RXTqclsk5Xb7kY9mFK0AYF+ku:tM8auRC9YcGkRb4Y9mFK0AYF+ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906350, "uuid": "77f94a34-130d-4ddf-adca-fa10ef5059e3", "value": 111032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906350, "uuid": "01384e2c-1a30-4556-9c1e-87ceb78148ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906350, "uuid": "48fed109-99b0-480a-a384-ba2732edbedc", "value": "c30bd0c34b2a8900562fb158a7a67ce4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b85c15-f891-11ee-a120-42010a9c002e", "comment": "Malware payload (PhemedroneStealer)", "timestamp": 1712901549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712901549, "uuid": "849c4966-f215-49ef-9807-d1916048f268", "comment": "Malware payload (PhemedroneStealer)", "value": "1ca637cedec93ea9574650ca81e9b2fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712901549, "uuid": "f1b29b4c-3654-4a54-90aa-0aac1e98a7db", "comment": "Malware payload (PhemedroneStealer)", "value": "a730965e7baceb83ee55fc855213f2a76e903732f2e2e857214d0f6fa0bed3ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712901549, "uuid": "ba0cb741-d930-4e74-897f-33dae818c3c9", "comment": "Malware payload (PhemedroneStealer)", "value": "821d66ecdc2658c39d77c2177ffdd243d0d15948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712901549, "uuid": "591a022f-2c1a-4370-94e1-a1c5feb63cff", "comment": "Malware payload (PhemedroneStealer)", "value": "f0fdcae7ab5546a802ae3dd176165a990b9e9a91d719a2b822d2937468e66d16163660bac7bfff35b1e97503858733ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhemedroneStealer", "colour": "#645F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712901549, "uuid": "0f5183cf-d2fa-458b-b473-6eb6982a4a78", "value": "T1B604DF02B3AA5A23E55C5A74C1D7AC2207F89B8336B3C78A7D4815994F433E9DE063DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712901549, "uuid": "f6f6a964-6aed-4811-9ac8-1fe421945a1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712901549, "uuid": "e76a1d5c-af38-41b2-b944-b365ebba0493", "value": "3072:mi8HVPNliJfDAU3xD6wkf3hDeFRqxMyzj6P1C5xrleHu+oTkEmuFED:mTVPiJx3xD2fRAtyzs2Ku+oIEmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712901549, "uuid": "4fbc5d8d-3082-4838-afaf-95bf9bdebe4e", "value": 184456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712901549, "uuid": "92ffaa79-5a3b-40ab-810e-396885c1f42f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712901549, "uuid": "ff7441f5-3551-4b33-aa92-5133f6b98736", "value": "Ghost Loader 8.7.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e463659a-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712906322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906322, "uuid": "011470b9-a43d-4662-b057-1e477f0298bf", "comment": "Malware payload (Gafgyt)", "value": "1e245f54413ed818d0e0635e6735060f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906322, "uuid": "09712fde-214e-4371-b05c-283259b3782f", "comment": "Malware payload (Gafgyt)", "value": "a786fb1ae4e84b721c73996051a6836852b2fffb81241d71e6f14a8e4f4c78d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906322, "uuid": "381f2b82-b76f-499d-9307-ba9a0a049a1b", "comment": "Malware payload (Gafgyt)", "value": "fef6e5b33e4fdc9373d2220f0ec5b09bbd59971c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906322, "uuid": "3bdcbda5-0682-4ee3-941f-ac38d7ed2e8d", "comment": "Malware payload (Gafgyt)", "value": "2d2970a86b0a0489afea8b4c6d95a32abf257d743cae7cfd7934ee962dd3298157b9068d3b50c2e0d3dd4497ef49aca8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906322, "uuid": "a12b2f0f-4a6d-4952-a0a3-d91586c84d96", "value": "T1D0042A34D6504B17C1D223FAA69A424E3F234F97A3E733195638BBB03FE279A0D61915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906322, "uuid": "c14bf7df-8d1c-4d92-a46f-96e4266519cc", "value": "3072:6PC+RjGkWa6s/qSPeAjQM6PBtCkbPgoixVsAfymUwwFB7DXNu:61fWa6s/qSGAYPB8kbPgoixVsAfymUwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906322, "uuid": "ddbdfb72-697e-4c39-8760-187a850273e6", "value": 181882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906322, "uuid": "f6eb62e2-b547-472e-9684-6076fccf0f8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906322, "uuid": "19c2fe66-2a70-493c-b2b1-f39a356ce75f", "value": "1e245f54413ed818d0e0635e6735060f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f228d7-f8b7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712917760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712917760, "uuid": "25f24ff7-13f0-4604-8157-c1932c0f5d40", "comment": "Malware payload", "value": "861d098df60f8ec804cbed98afce830a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712917760, "uuid": "25deb1d3-7977-4442-9f77-b2658af14e42", "comment": "Malware payload", "value": "a96d2951551aa3187feb24ce8855a8837fe0c8dddeefdba4a3af1c49311e509b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712917760, "uuid": "ff49bf04-b3e7-4ea6-90f8-5ae216865444", "comment": "Malware payload", "value": "87b0fbc33190dff269d50ba63c98d0595a62791e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712917760, "uuid": "17d911ef-8360-4081-8676-34af98a2e4d7", "comment": "Malware payload", "value": "55c15e2681e0a28e7e63b18168346cfbbaf3b4b8717a2caaf5dda26d1d518529d5f161b35df768c1045184e9d021b240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712917760, "uuid": "31eba1b7-e017-4b4f-940e-ba1ab1e4f8cd", "value": "T1A2B5334337D79A12D29C5AF8CCD36F1107FCD34B31B7E7562945A248CA623D27A0B9A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712917760, "uuid": "e3e3fce9-750c-4674-a624-4a7f769bfe60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712917760, "uuid": "09f0ff58-903e-4189-acc4-36db24156657", "value": "49152:xeLlatN6xmS05G931SKjruFDtH+FmqNq1HxQqRfb5ulsfAF29yz:x6Q7/5e30K+J+/4PjUyfz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712917760, "uuid": "590b7682-bb1f-4643-b747-6c688288249c", "value": 2454664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712917760, "uuid": "142dcf77-9438-427b-a3a5-e021596ff782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712917760, "uuid": "bb8230c6-79b4-4c00-b1ec-b8be31346211", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d34e51-f892-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712901672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712901672, "uuid": "7b03c2fb-9644-4086-ab7e-360c84de375a", "comment": "Malware payload", "value": "e211386b453b3c5a57201f82e6d78430", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712901672, "uuid": "07b9d094-8110-40d8-8a3f-7c9709cf86b7", "comment": "Malware payload", "value": "b0f94f50e1e935e07ee2ba80dab3a2aa1385736b164649525060a8b9197b0039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712901672, "uuid": "5e1cbbc0-bda5-4c6f-ae94-84cb257ba11c", "comment": "Malware payload", "value": "ded19683ad9f32aadbbdddf2ebf56874b7e13e73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712901672, "uuid": "f212bdc9-51ca-4285-8c4e-e0dd7d08c5de", "comment": "Malware payload", "value": "bccd9c10916113208d36444e3e84095c660231ef3701b9567a430215da8cd0a33e2ab540d37ba408e906f32b8b1edccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712901672, "uuid": "30c703fc-4293-49ae-addd-55384418f80c", "value": "T13A740106B3EB132AD29CA578C0E74E2146F5D7872633D78A3F44068A1F137D9E9163E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712901672, "uuid": "2c8a656b-ed3a-4de7-a59a-58f2c46b4a23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712901672, "uuid": "c5113a40-4a53-4156-8119-176aea0ffa9c", "value": "6144:eVRzLtmZytEj3I4tRwdyyno6e5V9PV1e2eXa5GE5tSOa11yHhecpWZ:er1EjPtRwsynoR53P5eXa5GELSOa10IZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712901672, "uuid": "043c0135-fd18-40cf-919a-47e4ed70cda7", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712901672, "uuid": "06b45a2a-4884-4d8f-ab23-ad2b6c2149d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712901672, "uuid": "621dc8c3-dfcc-4d2f-89e4-9c517a8c831b", "value": "Dragon Loader 7.5.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d359b70-f8ce-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712927624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712927624, "uuid": "13e001c8-cffc-47a1-a07e-707b009d5096", "comment": "Malware payload", "value": "b33683c92c09de1629c7e49edc8dcbad", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712927624, "uuid": "4ce23e1c-fe57-4a08-a410-3ff569e61938", "comment": "Malware payload", "value": "b30865c552606193b18abdd9dbe493cccfb2c7a2d137fa669c8e6b72c93ce4ad", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712927624, "uuid": "3f8b8adf-2a6a-44f9-9cad-0c302bd5b232", "comment": "Malware payload", "value": "0643a36374c9be0582b7f0143291282cc0de1f69", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712927624, "uuid": "6dd53c68-9e5d-443e-8ea7-840bbb595461", "comment": "Malware payload", "value": "36e54e9e14cd37c653940ef235a5cef61a0cc6359dbd4cc1643a4ac0b4577b510c9754cc6d5ec5fba92e2db48f611572", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712927624, "uuid": "88e41004-80db-425b-b4e3-5c522d7d63ad", "value": "T12D9422814DA31F2DC99C428FF52D5A4F3DAA9AC8F4C290562332715B07DDB2CA6CF468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712927624, "uuid": "1e84d341-56f7-48aa-a43f-bf87a7c35aa8", "value": "6144:K8prQWabUPRd7G5w8jBKw0UGbwPEbcLbxM2eaAlj3N/YNRBk94SGMBVcbxQAwV7r:d5eUfiTBKw1/PC2kljdgNrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712927624, "uuid": "b1bca866-c9d1-49ea-9239-90993e8512a5", "value": 424642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712927624, "uuid": "5f51225d-453a-49c3-b571-11fd2670282f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712927624, "uuid": "8844d455-ba7c-4183-80d4-e48c8aa0c267", "value": "April_2024_discount_Voucher-Unique-d-File.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b225e56-f8b7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712917634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712917634, "uuid": "4030a71c-d30f-4e43-bc64-447459e37694", "comment": "Malware payload", "value": "fcd92f3c080d4bf700d87ace13ba1304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712917634, "uuid": "c00ce868-0012-46c6-bb34-0ea86bfb3dd7", "comment": "Malware payload", "value": "b3edb6fa852b4c1f95fa45e52660f1854a5da92413136600529cb5705e5c36f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712917634, "uuid": "c3ca5a20-1d38-4f26-904e-95642de0a26d", "comment": "Malware payload", "value": "b5f932894848bc0d82fdb2a33a63babcc03f9f4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712917634, "uuid": "70efd735-f429-477d-8cb7-10227b65ae2e", "comment": "Malware payload", "value": "4cb1a6b5ae8dc71cb60932965599183e4942cd761c0934d8bfc00eb5b4ad303fb6faf577d51632dd6d2f917a51eb3a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712917634, "uuid": "1097e23a-0516-4b10-ab88-1618c8c9cb70", "value": "T124745C54BD38E052E999EA33FA0056E02C3613A04D667DDF2EBA0D543EB25F1C059FB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712917634, "uuid": "4e2ef755-9ffc-4f7c-9222-8ba19840b017", "value": "605abc3fac37728842f967c1003338b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712917634, "uuid": "5b861824-306b-461c-a712-82d8aa8eb4cb", "value": "6144:M7P7gki4bVswwrn63OQIP/c1CE0b2tgoJjjjjjjjGEe:ixRsoFI73Ijjjjjjjze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712917634, "uuid": "3995c75a-9afb-4450-9d2a-9b11d16efbe5", "value": 339720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712917634, "uuid": "828f73cb-9ef7-45a6-a82c-bf62ee94ba73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712917634, "uuid": "a22ffb26-27a2-4017-b27a-ff820913c4da", "value": "SecuriteInfo.com.Win32.Evo-gen.24102.32645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1248c7c1-f8de-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712934316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934316, "uuid": "20ef4994-19a5-4d9c-b16a-57f8599883d1", "comment": "Malware payload (Mirai)", "value": "5956c72c3af96e9731abacffde8f40bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934316, "uuid": "d488c490-60c3-4ebc-be3a-44fcd80c8b57", "comment": "Malware payload (Mirai)", "value": "b94f10ca3a22d68473a1b396675b37319f4bd8784655368ae524845b8aec2b50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934316, "uuid": "b215902f-77f3-4f1c-a24c-af8ff1ce128a", "comment": "Malware payload (Mirai)", "value": "d1240e12a0c37525ee2af76eee05cc1820fa9fef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934316, "uuid": "d00bc4f0-54d2-403c-b475-ab48c8627d24", "comment": "Malware payload (Mirai)", "value": "f6e6a79e1b9d01d26840b95a468ad87ba9d9e60e7cb33f3de4e49495c95ee660b023bda6d23b3e671f4f7ec4b3a611d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934316, "uuid": "2962e5f6-3b3c-41f0-931f-9ad72da2a03a", "value": "T17A73F756B8814B12C5C512BAFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934316, "uuid": "62be49ed-fb6f-4166-a8e5-f9d4ed828546", "value": "1536:2ln25xPBXk1wnnkL7+6Ed073HxMPaT90DILipN7svHTGcV5GYI2J:7xpXCMkMSNeacN7svHqcVERs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712934316, "uuid": "cfe44aa4-dddd-4fe9-a892-41b77ffe09b0", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712934316, "uuid": "0428a781-3310-4c39-8342-7807d0bbfe98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934316, "uuid": "e607ce84-fbcb-45b7-9a15-05561570d663", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c3960b-f8a9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712911535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911535, "uuid": "9631e1fd-aaf6-4ee7-8fd6-e42ab62bc924", "comment": "Malware