{ "Event": { "published": true, "date": "2023-11-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-03", "timestamp": 1699056181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1645b885-450e-4f4c-9222-b31658526d3b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f1c5b7-7a34-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699007728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007728, "uuid": "37f1f3a1-6813-44b8-ae7d-72d6fa3d45a8", "comment": "Malware payload (Formbook)", "value": "e92d9d4622153a6556df4c2cef7a2999", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007728, "uuid": "2e0f12e5-1c08-4212-97a2-51318642fb7c", "comment": "Malware payload (Formbook)", "value": "00784d75ce7250e4634722b0db5ab6748aca2bf7fe0179e63e0ba5604917e455", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007728, "uuid": "be47de00-cdc6-4c1a-bada-852bfe3cae5b", "comment": "Malware payload (Formbook)", "value": "5bae8abd0e724b1ebf83f1e1c1a24817fa486c04", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007728, "uuid": "683a7487-a00e-42c8-880e-dcc46e3d352f", "comment": "Malware payload (Formbook)", "value": "2e641b100802f9d961752d866a7f999748a3dcc24563e49af059c49c69537822b77a8a515aa01c89cd646c185a085295", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007728, "uuid": "24b1c3b2-ab96-449b-ad91-6e4e3d44d73a", "value": "T156C4238404BBBD65BDE4383609A4B16B3B06B78C88609ECF7A373E9048D963107F75B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007728, "uuid": "9866fda6-ebe9-45c9-8cee-fef1bedeb10b", "value": "12288:IZ6OIe8V7cj4YOFflrn1cP/kwYVEgy1SQ5pMqZ4G:I8OQnYObn1W/kTG5nZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699007728, "uuid": "83d7a647-4a68-4e12-898d-a12193bf56c7", "value": 545591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699007728, "uuid": "5c77bd88-d801-44e1-8e92-09a62e81ce8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007728, "uuid": "e1c72831-5ab1-4cf0-bd93-d8e59c017e9d", "value": "RE.Documents Purchase Order products 23100290683pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd0c62b-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996843, "uuid": "3ef93583-fa54-4daf-9c46-ec9e90d3e107", "comment": "Malware payload (GuLoader)", "value": "e5386ec1666afd49b7a21d15b32c923e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996843, "uuid": "e083f928-fca0-462f-b927-e557d0d4e54f", "comment": "Malware payload (GuLoader)", "value": "00ca7e72a993d0d28c9e4fe737562bcddeff8717945f1636e60a229616b60897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996843, "uuid": "55eba2b3-f266-44f4-bc5a-356f1949d16a", "comment": "Malware payload (GuLoader)", "value": "b85b5e0c8a98d205cea61e7690fe6f8bcdf0d138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996843, "uuid": "4ec13388-83b4-4417-ac21-54972752c9c5", "comment": "Malware payload (GuLoader)", "value": "5751a45cfa7cabf17411af85f9ea2ef6a52f0ff5646d2bb6a5452cf0d3c205bc5f1ee68e9a614b3849acf4f27e7c5c43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996843, "uuid": "b8dac0b4-1add-4abf-ae98-d707dc2b98da", "value": "T1F5F412027230E42BC56A11738C67D2F8AFB7AC995CD6039B37687B2EAC73652784D345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996843, "uuid": "c54fcbf4-7174-4bb8-ac22-233d2fe920eb", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996843, "uuid": "9684130c-01b8-4ad6-84ea-7ff764a6ccc5", "value": "12288:M0f2JEhxz/aAjCy8S4JzZ2q0c0i/bW5/ojweXtTYVNPvwfj9HBrRYzzpT2:M0foEhxFjr4FZ2tVi/bWo9T2PoftxGV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996843, "uuid": "5920dbd6-ed96-45ac-bb80-6999337e0fc1", "value": 784977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996843, "uuid": "532ccef3-6cdc-46f0-9770-37e069ba8ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996843, "uuid": "45b7d673-6db3-45c2-93f4-021e59267f9f", "value": "Pensionisternes