payload (Mirai)", "value": "5c1ff3af011765ee7b4048d19b1c27ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911535, "uuid": "e9098173-12c9-458f-9709-7fdbd02a9630", "comment": "Malware payload (Mirai)", "value": "b9af728d6cb6588937d469ec21a905ff44fcb0802c49c164c88db23ba9bc06a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911535, "uuid": "17d54ef6-c264-4573-b8d4-c236a8d3afc2", "comment": "Malware payload (Mirai)", "value": "a11ca6147619c97e22ddbf74ede2d1b4ae487db2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911535, "uuid": "3183ce7e-c22f-4fd7-ab6e-1555b02e9081", "comment": "Malware payload (Mirai)", "value": "bb4e5ae00713e3f3ee650306db50fc09667e2ba7afeb3636651a63138ff050013c539891e8363938f63dcf23690542ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911535, "uuid": "63724909-9455-4cc9-a88d-d4f5d761c353", "value": "T16D14D81AEFA10FBBD86BDD3702D8074139CC944722A57B363578D928F54B54B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911535, "uuid": "32b0a9a2-ea69-4c00-a6a5-cf76337b4316", "value": "3072:cyoAZDfkvljYKHCqaQ0DpYInh5H8WeYUVteJ6w2p:ZZDfcNlaYIh5H8hVteJh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712911535, "uuid": "114d60a2-2249-4c60-b779-dc373e44c245", "value": 193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712911535, "uuid": "b9d6ea59-813a-4189-89de-1fd7d81f2c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911535, "uuid": "82dd15d3-2d47-4caf-b1cc-97d79d6cf5e8", "value": "5c1ff3af011765ee7b4048d19b1c27ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ed48e9-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712906343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906343, "uuid": "dbc8fbd3-de18-4da4-a545-14cb21596b94", "comment": "Malware payload (Mirai)", "value": "646a8de591d3bb8ea263b41e1331cf6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906343, "uuid": "b5036610-b3fd-448f-b525-ad62eff9f97b", "comment": "Malware payload (Mirai)", "value": "bac5c087ca6c8531f5496c9b877d16f17df3bc3c81478d5731709330b9782e38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906343, "uuid": "9f3362bc-bdb5-4167-9abe-61a5e7e9a566", "comment": "Malware payload (Mirai)", "value": "a3e7b6fc960b4e33f1dfad7209ac792bf01830aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906343, "uuid": "b79b8415-006d-48ef-bf00-0ade99d97085", "comment": "Malware payload (Mirai)", "value": "b825d388da4379e1fcde2222311559b0f7000178030a8357c9803ffc7fb195f1f67cfb76cff796044d0034f7e28ef3fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906343, "uuid": "830803e6-36cd-43dc-9735-31f800220e17", "value": "T13204B53E7A11ABBEE169827107F66F708F9529D327A09341E26CE7185E3124D1CCFB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906343, "uuid": "28900d15-8cf5-43cc-893d-9c26d64a405d", "value": "3072:PKn3FSO7m16k9DfF1sHEENZY1W3amB0v4vnaNu:ynmgXNZYwqmB0v4vnaNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906343, "uuid": "e9e247c0-f8b7-47fd-81a7-16b16d5d802b", "value": 181137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906343, "uuid": "fc9835e4-3f99-4ed1-9599-608368325dc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906343, "uuid": "c15629f5-f883-44b4-9e33-8e5e8f2be2db", "value": "646a8de591d3bb8ea263b41e1331cf6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1f7d5f-f8c9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712925614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712925614, "uuid": "15b60bb8-ec76-4656-8c0d-bcd5f5621ebc", "comment": "Malware payload", "value": "30b7d18a5487436f333f35836d9daea5", "object_relation": "md5", "Tag": [ { "name": "CleanUp Loader", "colour": "#54298D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712925614, "uuid": "d2e4b3cb-a47b-4d77-813f-180d44f4a26f", "comment": "Malware payload", "value": "bac7079571fa4fa2e3543fd4edfb5144ec4ff9046065c7f11cb8c9552117d138", "object_relation": "sha256", "Tag": [ { "name": "CleanUp Loader", "colour": "#54298D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712925614, "uuid": "baea0896-1c42-4fb7-933f-e5b62b9eed07", "comment": "Malware payload", "value": "5dffc7d946e1b93439a6a8ac901b95e310019a48", "object_relation": "sha1", "Tag": [ { "name": "CleanUp Loader", "colour": "#54298D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712925614, "uuid": "86a81573-36c8-465a-b874-e507ce450e21", "comment": "Malware payload", "value": "9b85cad9cc77fb43b8924de76886335cf88a5b20e4e37512a0235c32c232a0bd246116a765de6b2208f7a7a1206b9dd0", "object_relation": "sha3-384", "Tag": [ { "name": "CleanUp Loader", "colour": "#54298D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712925614, "uuid": "41480cf2-395f-4a22-b687-61c7982cf127", "value": "T124753305B28C29557E486A4F299CCF44A83BB46056FCCF73D148FEA7A6DC939C99E070", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712925614, "uuid": "a525fb4a-fe5e-4013-a0ca-91e9086b6d0a", "value": "49152:O77r9KI9v5IkP8QFZJ7Yc8jJIFdQC3G1bcnE8dPJdoxZVyI:OU87P8QLJUc4Il21T8dPJdsDyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712925614, "uuid": "b513a49b-fae3-4197-847f-42e37537bbc2", "value": 1686911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712925614, "uuid": "fb4f2483-35fb-46dc-99d6-03504fc21643", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712925614, "uuid": "8e76d59a-2578-4490-b5e7-4e4cb4068ad5", "value": "garold.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254043c2-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712906001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906001, "uuid": "6fbc59d7-f1a6-4051-95ae-244e58764a7b", "comment": "Malware payload", "value": "5c0d04ccd0cbcd8cc90a502df8b512e7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906001, "uuid": "d95db1d9-b9ef-4ac5-90cb-4e496b400b7c", "comment": "Malware payload", "value": "bc84c3a9cfeb083fe41a238c55ea3163b5c9e5103fee0a7d7f4d8a1236b6d22d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906001, "uuid": "8eaeec11-451f-4994-8e84-2ca735e3d2f9", "comment": "Malware payload", "value": "0f905a137b801a69cf498fc0f8c5f00e75c5e689", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906001, "uuid": "d9fd4923-f0cc-4265-8a4c-40d5e927d99e", "comment": "Malware payload", "value": "216e50367578d15e1b198220672a8ab98ce8ce2289cec1d6200e9f9d6b096db86d7702213273ff403fa0e3c66a374f43", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906001, "uuid": "fbdbea08-b119-4497-becf-8d8f5fa9be6e", "value": "T12FE53308FCABA195C1E90AF0C58E8E795372EE0C5DEF6058BA1D89DC597CECE714D122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906001, "uuid": "c78d3f54-2a88-47df-b8ca-f351260f4f15", "value": "dde04a4a91a59ef24083f245b804ae7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906001, "uuid": "9b332967-ab15-4147-8e6b-dad90bcabc8c", "value": "49152:fEOGfMr0UrM21zm6mVonU7JCGjh9FDrjop1jy50JtrD2sGxgLJ+r8+NSR63xrO0s:rtr0CnnGJCGl9GDnrNGaLJ5RKxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906001, "uuid": "efa701e6-efe3-4768-a870-998992fa5c93", "value": 3302400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906001, "uuid": "a354d0ee-28c9-4c77-9f6f-415eb89c4bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906001, "uuid": "a870eda0-dfb6-435f-a17a-061fdae8a3c6", "value": "5c0d04ccd0cbcd8cc90a502df8b512e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d1ccb2-f8a9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712911525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911525, "uuid": "1533f426-556b-46c0-a2a5-fe19750387e9", "comment": "Malware payload (Mirai)", "value": "f563db906bacdccc55d4ce532ca63a2c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911525, "uuid": "fc684b8d-a395-4839-8d2f-e8e7a614aa9c", "comment": "Malware payload (Mirai)", "value": "bf89bf2fd9628d010dcfb802e7210645bc890c2c54b0ad25dcd62fdd8fb19e43", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911525, "uuid": "eee7ca16-d2dc-4e7b-b661-5d0e044ffcfe", "comment": "Malware payload (Mirai)", "value": "660a58f61438d75340b4d050d92748c725eba539", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911525, "uuid": "fa17cd1f-11d0-40ba-8f4d-2bed7491ae6c", "comment": "Malware payload (Mirai)", "value": "d07fcd5fb538664147dbc28c8f64f634cb32bdd2b20ef571dd3fb32e103690eb9ca80dcb3031431b4a758e69f696258a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911525, "uuid": "4bdce4f7-4478-4eec-a9b7-20b8d2eb6184", "value": "T13D144B0775C090FDC4DAC1744B9EF53BA977B0AD1239B12B2BD4AB221E5AE314E2DE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911525, "uuid": "bf5b125a-6e4d-494d-bf60-c1ba48ef83ed", "value": "3072:45TktNb2VUf4dY+AxCb9/qoem+2JE7ZAdPMvhfRHS48wz:45T+b2Vk4dY+Ax4aAFopS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712911525, "uuid": "35e7f523-66a3-4cc3-97df-a065293b82b6", "value": 195160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712911525, "uuid": "b5c17c28-2103-42d2-8b52-adf94eac6a66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911525, "uuid": "a753d4e5-746b-40f3-8866-0e710eb7a3d5", "value": "f563db906bacdccc55d4ce532ca63a2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a8b730-f861-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712880796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712880796, "uuid": "a6301018-b49d-40db-b077-2e927ee3408a", "comment": "Malware payload (RiseProStealer)", "value": "5efb20ecf468b1655161f6644597f817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712880796, "uuid": "8cc1bf05-9b94-4cd6-b0c8-6c26bb096c23", "comment": "Malware payload (RiseProStealer)", "value": "c17d9e85a57cb25faf209c3d4e3478b7c746f3ba0c9b2a7ac79c66cf8b90202a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712880796, "uuid": "85946686-ea7b-4559-b38a-1e957e64af85", "comment": "Malware payload (RiseProStealer)", "value": "d8889d70b8810f78ac8f1e505e7f1cc53902caa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712880796, "uuid": "7dc985f2-8f78-468a-876d-ce658df3dacf", "comment": "Malware payload (RiseProStealer)", "value": "3a9c59418a8bc9dd0f5dbe79392b9a9a2d5dca02d1dc45245bed7c0428e17a95be42998eed123d67484f9ab6d92535ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712880796, "uuid": "01435839-610a-46a2-b210-21d7a2453ffb", "value": "T17646338E52C314E4D8AC86F41B26B6FF72FB1EA209C64E5E219C3ECDADD241550B7607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712880796, "uuid": "7ff58127-6b9b-41d0-9908-2fc373b1e7bd", "value": "fce2185f86316405847dae4f4adccdc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712880796, "uuid": "4d19d87d-f4c6-44ee-bc04-1fcbe541bc52", "value": "98304:hd6xIW2B2sLpJUixvOU8T4K48fmv388hyNGj/X43EpfUXDbt9tHJqR4dI1apmWGI:hKRxsLpHiDv+kzNGj4/t9tHJxG87k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712880796, "uuid": "e4af3502-b94a-4222-8ece-1b7070ece86d", "value": 5776896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712880796, "uuid": "2d92155a-fb05-4f34-924b-181a3f283e70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712880796, "uuid": "d66a4564-201b-4ba2-b4d3-210a0fa2b7c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4834f2-f924-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712964448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964448, "uuid": "e8e2549b-c19a-4907-911c-03a52af802b5", "comment": "Malware payload", "value": "f512b4e5a37e569077ffa6dfb915ae60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964448, "uuid": "6f1759b9-d8cb-430f-8fbc-f65629522301", "comment": "Malware payload", "value": "c1885ad43e30b01e03cf2d57f9ff99c601f11035fb09cbf79095bb05eb78eab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964448, "uuid": "22a04bd6-768f-4ae4-9be7-687aa39d7c06", "comment": "Malware payload", "value": "66ded7eeeb426350faeed3b42d98e64ab269cecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712964448, "uuid": "87d9110e-73ba-4917-8297-78c62a3b274e", "comment": "Malware payload", "value": "2e9f82ad8051ecc8ff25f92a9c1c2925b259442ec519a0c1e244a90b229eb655ec4d589431c03b4682f5449f29651d8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964448, "uuid": "27a06d04-35a2-4234-b1c6-dc150234bec5", "value": "T1FAD533C368B804B1CFCA50BD4C7EA01ADC809F1776667E65D6ECEE045F9A24C4B6D1A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964448, "uuid": "7d516500-5842-4fbe-b9eb-241c3e60b650", "value": "0e65d8b21cc7f622018205c832c53a41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964448, "uuid": "4e08e34e-d9d3-4ddd-8183-196013ccb468", "value": "49152:LZRiWfivq9ly84hCMqmBGXZPEN4gPCk9tXRwJUzQ+RH1CFeFiU4QSfelwluhVUp:LOW64FXM9wJ8VP1XwGs+RH1CFE4CaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712964448, "uuid": "14effbdc-6fd9-4f79-8f3f-5dbf31880c81", "value": 3012552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712964448, "uuid": "eaf84031-958e-4a19-a461-1935c6013298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712964448, "uuid": "20188b40-7215-4c5b-bf30-aeca1303c827", "value": "SecuriteInfo.com.Variant.Jaik.220190.19238.10614", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e96678-f895-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712902993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902993, "uuid": "22e050a5-afe9-447c-b709-67d45d78b841", "comment": "Malware payload", "value": "ed7bfa42420a272fddc79e18cabfda12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902993, "uuid": "7313ba33-f399-4951-9c98-8b15a106948b", "comment": "Malware payload", "value": "c19f4ed7c43869061fada30d59308b85b48cf992ad77d6542349e0884b2f227d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902993, "uuid": "36befaa1-37f9-4ee9-8ce8-93e9e4ffd9fc", "comment": "Malware payload", "value": "721e2a451e9962903ccfbcd69bc363ded7428cd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902993, "uuid": "ce93229d-efd0-499c-bd9b-0a78ddf918d7", "comment": "Malware payload", "value": "2cf2a9fa8583538286c5ef266c211ed511a063dbf92ca727daacebd5ddb6af3d0a1c9e348b69d52f22fbc34dd9d1b908", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902993, "uuid": "cb6101a4-cad3-4bdc-b2ad-3480afffa033", "value": "T14D840113B2EB0216CD896A79C5E38C1617F5E74B31B7D7493E8805468F437EE9A0A3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902993, "uuid": "5398bd1f-99de-4e06-b490-511baae8f46c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902993, "uuid": "891c304b-824b-495f-aa5c-b6523d20d761", "value": "6144:IqCmeyWRTSd4lpxOPK0d/L1kn8hIuyNKXTSddX8cEPBn5iat7wFBFWSl8H:Cy/upEPK0d/yn8hIuyUksLjt7wFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712902993, "uuid": "3497420d-93a0-4489-b379-f4081b773a8c", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712902993, "uuid": "6fb14833-4cda-4c4d-bc05-43abcd1717cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902993, "uuid": "3ce8333d-b601-4dea-ba1a-c8ebaee6ebb4", "value": "RobloxAIO CHEAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aec7323-f8b9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712918439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712918439, "uuid": "9f69a0ca-c95f-4281-ac38-520737f4e0a4", "comment": "Malware payload", "value": "c8194a43ff73e4ebc4f65122a3bd5670", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712918439, "uuid": "2ab5cf74-f076-4443-9116-ba077a022e65", "comment": "Malware payload", "value": "c398b3e06ef860670b9597daed85632834fa961aea87164b8ba8bb2f094a14ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712918439, "uuid": "eecac17d-d430-4e26-bb63-e628c6da38d6", "comment": "Malware payload", "value": "bc5342ecc4aed4f4257bae35f9718968f0b08608", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712918439, "uuid": "ce28dfa2-f09c-4d4c-ae4b-2fee285f30e3", "comment": "Malware payload", "value": "d9b0319b4aae2331403b27697ef0a480f729a8649cf6cdedc2e6b1fbc32e826349ad8e78955ad0c9bdb70cd5d7fc037d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712918439, "uuid": "1b06e783-5259-4870-b2ca-59b41b88e5fe", "value": "T17BB5E1203682BA38D17D323BA71FE22A065B65325535E09B7AD82FBD19FC4DD511BB03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712918439, "uuid": "1f6b0e87-b6f9-4dd5-bd4e-fe571aa9f232", "value": "818ca5cb099004ae18dfc7e62d89f513", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712918439, "uuid": "6a89b7a7-018c-4f1d-adb7-41c2a8442636", "value": "49152:KsHvYWDGbqsPOUgqDgdg3vWjIMJAxp+orKPkRZdMCoeuc9:HnDGbqsPO+gdg3u4b+orKPkRZdroeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712918439, "uuid": "3958bb94-448b-4d18-bcfe-1310edf0fbc3", "value": 2395136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712918439, "uuid": "f6c0437e-1101-48d3-b312-78105724c713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712918439, "uuid": "1cd3073d-2978-4492-a017-9a31d7801ba5", "value": "garold.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98ef465-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712906358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906358, "uuid": "f80a5a9d-8bc9-4a20-86a9-b11bead79d74", "comment": "Malware payload (Mirai)", "value": "15d84f74ed682a1d6ec4f7ea2b43394b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906358, "uuid": "3aa3c60b-27a1-447b-adf9-8c9cf32c8788", "comment": "Malware payload (Mirai)", "value": "c4cfe311d03bcb09e6473754b96ccb150861a6b974c4528cd2ca0852eee40122", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906358, "uuid": "7f69c171-af75-4a72-944c-7b17cb023720", "comment": "Malware payload (Mirai)", "value": "1a349f4964063946aaa1c3a4573b48388e5dd3e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906358, "uuid": "08d98ce4-6275-4d05-b01c-f7554e258522", "comment": "Malware payload (Mirai)", "value": "0a502e7ad399ee803a444d8643ef0d2ea4de60e56264a598073f2da1816745500f1d25a36e639c55d35fd59398dcd27a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906358, "uuid": "6cce4e1f-a428-474b-967a-68767791412a", "value": "T191D31AB3F504DE66F00AE67208D38B257E70FEE30B63156263173A6AED361C5285BE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906358, "uuid": "6b5df9b6-c8a9-42cf-b5c3-69d4d0d1a28f", "value": "3072:3v/xY5MqJdV3QeuacWjcW0JcWcBUsbWAxpk5k78tHZNmm2s0UzZ6l0Nu:3+ldVQeuacWjcW0JcWcBzbWkWG78t5NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906358, "uuid": "422f1613-c0c0-415a-8ed0-f7055b520b8a", "value": 135609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906358, "uuid": "4d1894bc-b29a-4a52-b2f2-44c157f0837a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906358, "uuid": "57edf36a-b85e-4c8b-ae4e-922dbde80a5b", "value": "15d84f74ed682a1d6ec4f7ea2b43394b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e95df6-f8b9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712918399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712918399, "uuid": "a6e26686-3ba8-429e-8965-7162cd5a87ad", "comment": "Malware payload", "value": "5bf1caf9f31eeb7db44060c62bedee80", "object_relation": "md5", "Tag": [ { "name": "ps", "colour": "#60C0A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712918399, "uuid": "1de0c0bc-8084-40f2-9640-8d75c2c84c91", "comment": "Malware payload", "value": "c645fd15dda1aa3d5554b847e1d243493ea22f81faf3d1f883100a4b51438b27", "object_relation": "sha256", "Tag": [ { "name": "ps", "colour": "#60C0A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712918399, "uuid": "c13a2853-5019-4346-9de0-10bced3485da", "comment": "Malware payload", "value": "33e7ec52677f02f08f3e3ef117965280e22dfd0e", "object_relation": "sha1", "Tag": [ { "name": "ps", "colour": "#60C0A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712918399, "uuid": "059ada2e-bfb3-45d8-ba74-640e09fece8b", "comment": "Malware payload", "value": "0335e8dba81121e95b97b34910287cd5dc077a425fa9bb5b7092c9313f190f5e17663450266192861183d25e1ba9b337", "object_relation": "sha3-384", "Tag": [ { "name": "ps", "colour": "#60C0A6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712918399, "uuid": "cbe9bcdb-f7b8-4cb0-b3a2-758d7fbedd99", "value": "T1A411101D72E772B0E7E907E5D26FE496121541AF22808804732CD6806FB22BCDBFA7C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712918399, "uuid": "539473d9-723e-4050-acd1-3ae9deadbae2", "value": "24:5bDm9a/qquensjSzI9cIVZTzCIc2JAXouhNufFJz1Nn6:N+a/1USzuVdzDVJgPhNufF3N6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712918399, "uuid": "62553b80-ddf6-4280-9c4f-86311a1f0205", "value": 971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712918399, "uuid": "a2a9acd7-06c7-485d-9c38-d82408c05f72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712918399, "uuid": "789d03bc-f1f2-4131-be1a-9b6ded9d6730", "value": "fix.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23be440d-f89b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712905569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905569, "uuid": "705624b7-dd7f-459d-9047-94af84bfeab3", "comment": "Malware payload", "value": "c111771f5d635783ec7d12a6852102ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905569, "uuid": "33a82f13-bc8d-41b9-a2fe-c8aa01063eee", "comment": "Malware payload", "value": "caaab928c6a53c94ee50f4156530e461680f21f70ec9358aa8bb174edf6edc4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905569, "uuid": "6dcf08ed-4536-466f-ba6a-107053c9b1cd", "comment": "Malware payload", "value": "f98ef48a250f20211f951721f46e4c63b6f069fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905569, "uuid": "b60a8746-f877-4c0e-be34-02739d59c164", "comment": "Malware payload", "value": "5abfef34de00d3a1cdeff2435501ce3415c13490cb2cab49e3d83a260b707023cc0577382dc35a3029a207d3c1814fba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905569, "uuid": "62b01d6e-bde9-435d-9825-314f3246757a", "value": "T17633CF34B7E81BA8FBFE0F715D722A104E3AB9539A51D25E2198110C6637381CAB1F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905569, "uuid": "e17cfa75-ae88-4335-8466-1097e2510e62", "value": "1536:thWoJ34AIQO6Lr8KHZvLiowOszHJk+1uKd:tZIQO6bH1YTzdUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712905569, "uuid": "1f8def44-032c-4bdf-9518-85f40f762687", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712905569, "uuid": "426b5345-672b-4a98-8c52-5d1cf7302db8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905569, "uuid": "c889b2ef-a8a9-4e2b-aead-b57c8671a4cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bd4a4e-f86a-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712884472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712884472, "uuid": "104792c6-1de4-497e-8cd0-3ac10bc72c93", "comment": "Malware payload (RiseProStealer)", "value": "37084171cb5680f306e31a15d286ace0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712884472, "uuid": "b840eb0a-6231-49ac-a16a-d61ad48ca1dd", "comment": "Malware payload (RiseProStealer)", "value": "cb03ab524875b97a169e416c8c4fadc718ea1baeb726ef723d9fb0f1d13211bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712884472, "uuid": "e4404c0d-8a9c-4766-840d-dad25f433555", "comment": "Malware payload (RiseProStealer)", "value": "2eb3f177083c7d75eaa2d420af8e9b4b4dbc3a45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712884472, "uuid": "b1a393fb-1e74-4546-95e3-5ff885442e54", "comment": "Malware payload (RiseProStealer)", "value": "beb487de944a8f74f2f916fc9c1f3d83a31af2be551f3e639d0c9916277cd1a1a8c60eec2568f9d5358b223741f3464d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712884472, "uuid": "243ba283-2ffe-45ba-af08-9c5a2dbca14a", "value": "T12F15020373D0B871F63387325EB996A5656DFD708F52BB6F378C4D4A09B40A0D6227A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712884472, "uuid": "e4b0d0dc-0136-47e9-a7c3-848adb0d9cd1", "value": "8e46a2841daf40f5670f682d013443e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712884472, "uuid": "852ba1b5-a4d8-4f90-953a-78cec42e5f7b", "value": "12288:uszwCMQHGU5pXwn8ov2nP5PKYHtcy5eYj2ef9RjJpzEzJ6UgC5eqIuy6LsiHQP:us3g8oOnPHHt4C28RjPoQ80uyCsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712884472, "uuid": "c39d50f5-b82e-4563-8066-499d137e33d0", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712884472, "uuid": "db12960d-ac9f-4feb-ad10-b3132e4b2d3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712884472, "uuid": "4a11f513-f8a5-4f49-b308-190aafa879be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4fed7a4-f86a-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712884821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712884821, "uuid": "6780e044-fd3f-4243-8bfd-894a7957d999", "comment": "Malware payload (RiseProStealer)", "value": "7e96aec89a268f4b6c9aa96f01b5b838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712884821, "uuid": "96287910-0e2a-436c-8485-17a031278d83", "comment": "Malware payload (RiseProStealer)", "value": "cbe58085b39137fb2dd52c655308d80415d632f17d6d47d3f748f55f967efed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712884821, "uuid": "dbafaa41-625e-44a0-8db7-ffe9a0ee1761", "comment": "Malware payload (RiseProStealer)", "value": "1cc65e0f23af3165467279167dc52e2ada018a65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712884821, "uuid": "50b1d37a-ab65-4e78-bb84-55723be1cbac", "comment": "Malware payload (RiseProStealer)", "value": "c94699b0d2bcc370abb7c424c1265c57fcfad364c008752a163951d186e2d8b44ed7a523c71d040f98a4e33bb531de35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712884821, "uuid": "17e49b17-b489-4d16-843e-f41154a2b7e0", "value": "T183663300F8D34C42C59A99F85B9BFDFE3AB229F60151CE9B16BC15C99DD3528A2B7103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712884821, "uuid": "7a3bd487-033e-4deb-be61-dc8a802ae9bc", "value": "c959ab5e76f65820c55fd6008599fdae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712884821, "uuid": "4edd5da5-da1f-4a81-82cf-a05ab7f5d08f", "value": "196608:p/KoI9n0xD71kj9IO5tmA5MWTl9yOSNKY:BKnSxD7SIwB5MWTYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712884821, "uuid": "5ea3b521-fdf9-4045-b69e-b40a1b6c6a44", "value": 6609920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712884821, "uuid": "2d925e04-0379-4c58-ba26-0577ad39e6be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712884821, "uuid": "3f89319f-ca5b-4419-815e-42dce040cd1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27daf023-f8b1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712915025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915025, "uuid": "25c84e9e-2873-4902-ab6c-48a73726b59c", "comment": "Malware payload", "value": "1b988ad9e3a6b8b8cbfeb3d7cf30beeb", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915025, "uuid": "63e02684-554e-4794-a8be-93afc9110c98", "comment": "Malware payload", "value": "cd8d70e4a1918681c8bd81c333b7f2f27433baf4de640b52e522bfea80c00afe", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915025, "uuid": "a62ffe23-bc77-42e4-afa0-d6acdd425ee2", "comment": "Malware payload", "value": "0f8c2a961fb959eefd3fd3c9de7a1782d3e609f5", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915025, "uuid": "92124afe-c557-48c6-980e-f72d7ea7c126", "comment": "Malware payload", "value": "6c8374bb8d415a7a2692d3b7b7b0edb75f4ac2ab038ea1b12d32af8606cc64fed14bffad7dd9a32450cc8f2787a14c62", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915025, "uuid": "43181d2a-6678-47fd-9027-0b408758d482", "value": "T16BE260593C4761660A37F27AAB7BB549FB75802B2201A140B85D836C2F70E5052BDEDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915025, "uuid": "c95b385b-5af0-490b-b902-a7dd5bd20ced", "value": "768:MkHOEbpcMYjmv1rxc5KTPBoMqS7j8frPWgtZPnCUQpBNgZnFFQE/0FRIpaN1hXQQ:xOo0Wxc5KTPBoMqS7j8frPWgtZPnCUQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712915025, "uuid": "87669690-4928-4cab-9fe0-998f4ae2e47b", "value": 32876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712915025, "uuid": "cf5bb98a-3672-4641-8d25-50d47534ef53", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915025, "uuid": "0d91303d-4162-4df6-83d3-1c5f8cdd63ef", "value": "EXCEL_DOCUMENT_OPEN.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df096243-f8cc-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712926929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712926929, "uuid": "fb75e18c-ab20-4b5c-9add-1abe3bb65f55", "comment": "Malware payload (AgentTesla)", "value": "a2c8fbdc6d1883d1a78f974711c3d681", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712926929, "uuid": "a71dec1b-cc1f-4486-9f01-672477d37cdc", "comment": "Malware payload (AgentTesla)", "value": "ceaee7b17b8e34dd07ecc0bd94b23209ae391eaab810d0b2c3a34f2ea40f7bb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712926929, "uuid": "3ce103ff-1a47-4e6d-8f49-d4903bdbf103", "comment": "Malware payload (AgentTesla)", "value": "1b4e4445860a8db378d1e71fb239092e6be8c9d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712926929, "uuid": "630a5096-1d01-4100-87b4-b3421ce2ba83", "comment": "Malware payload (AgentTesla)", "value": "1e15d1765680d772ac0d9bbfcf1012b447f3ad4c3e74bd7591c988d99de3803da1709a96e0f27c32ea6bb117b66c7eae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712926929, "uuid": "775c3cad-f74b-434d-b333-341c5d0d43d1", "value": "T1F5D4234D3ED4A6E7D0ED4AFA1417A950A7F0B769A6E1D6C5DFC2C2868391F10CC062CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712926929, "uuid": "f9c1f6fe-7b43-4df8-b287-ff615b35445b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712926929, "uuid": "75c18fbd-4760-4a58-9cb9-e6b3dcb8bbbe", "value": "12288:Wskvq31eoWxc5Z9W+p86Ir96oajYrVzVLPXbNI8Lg//xGAdHKXOFE:BeqFBW+u6elajYrVRPpI8wxGiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712926929, "uuid": "b83f3598-3b47-4299-a406-a856871260a4", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712926929, "uuid": "f55eaa5f-d4ad-4ee4-94f5-9cea74a4778d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712926929, "uuid": "71aca1e8-d585-49a3-96d6-3d9c669b03c4", "value": "AQQ-T7630-CVE8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11d4ced-f881-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712894640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712894640, "uuid": "df20e41d-8dd9-4c48-b92d-1520d5a94e25", "comment": "Malware payload", "value": "946ee9c2c1100fdedfa0d8d21e562f89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712894640, "uuid": "8352b750-31f7-4901-b790-b399f85a3f6f", "comment": "Malware payload", "value": "ced915425b549a29f7fa8b9099239dcb5854eb5298a080fb37d70df12cfe600e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712894640, "uuid": "290b730b-15cc-498e-9b7f-02d031f7d0d1", "comment": "Malware payload", "value": "8b3e873cb8fd3677451aa90059991b90b59a0c15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712894640, "uuid": "08fab90a-2dc5-4060-b55a-8c1269e1bae5", "comment": "Malware payload", "value": "2a7fbf688497ed2aabfa5a4f66b3e624f14595823fb66259e9e2d548f7f4bdd9831d79f8bad5f2252138c360222819d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712894640, "uuid": "e4dfe085-3b04-47b9-aec1-0e090c35b167", "value": "T1D984E04777AB4641D77955B1C0E349250BB4AF8735B3E78A3EC5328A0A323C5DE0A2DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712894640, "uuid": "a21c603a-568a-4f80-af3b-618fb933deb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712894640, "uuid": "0cf5f6f5-a936-4915-9563-eda1957a2889", "value": "6144:LrDZ3NWDoWEGGbp/8IBBK0yPkwq3Q8LeTVMs3ZTgJQm1:rZ3iojFbpLB7sk5JeTf3ZTCQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712894640, "uuid": "999ad94b-5fb5-49e7-952e-1b27cdd42440", "value": 372360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712894640, "uuid": "15605d77-8630-4c54-be7c-0e97e2b87a1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712894640, "uuid": "cff572b2-cee5-4f2d-931d-fa0ce8d39422", "value": "946ee9c2c1100fdedfa0d8d21e562f89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe03769-f87b-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712892114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712892114, "uuid": "b30d8a7f-73b5-42bf-9692-0ec590956fe7", "comment": "Malware payload (Formbook)", "value": "1a7abd0b5865f91ad24487e98f0f46e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712892114, "uuid": "e9db7d18-d407-48d9-ba45-75aa9fb5ec90", "comment": "Malware payload (Formbook)", "value": "d3664b1a15f1e037188acd5e5b01c6ce160a1322d40f48593917632dc4404455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712892114, "uuid": "8ac3b90a-cf1d-45e8-8c80-b4ce8782e3cb", "comment": "Malware payload (Formbook)", "value": "cfa4513b8536f1653812ab06f4e18cacf75ccfda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712892114, "uuid": "f84f8aaa-0fc9-4f63-985d-bf00f222f914", "comment": "Malware payload (Formbook)", "value": "05576a7a0fe5a30a8681ccef260f57e2ad8108b50532d0299f0bff02d6c4589d474ee69744be4aa82385eb89a964f035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712892114, "uuid": "da3dcd9e-3c86-4a50-912d-5c2baba58555", "value": "T1A1D4235E49840337EC28C8F95A723E881AA457F72462F6BDD45C1F4EAA4FB8385C6784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712892114, "uuid": "8fbaf5a7-0a57-48bb-9af0-59b66cdec918", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712892114, "uuid": "3bda3253-ee92-4cb1-8bec-9da0ade9b488", "value": "12288:Zkvq31eoWgh0vxfQ7RduuKZVdtKFo99U1A/UbY2P19BX:ZeqFrh05f7dZLag99X2P1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712892114, "uuid": "7c430fdf-2b40-460e-a8a7-dd28fa4afdca", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712892114, "uuid": "67a8667c-080f-4bf0-b17e-79a1f2845405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712892114, "uuid": "d83c0fe5-54a5-4ac6-88f2-9ae042943bec", "value": "SecuriteInfo.com.Win32.TrojanX-gen.19751.7678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85363ff-f8d7-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712931562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712931562, "uuid": "bbbb2554-de94-4cc0-80d7-3d522fe4ca25", "comment": "Malware payload (njrat)", "value": "73f21442e6e2f2851b4f43469c4a3045", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712931562, "uuid": "a6d9bcf0-da47-4a17-8072-b9f4d043d186", "comment": "Malware payload (njrat)", "value": "d5287df696839eaff465b707962ff9ca0b5235a4890dc19465e3e4afde84013e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712931562, "uuid": "a09608b6-af11-43f0-8d5a-c30b9cfd65f4", "comment": "Malware payload (njrat)", "value": "878e8fd57ec84a270c0602d60b1c0b70281823f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712931562, "uuid": "9378b3c9-cd55-4c52-8155-83853a214db2", "comment": "Malware payload (njrat)", "value": "1e9bb65fa213e35ea918d3be713db88dc905baa4840c772e555bab44556f631f0c07ce2efc1fad17d62d12bdfe8cd82e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712931562, "uuid": "ff6248ba-3e87-4e7f-bd17-26c494104901", "value": "T1EBE208067BE98215D6BC5AFC8CB313214772E3838532EB6F5CDC98CA4B676D00245EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712931562, "uuid": "d59a114c-9412-42b7-bb59-4f25d3a7191b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712931562, "uuid": "54bfd1fd-cfea-4e02-b6ff-ede0e04555a1", "value": "384:n0bUe5XB4e0X+OJ4w0Q0mS03AWTxtTUFQqzF6WObbF:sT9BudH55dRVbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712931562, "uuid": "823de2ad-b49e-44cf-88b3-8d05b4e6df70", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712931562, "uuid": "3f0ab0fc-507a-4e1b-9fd8-d21c822dcec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712931562, "uuid": "5a2f6d76-610e-43f5-bdbe-0ef056df5c2e", "value": "xmsbkx2F0oQn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d836105a-f882-11ee-a120-42010a9c002e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1712895135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895135, "uuid": "ecc65c08-29a1-4cf6-b99e-411e877d8e30", "comment": "Malware payload (Smoke Loader)", "value": "73c5e5058bdb7449f2e38f1c7645b9ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895135, "uuid": "7a77125d-58ec-4011-b653-84e04991e635", "comment": "Malware payload (Smoke Loader)", "value": "d671b17afb9e245e629823dccd61d78257df00834fb2b1fa9431c6439c62fd45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895135, "uuid": "391fde8b-59c2-4670-8fc9-3956862b94ac", "comment": "Malware payload (Smoke Loader)", "value": "e9b584910e84b4af4394d944fd178d2b110c5c96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895135, "uuid": "2fb80108-1927-4ddc-9235-9eb459fc8e5b", "comment": "Malware payload (Smoke Loader)", "value": "fd28613e553eee8c9617db9d60f318c119f247f3f9ed96688ba0dce007490b7ca9adf9c021cfac60dbd1d179effce28d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895135, "uuid": "874829c4-13ce-4661-a99d-dee122e233ea", "value": "T11E548D0272D1A873E6738772DE6996A4673DFCF14E757B2B33485E1F05B00A0D622B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895135, "uuid": "f2094425-9032-4700-b42f-33ebea6df966", "value": "37d5d9e9c6c8829366c7450bc2f82d1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895135, "uuid": "3e348eac-8b82-4f38-960e-743226bedea0", "value": "3072:VOeQ/4QgHDEGn6R3U23Kc+m+vNR2T+wtkeJleNMnIVzwlxyMBzfSz+RDRn/7Yoi:1XEzk23p9iVwtTkMnJlwMBzfhxh/7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712895135, "uuid": "be385039-8380-4044-824d-68a72f4f480b", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712895135, "uuid": "2ab83157-ad10-4605-9fa7-efa62e3dff11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895135, "uuid": "cb44968e-e4ef-46bb-aabb-4705e602002d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd6b0ac-f8fc-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712947328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712947328, "uuid": "fca59a79-5b21-481e-99f0-134d17755736", "comment": "Malware payload (Mirai)", "value": "31d7cae54418563352ab7150a1c39ac5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712947328, "uuid": "8b75265c-d9f3-42ed-bbdc-948568a083f0", "comment": "Malware payload (Mirai)", "value": "d6744b3d1944189efdf81e9faae5929aa01407f17768f4c59996804da095bf5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712947328, "uuid": "49ecb29d-de66-42d1-a13e-c04f7e20cdba", "comment": "Malware payload (Mirai)", "value": "17c84a0c1353e5a4a213a2ab37ec77a643b5cda1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712947328, "uuid": "405f8ba8-d3cf-4f58-abe0-b7060907f34f", "comment": "Malware payload (Mirai)", "value": "3a25313acc54aba713baba4e2a39d8f4046ba382a9caf9627ef37caef9ce5a88c2111285f678f14648119e426061bf87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712947328, "uuid": "24c1aa0e-63c2-41d2-bf1b-4617a5862d23", "value": "T1EBF2F1218267CEF9EF35C177075338881BC07A0267EB8A6D6F8AD265DB733059F45606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712947328, "uuid": "85a3adf0-6b83-4038-bc8e-be6a7b84b775", "value": "768:oFetzn1Ew4Dbd/rKKJJ1tQbcWTZa6nTOdLc5vaf51bK2EffPJdy:CeEfdjDJTuckZa6nTYLc5vafan3vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712947328, "uuid": "420a6ffe-6acf-41e0-ba0d-ab79e40d6e46", "value": 36968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712947328, "uuid": "c219f8fe-f70c-4ce1-b3bc-dd3179510263", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712947328, "uuid": "03883f53-503c-4bc5-bd62-b25bb1dacc40", "value": "d6744b3d1944189efdf81e9faae5929aa01407f17768f4c59996804da095bf5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0215e6-f8f0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712942089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712942089, "uuid": "d30e3f7d-331d-43cc-859e-84c04a1b2b09", "comment": "Malware payload", "value": "2fec3ab587e6b5533b4c6b3c11dd357a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-3881", "colour": "#CBA9EE", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712942089, "uuid": "be0816de-1e48-49b2-bd20-382a87e6a147", "comment": "Malware payload", "value": "d8ccaef116cada9c558f9e912d5cf7ef2978082611e677f6f55ca233f47a2f68", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-3881", "colour": "#CBA9EE", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712942089, "uuid": "128321d3-c74d-4e1b-ba59-c9b9c472939d", "comment": "Malware payload", "value": "65e440b5aee156fa6de192d2361302f3aa0665cc", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-3881", "colour": "#CBA9EE", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712942089, "uuid": "ba588977-df6f-4f52-a534-6a385f2b59d3", "comment": "Malware payload", "value": "cf70f9cb14eb865661c7753d172ec6a37bb0aed9a5296dedea69f21ebaa01fa3d3dacafa537db56a1ac334d0df1a627e", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-3881", "colour": "#CBA9EE", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712942089, "uuid": "2f2b97e5-428a-4d28-ad07-6cea3b673cff", "value": "T158B533AE83A1A156BC96DE317C78731E136067434ECFC2BA0E1ADD9935E4368FC56860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712942089, "uuid": "bfb49ef7-d0a2-461d-9a03-b1c58896cd48", "value": "49152:2wV1kRRv61980djY8Qu6jg+uNbJ1D0glaJYr0N5Hep31YgQjnm:pk+9898oa8gTUFep31jQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712942089, "uuid": "56ccb986-af4e-4301-a654-3fe16ae77501", "value": 2272392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712942089, "uuid": "648fc3f4-f797-4feb-89b5-5ab0fd5f541c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712942089, "uuid": "96878ff3-fb92-4991-b56b-e64354228f1d", "value": "2fec3ab587e6b5533b4c6b3c11dd357a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3974ef90-f8ed-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1712940824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712940824, "uuid": "8d93bb93-7267-4795-8e29-435a69fb37ec", "comment": "Malware payload (QuasarRAT)", "value": "b02a1547fa413fd97deb6d2776bd61a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712940824, "uuid": "6c5f47c8-e063-44cd-b568-97f45ebaa1e6", "comment": "Malware payload (QuasarRAT)", "value": "dabe0f83548baa1bbece033284676e56caff0eea881740218443b390c4e71680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712940824, "uuid": "ef75d14c-e7e1-43dc-abd8-a42ef36246c0", "comment": "Malware payload (QuasarRAT)", "value": "989aee470663d3c63835c47553b65829c26f0948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712940824, "uuid": "af7d9d96-81d0-4512-b583-f7ee9a23f30c", "comment": "Malware payload (QuasarRAT)", "value": "de23b26566aa4e8de82f95fb3c89586c27b60011ca9dfd52a3c1b3449f5906fa8482bfa7b04f2fe1e5e29376fab78c63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712940824, "uuid": "16c4769a-9910-4d14-9e56-8c8bdabeb623", "value": "T114F301128E1CA227C73F4F7C6C97A74577B185256297D38F785022EA5E523820E3A6CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712940824, "uuid": "463d48af-2710-49fe-86e9-a6b5d637fc97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712940824, "uuid": "d98e65af-ddda-4074-a17e-0d87f3fe5be8", "value": "3072:DLPAOjMEZJBuLnKtRYP9fvA6betlndzDQ8vi1AcFc1e11OE/:HAzk9CPJvtY1tU1Acke11r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712940824, "uuid": "84a03ee3-a029-4a4e-9915-54df250e69b6", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712940824, "uuid": "be5aa31e-5e8f-48d5-8c8c-ed7f83be51d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712940824, "uuid": "f22e196b-91b3-48dc-97f9-4b994dae5252", "value": "AprilDiscountVoucher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127cf360-f8eb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712939900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939900, "uuid": "29482403-4f2d-40f0-888d-0743635b96ad", "comment": "Malware payload (Mirai)", "value": "7ba40720b354b98d653ab0c0cf8a8a2f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939900, "uuid": "52833f07-8409-4bbf-a32e-c6440cf0e1e4", "comment": "Malware payload (Mirai)", "value": "db3611c6adfbc039a6e854c45217101f76cdba5703584187a48007869e755745", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939900, "uuid": "2270bdd4-28d9-4933-b77f-6970df024056", "comment": "Malware payload (Mirai)", "value": "639e6e3e45647306751d8b5147f80e33a98e5652", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712939900, "uuid": "e276d1f7-5f8a-43ad-9471-572a38e7d49d", "comment": "Malware payload (Mirai)", "value": "1c78cef6b81742a94b5a08d6f4225d13453e65fbb9acf64ba8bf03051b68ff8d94d275d796a4ed3e2f36273b7a7fc24f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939900, "uuid": "f708c917-a657-48b1-a1ba-7b678832e197", "value": "T1E8635C17B941C1FCC199C2344B7BB63AD93335BE1239B2A6BBD4FE126C89E201D5E944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939900, "uuid": "a8449dac-7aa7-4996-a531-9719a5e04ad2", "value": "1536:Hs9nvjgFUI6FMc3nAI6j18MtabBU2LF7ydQQQxWl09Xgrvtjcq:H8vjwRwMc3APpzt4BJRHQQxWKgrv5cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712939900, "uuid": "9a700d96-1c6c-49ac-891b-43ebb72035cc", "value": 67776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712939900, "uuid": "b429321b-718d-471f-8079-f3441f4137e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712939900, "uuid": "893b9441-19f8-4dab-9316-4f51d213c958", "value": "7ba40720b354b98d653ab0c0cf8a8a2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf463b4-f863-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712881773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881773, "uuid": "bfd78aee-c536-47c8-aac8-82edd6cd4f80", "comment": "Malware payload", "value": "648275d67e9b8c39c6a0315023267169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881773, "uuid": "9432b00d-3a33-45b5-9990-5f25049ed090", "comment": "Malware payload", "value": "db6fd5df4838094e4ec884d8b4bb9e5695948f38a1a6a1ccab4039ac134875f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881773, "uuid": "bdf170c2-c9a6-4eb0-8ba9-15601118e7d6", "comment": "Malware payload", "value": "518926c78674308465679467ac8d16c3eb27da96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881773, "uuid": "1bfac35f-3d2d-4014-91a7-bd8e78ce0d0b", "comment": "Malware payload", "value": "340ce389344eafc53bdb88832ec747cc0835f39435c47fc7585b8ea7e724c397e3004aab3b998acdfafaea1417d48a06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881773, "uuid": "79ec4216-4c6b-4811-b299-cf4cb1ea077b", "value": "T105D63333235A1502CA609574EA55FE22D6F76F415E3464CBE7F9BF2239B1340988CE8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881773, "uuid": "d7f746f9-f94d-4a71-943e-3f1b3a060230", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881773, "uuid": "5d4868d2-697a-4856-8392-9d70294b1968", "value": "196608:bbKu5OKC6jRM1uuS5Zlwn+LBTZSi7J/0PBKaKsvDQ/aeq3VGBBBxmGhg/udGP:bb95jjR1uwB9SiN/c5/eq3VGBdzaWkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712881773, "uuid": "f997b12d-6866-40c8-9681-20d1b29ef8fd", "value": 12633328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712881773, "uuid": "ac1b6571-3e2c-4599-bd3b-41572bebb932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881773, "uuid": "08092c06-febf-46fd-ab96-3fa63a219b27", "value": "SecuriteInfo.com.Program.Unwanted.3168.21315.8917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358dac2c-f89e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712906888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906888, "uuid": "62fafa69-defe-4634-aceb-4dfed0aefe81", "comment": "Malware payload", "value": "93296d670c3e6378469a9c3890546c3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906888, "uuid": "545df2dc-4cdc-4cd4-aa2c-91d24ee455de", "comment": "Malware payload", "value": "dd0b45a95ded59f25c0b6d7b1a5eb135fa288f2f56765ef3172dbaf52a4eb261", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906888, "uuid": "22a97d32-a75b-4faf-8b7f-6c029f08e8f3", "comment": "Malware payload", "value": "e14506906e3e429923e1ad99c608e3762b74bf96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712906888, "uuid": "cffffe81-7f48-481b-9845-965c07a7d8b7", "comment": "Malware payload", "value": "1a711f38972f7a5a7bdacbc3c42c0a221b4345e68a2df0ad707cb4fbc05d3e0a4fc4728911292b18395b203757ec66a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906888, "uuid": "e549fbe6-5952-47f4-b71d-974f36168173", "value": "T1ABA4E1E1EE60F7F9E6120E305D19CBE017DDB8609A34561B235CEA2F1A7C390952F356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906888, "uuid": "604e2bbf-94ed-4c57-8261-a90f91e85f20", "value": "1b0af0470af4d888c83defee61420444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906888, "uuid": "c391982a-adec-42c7-95c3-2fd301ec2049", "value": "6144:/nvY5dj71iHuYAkTZY2IJUfwTpzoDkvTRFmpLhVeKbVd5bIu5yG:n6j718uYAkTPI6Yp6k7icKbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712906888, "uuid": "e0cb348b-1585-4fe8-a752-50b0106e8894", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712906888, "uuid": "f7bfa4f6-98b5-486f-952d-874d425939ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712906888, "uuid": "3835af80-cace-4c22-845b-a212d881caf6", "value": "SecuriteInfo.com.Variant.Zusy.544534.13597.24264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab60d693-f8dd-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712934144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934144, "uuid": "156539e7-72ac-4982-ba8e-63707f638069", "comment": "Malware payload", "value": "a887a620f981957df960512d2afe4c89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934144, "uuid": "30717df2-8c04-468b-a34f-03fb956f7019", "comment": "Malware payload", "value": "e0effc007036fdff2780eafc9005ffcf97ba5fcedc65c753fd43c388bb2f3ce1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934144, "uuid": "060f00cf-3a2a-4a18-8809-2ab35f4909c5", "comment": "Malware payload", "value": "a4ee6c813a16927c9715bcbbb090db777c2038d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934144, "uuid": "db5ada49-1140-4fde-9467-9a6e06cf51c3", "comment": "Malware payload", "value": "06d0d9251d009b2bcf8491fae4dcfe5e99b97c3bc90b978d83f00f3aa086a6baa1a619fff25d63e62deb5726c03811f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934144, "uuid": "a984e279-6239-41ff-abbc-312d6ace4d38", "value": "T189B36A0A33D420FDD0675274CDB69A15D3B2BC2A4674934F27A47B6A1F733826D2E722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934144, "uuid": "08c4c622-2ff1-4bae-912e-0863f8c6cc2f", "value": "c51d659b4b1142d4af3795d09f1d63f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934144, "uuid": "e1f76bc5-0483-48d5-be2d-a4689b1b4829", "value": "1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+Gs9:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+b9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712934144, "uuid": "f556041d-bcba-4a7f-96fd-ced51bbbbe8b", "value": 108404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712934144, "uuid": "c61b47a0-e30c-4b41-9f93-279424914cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934144, "uuid": "96b9a456-8f34-4e64-8fa2-dd8dece415ba", "value": "humanfriendly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a59575-f863-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712881767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881767, "uuid": "bd524670-e47b-45c9-99e5-15190d059ba5", "comment": "Malware payload (AgentTesla)", "value": "568bfa321a8c8089195e670bc8b9d05b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881767, "uuid": "59a4d255-6f75-4f88-a02d-768d1df82a57", "comment": "Malware payload (AgentTesla)", "value": "e2b36a25345950bf0052a95107b9bef29b2ca3cb904685a98b5779041535fda9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881767, "uuid": "8014d184-9e19-4c62-8a8a-717111d5c222", "comment": "Malware payload (AgentTesla)", "value": "3dd10e5fd717aceba2e2e45d7e02b8a7cd9b18f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881767, "uuid": "e097fa94-8368-4391-b56d-b39e407905be", "comment": "Malware payload (AgentTesla)", "value": "fabf45494b7e9feecf8bd71773bbbd9f5767c70837eebe1ae099ced837db5e9b0963f9998a3bbdb2e7e00fbe70bdb6af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881767, "uuid": "65d1e825-8292-486b-a079-2d41a3e016a1", "value": "T105E4F19C765472DFC827CD728EA42C64E66074BB431BD213E42722ACDA1DA9BCF154F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881767, "uuid": "11f4e566-921e-400a-9c1b-d33cbf320e65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881767, "uuid": "90268c78-b1a1-41de-8cab-218b490cc149", "value": "12288:ckvq31eoW5AOD1gkgoYtXk8Db92or0eHVs7kEVqS4L+cTxsX954pS2Tl0eYiaJvZ:ceqFe/13TYt0mbI3e1+xVqSgtTaHcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712881767, "uuid": "20285965-6b8f-4c54-815c-2c142e2acc04", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712881767, "uuid": "bb7581bf-4c90-4d55-9fe2-46071735f8d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881767, "uuid": "e49f8c20-46d7-4bf0-aede-dd6d0156bb21", "value": "SecuriteInfo.com.Heur.9508.19196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e247b903-f8c9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712925646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712925646, "uuid": "10a6191b-f244-4749-bfc8-77ddbbdda7eb", "comment": "Malware payload", "value": "7df59556025e47ed9f44155ac33573cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712925646, "uuid": "eb8a4280-bf5d-4a39-be9b-01c42ea72aa2", "comment": "Malware payload", "value": "e34fb3b05852700ae9f875177eebdb1adb18a56cd0ae378544b2bf66871e4d23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712925646, "uuid": "a42312e9-3907-4d6d-85a7-cd9d47e14b5b", "comment": "Malware payload", "value": "a57fa025d3869374d72404d250644ae24c9cab2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712925646, "uuid": "c9aed3ab-bc20-4e3f-b569-6ea07020aec3", "comment": "Malware payload", "value": "131d627b4a9d25984517bf370c9da271136cdc3872c59c57b03530ed00df219508b6a8403fa9128261b2366470274069", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712925646, "uuid": "0bc8ea66-53e6-4579-9c69-86e3d48946ea", "value": "T1088423502E3DD6FDD8584BB339541C1173781AA74918AB0513BE8DCA8FF2F96682F8D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712925646, "uuid": "5d938e5e-3de8-46a5-bb43-194ee3174924", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712925646, "uuid": "6200d962-b959-4256-97e8-fc946e9e67d9", "value": "6144:v+O2vaXos2cR/uFTlaaylb3l1fAXQBAI/NKn1HqxNUwcFqCkp+NIexVF:m9Oos2cRGFTlaZl0XEFNK1HqbLtpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712925646, "uuid": "1ca37cb1-ce46-4af2-9f5e-284c52f8c4b1", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712925646, "uuid": "04ee07ee-6389-4ae8-b36d-9f3801479214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712925646, "uuid": "23f0af7b-77a1-4efe-ad7d-bd8846e186c4", "value": "7df59556025e47ed9f44155ac33573cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f06538a-f8a8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712911145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911145, "uuid": "394dc083-c52b-47ad-80c2-2ac187bbef42", "comment": "Malware payload", "value": "0d2400ecfb6b1857a26ad1dd124c4806", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911145, "uuid": "a3f65eed-3d96-4a60-be69-1720de4ce819", "comment": "Malware payload", "value": "e6433b54eeeca4efa18f93bd3d90339114edd040a16083e6d5be17f7f0f655e3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911145, "uuid": "11738eb3-aa5c-4068-8fdc-0475a6700bcb", "comment": "Malware payload", "value": "2eed3e907f0dc8176080bfb88324ef0f4d1f0553", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911145, "uuid": "43ddccb3-3bd6-480a-9d2f-28ee4391bc54", "comment": "Malware payload", "value": "9c9ce60d0a68d27867d3e4940ea076835b8dca524a64d20c86488f33417e32d6b865fde529c273f6090b0f3abbcc6fb4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911145, "uuid": "6b38e6aa-eede-49c4-a482-76ce4ff562fe", "value": "T14354963CF1FA1495A433AB9136E09221D6072DB7FCA8EA2340AFC1B475FC4534769AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911145, "uuid": "e2e8b7db-ab89-4631-a17a-b3df68bd1b75", "value": "1536:Gz/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/z/8:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712911145, "uuid": "aafca1ab-a6bf-4bd8-9018-cea9921b7077", "value": 293734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712911145, "uuid": "0d478c72-9122-490c-8f06-ce7acbc34b4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911145, "uuid": "8f75679f-7896-41d8-82fd-d85a594e555e", "value": "1_JC.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed1bd76-f884-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712895736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895736, "uuid": "c4beedb9-f6b7-4bf4-bf21-92f63f3e0e8f", "comment": "Malware payload", "value": "884b8974c7353144e5bf3d0f582d5217", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895736, "uuid": "9489ceb7-66a6-46e3-a298-8b95e117ef0c", "comment": "Malware payload", "value": "e79c8fe1cf16c2d54a6f5115fc89113befba1a26f827a5ce05e56e8512bc85af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895736, "uuid": "4ef470d1-4e91-4c65-8c77-19251db337a6", "comment": "Malware payload", "value": "e42801eaa20292f4d4122a25d32a0fcfc425b573", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712895736, "uuid": "6d7e679a-6ef9-4837-bb78-bb4b40812d35", "comment": "Malware payload", "value": "d4fb7c688cf9551b12d76518b15924afcf14d58cc69d8c31bcc423a44891391b846c34d4b413897ddf4a19895b5ab5e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895736, "uuid": "3702c4e7-2154-4d0f-8d68-6940e30adb3b", "value": "T120163307F7601539C8F25CB41A47FC2BA9B7BA448D743244B16E2688FF2B4A486465DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895736, "uuid": "52cdf828-d98f-405e-aed6-4502d49e927f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895736, "uuid": "b2c0db92-d247-4fa3-996f-b7c9d759102a", "value": "98304:CsdLov1wm2+M0F8lPko0FdrdcBI0b2dmLaYj6juZHBO:IJ2rH0FdrdsI0b2dm2O/ZhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712895736, "uuid": "8d4d9f73-8a99-48dc-8c3d-e21e24428bc3", "value": 4170222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712895736, "uuid": "ae8f84ba-8309-4de8-bd79-e2447d9b1d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712895736, "uuid": "f8b5e48c-f9dd-40c7-8075-7a9c278148da", "value": "SecuriteInfo.com.Trojan.Win32.Crypt.12974.26459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0f744e-f894-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712902627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902627, "uuid": "24e88f35-f007-4752-b1e3-1ecf9fefa44e", "comment": "Malware payload (AgentTesla)", "value": "59a8039570f0634f82e7d25bddd37658", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902627, "uuid": "a7c6d9b2-e1d1-4b57-8f49-b375d47df6f7", "comment": "Malware payload (AgentTesla)", "value": "eda52b32b68b4a7f91bf7ddc52967d6541aa2d7d0ffbfd7a2cf1f70727bae239", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902627, "uuid": "8c4f3d12-f509-4d88-9582-b21b78b522e1", "comment": "Malware payload (AgentTesla)", "value": "868fc0385ba057cef96178eb54f04677fc4a3aed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712902627, "uuid": "7df5b65c-9aaa-4d9f-91ea-681a92270b77", "comment": "Malware payload (AgentTesla)", "value": "d93108668223df3e0f12741a8fcb67a00f70a01e90b75079204126c6a6a96945a3a10618e9a33e576db608f3f8a7025c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902627, "uuid": "63df86a3-c885-47bb-821f-f89b0e5f030e", "value": "T1D734FD037E88EB15E5A83D3782EF6C2413B2B0C71633C60B6F49AFA614516466D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902627, "uuid": "cbf62bbb-4150-47a3-a127-2d63f3d0d378", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902627, "uuid": "27df475f-0471-4b94-9f27-71431ced3ef5", "value": "1536:7Ca7cyo/4Ag4YfeJfL2Gk0OgtbCBcJsIx2lRZ/Za1gV2dqjui8LTO802/z/IwKv1:7XU4Ag4YMtGb1Ey8Hz/Iwvz52I/mgZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712902627, "uuid": "f521dc58-369c-4d12-99df-4a6a1594f0c1", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712902627, "uuid": "2c3a0980-5aaa-4c96-b55b-6cd623e5e425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712902627, "uuid": "be149d51-f0a8-4852-aa08-a63126c82a9f", "value": "17129026260efdd91c6d1ffeca6e8eda3ece36cd849272dce1a2d9ab3c208be65a370d4493880.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77003175-f8b1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712915158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915158, "uuid": "e76b87f1-02f3-4602-b00f-ee97c8bc74c6", "comment": "Malware payload", "value": "1e3cc474231150f83579e1f20d6a6afc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915158, "uuid": "23cb7d87-f30a-4af3-9307-76b360a568c6", "comment": "Malware payload", "value": "ee61f65a99de235f6bac4ca87a93817eeb8befecf7d50eb3acc605611e0dbfc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915158, "uuid": "98c17c1f-633a-4c40-b033-766b00f74024", "comment": "Malware payload", "value": "f2d235925124a0e9c7d56dec933a1bbbf72a0243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712915158, "uuid": "ea32d104-556c-4904-a44d-4fb724db9432", "comment": "Malware payload", "value": "8b2f3fbb300a34da24e9e7fc72efa5e9b7481c77d22993d912abfd8858292c1de89ca339703bf99898cf9f73e479ad1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915158, "uuid": "87fd5de8-2a6a-4c29-8c0d-5e306d150842", "value": "T1A216E043D668C72ACACD01FD9E31A0845D82D25F959BF7D5B0886E6818FA3DB7D0F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915158, "uuid": "cb74bc06-643e-4011-ad28-1b77a3d2c291", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915158, "uuid": "fc95d2d1-1e1f-411e-ab50-e4c14d3d23e9", "value": "98304:7MT0OFqpt+1f8m17ab29kncbnuLt2Hy62EE+DK3T3xj:7MTPq/M172Qk6uLtO/2EE+mL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712915158, "uuid": "88362ade-278f-4774-883c-af03f24964d4", "value": 4033536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712915158, "uuid": "aeb21bd1-1ff6-4adc-a0f8-05bf0c18c801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712915158, "uuid": "34022408-c47a-4e6a-a473-26ed92b5f4fe", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.KHA.gen.Eldorado.19865.31297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd37e103-f863-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712881775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881775, "uuid": "2c3eeab0-13c7-4f3e-a532-c0740da0c37e", "comment": "Malware payload", "value": "0417bca641dfcd079160dc61944f9fd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881775, "uuid": "7ec2ddba-ac21-4628-9ca2-775efae1e5c8", "comment": "Malware payload", "value": "ef52b3eb83b5015f0e7e11f29d80544136f4fd5323f82036df0e248c05f2a041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881775, "uuid": "f5a8f606-f913-4c5a-93b2-5a32cf2dbddf", "comment": "Malware payload", "value": "38082928fc7530d409a0db69fd675eaf2fb4713e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712881775, "uuid": "5b592b27-809f-40ae-9798-9e0fe2e82e07", "comment": "Malware payload", "value": "21ae190a118bf48972b55021a9dc62c98fc991ecbf0c426576ebfa5e769276550e30a11c73f5db298e5a816abf584e4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881775, "uuid": "c8d1cce0-ce4f-42fd-abf5-c8f8d46e9e46", "value": "T1BF73E51637E88795E8A9CFF22D75C2950F73B92EE930EE1D9D4402C846BEB005562F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881775, "uuid": "c4c42076-8912-4a53-8c4f-a34b9f46a394", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881775, "uuid": "53c74f6e-2401-45b4-99a2-984a7dd6f41d", "value": "1536:gNxafF/VQnllEXH8PxVgKoMC9vyrC/VQnllEXH8PxVgKoMC9vyro:MxafFNmllOIgFX9vTNmllOIgFX9vX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712881775, "uuid": "1291e0c7-afcc-4d75-8e19-c281f1097ce0", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712881775, "uuid": "a1b70018-eb3e-4e08-ba22-e5676534bf7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712881775, "uuid": "010e3cef-e80d-4049-84c0-c54ba87d4532", "value": "SecuriteInfo.com.Trojan.Win32.Agent.2002.3642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba47e53d-f874-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712889072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889072, "uuid": "3f11884f-c664-41f3-98fc-f85c7c8da4a0", "comment": "Malware payload", "value": "a049363fbe9e8e98547d1a3d4694ea9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889072, "uuid": "d4585b4c-933c-4268-a269-5d6c37039daa", "comment": "Malware payload", "value": "f1c79bc29231efd0aaa9138d7e13df0209ae28f6ec7fa8b3b85e57d60a0adbb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889072, "uuid": "0c8a586d-c1e1-4b77-afb0-ee4f06c8002f", "comment": "Malware payload", "value": "db73c14ac4dbc93966b2ca4158e3bcc7815109c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712889072, "uuid": "f716515d-9e38-45e2-9c9c-875320458068", "comment": "Malware payload", "value": "a63ef64b7b3ef213d99f4c737a4291f2afc3eea13feeaf5a566399786c2fc8a59cf78ec77eb55a6365b1e89277c897af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889072, "uuid": "da576c40-e326-4729-ad9d-aa5b6c91b1bd", "value": "T1A0A73301BA409135E8B301B6CEBFB66D926CBD30570561C7ABC83E6D5B769E3793120B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889072, "uuid": "36a28f66-7137-40fb-8bd2-58f5e767b9d0", "value": "5770c0081fe6e933bcd66b97441d46a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889072, "uuid": "c2fcbd36-0e43-4aa4-afb4-79cc66649df0", "value": "786432:Cee2ddaQ/KrzdH6Kkf3u8O+3/CGHeF4Eogk+RrFpldGxujSNLcfk6lYog9a0gnt5:DD/KrzdXkqIK2eFyf+RrBPjNfkQ/g9ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712889072, "uuid": "ff13aad0-cd03-4bb1-9b90-50077c3418e2", "value": 44769264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712889072, "uuid": "5310345c-9c23-4725-8706-bcb1503b30ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712889072, "uuid": "32c19d83-a7f7-4b16-ab8e-7fc6fb2529f0", "value": "SecuriteInfo.com.Trojan.Siggen14.37456.29546.22604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1502e2a4-f88e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712899961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712899961, "uuid": "54a348fe-bd14-437c-9c50-61dcaf251a0f", "comment": "Malware payload", "value": "c94ded66fd91f1926f436fcdc92e6444", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712899961, "uuid": "e795322b-8823-4377-927a-e57cc227ce35", "comment": "Malware payload", "value": "f2273b4ee392ca235805ad3ce42ad903a34b2effc9cf54b01eed647ccb0ee0e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712899961, "uuid": "ef369670-3f6d-4b5b-9ad5-2534407dd339", "comment": "Malware payload", "value": "941b13b8af43dae2f5587ed2d0cfd950842958e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712899961, "uuid": "15872d85-80d7-4646-abd0-48fd9a90a596", "comment": "Malware payload", "value": "f5dc738c94ac3f0859e65b6d97eee0bff741cefe6dcdf302e401a94291bb67a632dfbda9f1027314569916e9fc79ef23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712899961, "uuid": "0a933659-2701-4da9-9667-72706e009fb1", "value": "T15DB4E1E1AEA0B7EDE2614E305919CBD016EDBD50EA305687235CDE1F2A3C7908A3F751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712899961, "uuid": "17c007b9-0a2b-412a-8887-6bd255165145", "value": "1b0af0470af4d888c83defee61420444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712899961, "uuid": "29f50add-3d2f-4104-ae7e-bd458f42c718", "value": "6144:9rdSsbVOr4Wk4bUVkHUusMvdK0c9IftMIyVjibSnZVEWbZ/ihreKbVd5bzu5yoP1:/FbVORGVmUlwda9Iftgj5nZvRKbOn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712899961, "uuid": "fa8c27a4-4605-43d1-ab5d-abe3ca55ad23", "value": 535041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712899961, "uuid": "3a31d0b8-341d-4237-b920-6c9c82d58fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712899961, "uuid": "9ed8aa2f-fd7a-482a-b5a8-d389a1647805", "value": "c94ded66fd91f1926f436fcdc92e6444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a4c9d8-f895-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712903235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903235, "uuid": "95f5fae6-8ddc-48e0-bfaa-26efea802538", "comment": "Malware payload", "value": "c616432dc149576f7f7439f3c5dbd533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903235, "uuid": "a3c731b8-9134-4124-bf3a-66c29b625633", "comment": "Malware payload", "value": "f2698469dace80e405afd58a171414031e631fa28c91feea0b53386fae9b95ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903235, "uuid": "04cd5dcb-5f07-4b62-9612-c6faa896ee36", "comment": "Malware payload", "value": "cbb90e1bb0760e8b957c3cc046a412408ecc5181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712903235, "uuid": "7eea6a62-d88d-4c4c-ac0d-dfafd7083984", "comment": "Malware payload", "value": "fe30e9a78d299a6c1ea204512b27fb1e079b18ea8ab59c3c7b5684d859b1b05e7295e816224413ca26418bedeb18b65d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903235, "uuid": "751e8cff-c326-4052-b03c-b69d2bc56c56", "value": "T17E940209767B5746C84D1930C1E78C261AF6E78335B3D68A3E4912850F827CADE8B7ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903235, "uuid": "efce6f24-bf19-4a8d-abb9-52ee736bfeca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903235, "uuid": "7e6bf424-23f6-4ba9-bff4-da65e2a3540a", "value": "6144:erJcR6N2gORT1mYexdTN0kKaA3VgWFdg/s8XO2wat0iYQ:9skgOR11erTgaA3qqg/je2GiYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712903235, "uuid": "214c878c-e2c0-489a-a159-42182da13309", "value": 408712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712903235, "uuid": "bde07b67-68db-4c6b-827a-05c90bd55900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712903235, "uuid": "b9e1b631-2fa2-4517-8ab7-31577d7f7c25", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cef5bed-f8b7-11ee-a120-42010a9c002e", "comment": "Malware payload (Glupteba)", "timestamp": 1712917638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712917638, "uuid": "08801a67-f9a9-4781-8345-52c12579faca", "comment": "Malware payload (Glupteba)", "value": "d3d4eba4ba6831ee614aa7a3cec04586", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712917638, "uuid": "698a8d70-7b21-4ed1-822b-9e3fd75ad41d", "comment": "Malware payload (Glupteba)", "value": "f349a03a2c8709c06d4434720abb398893b103670b03ee018938b48db0e6eaf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712917638, "uuid": "1b873c7e-0b84-469a-a194-e906c18d7857", "comment": "Malware payload (Glupteba)", "value": "e4d14b18aa6a1e786819bba3c77d29bf5555875a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712917638, "uuid": "20f9cc3d-5738-46a1-8b14-46863cccc2fe", "comment": "Malware payload (Glupteba)", "value": "24d34a3dd53c25d1229c66a40ec637584457f85b3f112df81f69cc2ff611b244d6d6caef7a132c78ddce77a9a4ad0958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712917638, "uuid": "95380d96-60b4-4712-8ca0-de71bef5af18", "value": "T1DF263320A215F77BD1B79C3144AEDBE79ABEA8408B785A5B730C1D5D0E7DB804853393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712917638, "uuid": "6d0c9b42-875a-4dfb-9d96-62ea298e071d", "value": "e03af4c47837fbfefcd192e4bab71da3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712917638, "uuid": "589e5f45-f1ca-4fdc-be07-84f4f6d2e061", "value": "98304:VA4fQecysdnM7rvSYUUWKris2uPrVauxJtwjQ5u0TJp8:rQecsPjnzPnHwjQ5TTJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712917638, "uuid": "34d95e93-9eff-45f4-a7fe-f47453062867", "value": 4437384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712917638, "uuid": "740771e7-c6ee-4048-bbee-b9973044809c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712917638, "uuid": "5a841b6c-4eb6-44c8-9d7d-65b906f50b95", "value": "SecuriteInfo.com.Win32.BotX-gen.25516.7795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d7f064-f8af-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkTortilla)", "timestamp": 1712914208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712914208, "uuid": "1241c532-3180-42fd-909c-5638455c7d40", "comment": "Malware payload (DarkTortilla)", "value": "401058c02d8d2199ad2867a9c67be4aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712914208, "uuid": "c71c8ade-5199-4dda-a30c-b8c680607d43", "comment": "Malware payload (DarkTortilla)", "value": "f3df175fa9855f1199a96a150f59c0147c0305d3262bf12f4baadd7eec3f1a0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712914208, "uuid": "cc7a3e74-5d31-4cd6-9455-be47dc9c403f", "comment": "Malware payload (DarkTortilla)", "value": "e297e156b571f6b2811caf230544d92a8de2a771", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712914208, "uuid": "e2a7ba8f-a8dd-44af-9939-c280f9290337", "comment": "Malware payload (DarkTortilla)", "value": "de16138c23cf4a156a2878eff814e84823dde54fb98bb2b3f247594a74a0dab3fb1c040bc5ac6064c7903657613133df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712914208, "uuid": "34e6df5e-b2d3-460c-aa45-6b1af97dbb9d", "value": "T1FCA5D0C7B7E9ED04C03E3B7071A0355082F2A4C98D62C94F1AE5A5CD7FB3245ABD159A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712914208, "uuid": "439acd7b-d93e-497e-b0cb-e0bd7867f61e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712914208, "uuid": "31190687-cc04-4edb-9e76-5e5839b94f41", "value": "24576:jY8/pR0EYp9wMdM5JuzYLVN/UY0XGZ4xtE+aO7CrLiu4l70V6Xe8HQr3:jLpR0/jwMd0uz3/GixtvaO9Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712914208, "uuid": "a0f74e61-c6b1-4a94-ae9e-38fab301815b", "value": 2187264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712914208, "uuid": "1f6631c4-2f9e-4c99-9582-989f655f9023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712914208, "uuid": "b2a268e8-cc70-4b40-8a86-1b98da9ec62a", "value": "401058c02d8d2199ad2867a9c67be4aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1857596-f88c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712899365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712899365, "uuid": "7c65152b-d038-493e-a3c5-7a826cacc2e9", "comment": "Malware payload", "value": "3b5e5e15b99a49c9259e7bbd6d64f608", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712899365, "uuid": "8327dbae-2949-40a6-b2b5-b7033ee7f6b9", "comment": "Malware payload", "value": "f4969695d2254e3942c65ea612d8081c9e03721c7df77c42dc83994119581e8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712899365, "uuid": "0b011c66-f8a3-4e35-915f-9eed26702e86", "comment": "Malware payload", "value": "2d83d60e66af0b76ecb7087d043a84bb5b783dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712899365, "uuid": "15850b96-88e8-42b9-9c04-3f094429f3a3", "comment": "Malware payload", "value": "6b578c29d5c487449fd6ade52443b642d3a3be1631b2e9be17e97b426f0ca100b9ffdd0d65591594b38aab5f49a4d114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712899365, "uuid": "4b608e5b-839c-4f1a-8116-d6d4bf3a703f", "value": "T10016332B3A1019B0D8326E336C1183594D7F7FE451A3595E363E1E9D9FE78F840A928B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712899365, "uuid": "b0bd84fd-5eac-4341-8b01-2ccffef1e1f5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712899365, "uuid": "dee2027d-9937-4e3a-8356-6c97da30f46a", "value": "98304:CMZLyZfXNbL+NCRBjdYkU+RsadLypI97NWO:3Zmh84RBjKFAxy0wO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712899365, "uuid": "1138ed2e-04e4-4c6d-85db-61cb9a62d6bd", "value": 4191135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712899365, "uuid": "bf0214c3-9ce8-4882-971c-0a5bea9ed14c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712899365, "uuid": "7b5e45f8-0204-43e2-99ee-f310808b15a0", "value": "SecuriteInfo.com.Trojan.Win32.Crypt.28283.2949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10efe268-f89c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712905967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905967, "uuid": "051acda9-5c85-469c-9b51-e14a9f659379", "comment": "Malware payload", "value": "c23299a9f200c365d7b2e6f7e7d2dccf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905967, "uuid": "4c56203b-3257-4ce5-aff2-2226c4607f05", "comment": "Malware payload", "value": "f5af75ed7ffa16e6d73befbc2748a2804a1b48295e3ce863f0ee8f7853736996", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905967, "uuid": "ffd02d8b-f48d-440c-8742-f7738cf290f8", "comment": "Malware payload", "value": "e38ed69dcf90c5a74e4d53d55dafc414b5466cc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712905967, "uuid": "c35d99ca-9c65-4cb7-b5a2-e2ae124c5ec8", "comment": "Malware payload", "value": "863e3871194c1000a3d0e5c01a220c7ea528b4c3ae9f4cf0f3bada215ee1da82b30493126cc55b1f3033972de1f9fc10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905967, "uuid": "ffcf2a38-2f24-4d70-b616-2a57af537983", "value": "T17047DF73910738E9E5A98DB4D01425426DAC38875738A3C7BAC871F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905967, "uuid": "bb84af29-af3e-4e72-9675-22ef124f7957", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaB:sXyWSpV+Wu7rI3JE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712905967, "uuid": "80730eae-8911-4f6c-a356-f110125bc5a9", "value": 25591808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712905967, "uuid": "9917d42a-f7a9-4396-b577-921dd805eebd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712905967, "uuid": "d49a4957-8119-498b-b34d-16ac87b2059b", "value": "f5af75ed7ffa16e6d73befbc2748a2804a1b48295e3ce863f0ee8f7853736996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1856d1c1-f8a9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712911563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911563, "uuid": "9f6e4280-33a9-461f-9934-fea0c2d0b9df", "comment": "Malware payload (Mirai)", "value": "f45d4126591990f45382d85f52bafd0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911563, "uuid": "ce6e33fb-e609-4df1-a4a3-ec0d634421fe", "comment": "Malware payload (Mirai)", "value": "f748923e54a1caf87578b42950400e1724c3e8549f1ecc1417973c03e19ebae8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911563, "uuid": "919f1cb5-1f35-41fc-a5bf-674f7f923009", "comment": "Malware payload (Mirai)", "value": "eafd6ccd2bb6a0bd642053a0d173d301922fb788", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911563, "uuid": "af14afcb-3789-4cb0-86f4-cf03508dd0f2", "comment": "Malware payload (Mirai)", "value": "f68e8cf322a8ca2a1427b2c25c5d4561d1fe5fdf04009258ae33075e8789bca9cf5887c5d982276d7b99ceb71298d753", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911563, "uuid": "95fa4594-14d4-4369-aa08-f4b686592790", "value": "T1CFE3182277B60A27C0E4A579B1F75733B2B947CA14ACC60B3EA10D8D6FA95503117BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911563, "uuid": "52c8db0f-bd29-4ddf-a23d-b4c7fbb4e546", "value": "1536:GbrvO3QIAKZvZJOsPK2HfEaTcERF/29g8ytzTsTH+wbRXLstYmw8yqGyocjzsbVO:Vp3zXGuVwz+ezmwrc3swvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712911563, "uuid": "a9b26862-f3ed-4503-ac1a-04124234ef57", "value": 152520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712911563, "uuid": "4cd8cc9b-f807-466d-9085-e16749008dc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911563, "uuid": "55112f51-3686-400d-b4d3-6969c0896409", "value": "f45d4126591990f45382d85f52bafd0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31467828-f8ce-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712927496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712927496, "uuid": "262a40d5-1e3e-41b5-966e-e7659beb4158", "comment": "Malware payload (RedLineStealer)", "value": "a037d37588be527d6ab4a8b694008c0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712927496, "uuid": "0f96d780-775d-4ee4-9859-868823edd3a0", "comment": "Malware payload (RedLineStealer)", "value": "fa8bab85d7368e130a5ababcafc8a57e7d1681ced8196790292c5797439c2c22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712927496, "uuid": "145b6517-0cfe-439e-9a0a-82ea76db4711", "comment": "Malware payload (RedLineStealer)", "value": "bac3e9c35cb809d8db154e82054d01b41af9d5cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712927496, "uuid": "527511ac-f584-4787-81c5-3663e35e01b0", "comment": "Malware payload (RedLineStealer)", "value": "aca5e872bc1fdc731f5595d069a37f253143f7ab19aae4dac2eefaeb5be3aba81ce52721a095beb8b5a726f088e04691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712927496, "uuid": "48ccc27f-4508-49c8-bec9-8c6bf0382317", "value": "T1B564237F8AA50145C846CBB3365AEE004BF0D6AAA85359FC7C026067871E75B5F86FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712927496, "uuid": "a56c2927-875a-491c-9ed6-5301a410ffa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712927496, "uuid": "b9f080c2-bd3d-4740-bb41-7cd4707d7970", "value": "6144:QKn43PyXqq7Pul8yG19LQXHl35VlpP6aBGIZ+rbMvfqt3:QKne6XdPullh3lpVviTQ+8vfqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712927496, "uuid": "c8f7e01c-1df1-4700-b128-3f1e6a6e7ce0", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712927496, "uuid": "40515a65-cce9-4c62-b680-fb793e6f511c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712927496, "uuid": "733c1251-15b9-4110-92c8-9c7ab861019d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767bc2e2-f871-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712887669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712887669, "uuid": "68c05923-b6cf-480e-9be2-042caf26af53", "comment": "Malware payload", "value": "f54b6d787fd36793b2ac7ac892d53a43", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712887669, "uuid": "960c65b4-5c7a-4ed9-83d7-eae05be20c1e", "comment": "Malware payload", "value": "fb85c97c81b9ac1293cb4b70c60a790e7f7785a1d0d522643e04c01b87d381f4", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712887669, "uuid": "9bda1b91-b50b-4137-99b0-9eee0f3b04eb", "comment": "Malware payload", "value": "59143f20d2172fe99034ef47530492fe355ff760", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712887669, "uuid": "c8b53248-0ec7-47c6-88bd-1aab580d5d09", "comment": "Malware payload", "value": "5767fd3619763b32ddf24c6cb7a6829cceda775bf0c720c37d6d6e06e8d8a0709455726a4ea1a8cc86aae62c7f327966", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712887669, "uuid": "fe66d1cc-d042-41c9-8447-a4bd423fcc34", "value": "T1FC16450B48A7C7E097A352A3DFD5C1CE7F57BF8921BB650C6889D3CFE61220624649D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712887669, "uuid": "a73d3a8d-3942-4337-b945-815e0fa31ec4", "value": "49152:TmyGeFiTDcE35qCQRgjNDyHTpHeoqgiIY2PrNG:T8fZ3ACwLzpH5q14jE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712887669, "uuid": "2bc49009-efb9-4b54-b946-aed111f068c8", "value": 4108431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712887669, "uuid": "c3ef1c2b-2c6c-43f8-837c-3ebd4e8832f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712887669, "uuid": "0ac770c7-a17e-4ef6-9fd9-78a7f6ce8d3f", "value": "bundle.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8b4a73-f8de-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712934335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934335, "uuid": "0ec994c5-841b-4380-88b2-95e876ccb2e4", "comment": "Malware payload (Mirai)", "value": "4f268a75b82e7984aaf49354783a0d63", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934335, "uuid": "20ba87bc-81db-4c3c-acd0-e1b4e7afd3d5", "comment": "Malware payload (Mirai)", "value": "fc5d923c7c92db2cef5b7fe4e06bb703ec29ffabc051939fcdeb1dfb6f71ec99", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934335, "uuid": "63fec73c-8564-42ba-9ebe-0230091bb9df", "comment": "Malware payload (Mirai)", "value": "d1bf617a3d276f2e11797c503eb044e672bcad07", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712934335, "uuid": "5eb8dcc0-3914-4709-8fde-4df4db324643", "comment": "Malware payload (Mirai)", "value": "157a0d3565dd0ebc85034b43366a408b868a014e6ef2044850f7c38e862ccc823aab2cac7ebd05d98f31cc96260b87b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934335, "uuid": "1df34da0-5dd6-4e32-a1e7-023cdaf8b6d7", "value": "T1F7732B03B542C4FDD9ABC1345F5EBA3AD82375FC1228F1AA6BD0EA326D66D210D2DD05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934335, "uuid": "81057d00-0999-48a0-9552-ec95c4da946b", "value": "1536:/WEOXyxL8P2O8qd+z5lA8vZ9/pYOVXJM1jP2WRuGl8V7wNJAd:/WFXyB8P2tqd+z5lA8vZ9RYxjPLR5yVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712934335, "uuid": "c941559f-7ff4-4d06-a705-c5130333a71e", "value": 76304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712934335, "uuid": "062d9204-ef9d-473c-bd0d-2ca6d70b943f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712934335, "uuid": "a051d541-8bad-4b4d-bf82-8985ce1096eb", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a09901-f8a9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712911530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911530, "uuid": "3b10cfd4-f4e1-4893-804f-b868f7f58738", "comment": "Malware payload (Mirai)", "value": "3201f682957c05ebd488caa8cab935c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911530, "uuid": "8b5fc217-ce66-4cf8-b592-4fb636d841d3", "comment": "Malware payload (Mirai)", "value": "fcbead7e8aca69be6052417138f5e496a21de59a7dd6ce378d62184f0cfc1697", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911530, "uuid": "6d155e08-b840-4c5c-80f3-4caaf1b389c5", "comment": "Malware payload (Mirai)", "value": "d92f940d318a1800888d7b5326e62ff030524baf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911530, "uuid": "c1334e7d-e05c-4090-bb38-5eaac27c205a", "comment": "Malware payload (Mirai)", "value": "2ece6e4da3929d1f1d6c86bfd8bcabc6456a8931e7e719498d79c667a08e2b7026d85298ae739c6b86a96d7e8d0a8d3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911530, "uuid": "f3377172-51d4-47b3-8c7b-013cb54560ee", "value": "T177E31B56F8818F12D5C111BAFE1E128E37131B78E2DE72129D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911530, "uuid": "895b22de-e861-40cc-8f42-3be95458df16", "value": "3072:ARpOoGZUKySLmXu2gMYRacVRjTh4CddDCY6s:ARQoGZ59mXpgMMauaAdDCYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712911530, "uuid": "40b383b1-ab05-4a95-9d27-f9026b2ee3e5", "value": 148092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712911530, "uuid": "a24c1c1d-6516-4cea-b306-6b3961188733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911530, "uuid": "664ce7a5-7e67-4112-bdba-11a3311aee30", "value": "3201f682957c05ebd488caa8cab935c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7a1341-f90c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712954067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712954067, "uuid": "ae7e4848-3c53-40b6-b590-daff0e54ad3d", "comment": "Malware payload", "value": "e285b7b984b0682943ebaaf0a6cc1e30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712954067, "uuid": "06ea029c-b142-417f-908f-419df851534d", "comment": "Malware payload", "value": "fd0b5348bbfd013359f9651268ee67a265bce4e3a1cacf61956e3246bac482e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712954067, "uuid": "19a11aad-5970-44b3-8c86-0f64a95f3b80", "comment": "Malware payload", "value": "437d53c22ec449b0b167c64a6f2bf476eaa6b5d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712954067, "uuid": "bfd202be-d37f-4e0a-8faf-8cf2832cfc23", "comment": "Malware payload", "value": "26a182a0a3a80eb48c5321f8a4f6fcac721ac04530b22842a943a27888dd874c50d99f97eae15cb86ee2aab847e2ec26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712954067, "uuid": "1c2db447-07ff-4250-9603-2c34437ef22e", "value": "T1EED3D82A7A21ABBEE168863107F79F6093D525E327E19341E26CCB181F7428D1D5FBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712954067, "uuid": "a50a0b94-92ec-4e88-a9b3-6007a86831dc", "value": "3072:dvyprnPXIDAD/d9jyVGiEDp0sCJxXEk7MmjcoE7GN:hApKJxXf7MmjcoE7GN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712954067, "uuid": "977bed49-9a6f-46a7-810c-5c03eb3cd65a", "value": 142088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712954067, "uuid": "4adafe6c-0a1e-4714-a08d-dab513e81be7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712954067, "uuid": "97c96541-4781-4c76-9e15-9cda5e5913c1", "value": "e285b7b984b0682943ebaaf0a6cc1e30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6d4b2e-f8a9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712911541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911541, "uuid": "1729eacc-4c5d-46f3-90a8-e1f875290b3a", "comment": "Malware payload (Mirai)", "value": "9a23e9fc5ddd1f6e0e9ca112e0faf7f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911541, "uuid": "b036a0a6-2977-4979-8f97-3ce6071f08ac", "comment": "Malware payload (Mirai)", "value": "fe2e32235ff8e1b848f5ad28da452ef900134d2877aa1a82b22f48fbb6dc3138", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911541, "uuid": "be8b86c0-dc9c-4f94-9c6b-01d5d6fb7f81", "comment": "Malware payload (Mirai)", "value": "2b303b434a087711bfb45dc11bb25c18575df3be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712911541, "uuid": "66cda96b-47bd-45c2-b36f-6203e33b8f8e", "comment": "Malware payload (Mirai)", "value": "a3dde78b91d97164f77af1bc8a30a2fdbb4321fd6816324bc996a8d220227e004c2ed2e15758786fb5b6ec0e7d5c4fee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911541, "uuid": "11e8a794-f53d-4883-bfab-020ddca793af", "value": "T142D30745F8804F13C6C652BBFB5D428D3B2A1BA9D2EA71039D206F61378B95B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911541, "uuid": "15eb396e-ec12-4212-a96a-16481576d962", "value": "3072:EiVwtr1ov6ZIQgilNGVv0bxFHs25LsuEJrjA6kde64:vKov6mQg7Vv0Xs2lsuWIe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712911541, "uuid": "de12ebab-d702-4313-a7ff-486ac64148cc", "value": 142280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712911541, "uuid": "91b1ec91-11fc-4701-aa40-dd77544425c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712911541, "uuid": "fb27913a-92ed-47bb-b5a2-aa247c84bd94", "value": "9a23e9fc5ddd1f6e0e9ca112e0faf7f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00ec09d-f8c2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712922662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712922662, "uuid": "ff085a84-854a-48de-a153-3701579a15e2", "comment": "Malware payload", "value": "d341fe6eebc36000af7ef50b1d48057d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712922662, "uuid": "9644c09b-acea-4eeb-8e13-fcd30c4b9e33", "comment": "Malware payload", "value": "febb491f79a2ebe531abcbb4ab055e032413a4690034870052aa4d110fad5f61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712922662, "uuid": "1f8c2c37-cb95-46f3-9695-f833ecce99a8", "comment": "Malware payload", "value": "87fc3e116d6f5df6c813fe8e56a705fe37cfc59f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712922662, "uuid": "c1e6858d-7774-4748-a7a6-a270793b200e", "comment": "Malware payload", "value": "2421a61d206a7f5a3d2e54b46c094129c7ba5994eb09be445cd7ed4937dc07f623df3165c52fe17b05baf41e83e3c2f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712922662, "uuid": "673d7cb4-2c19-479f-97f1-9e3c8a79c1dc", "value": "T109B4E122E3A1F73ED6631E309D19FBE0A9ADBD1056741677234C2A2F2D7C3919627312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712922662, "uuid": "2fe1b8fd-dcc2-4aaf-8c41-914b71f7b510", "value": "821bd9fb95c98aaf3bf53dd773299622", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712922662, "uuid": "1f22b2b1-800d-4d8c-9fcd-60ab46fd3879", "value": "6144:6A3cjn7J56p3tLqhMVy6uFTcevF9+lpj+rKIHaNAFBzRDXMh7n5Ju5yonr:1cT7zQ9LkFQmK4KI6NABR8h7Ivr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712922662, "uuid": "1c21775b-da17-4a90-b87e-3917ff886ef1", "value": 502785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712922662, "uuid": "7e7a636f-5499-40f0-80b9-36f5da66a0a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712922662, "uuid": "de6ef219-101d-42cb-bfd9-751b094bfbac", "value": "d341fe6eebc36000af7ef50b1d48057d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }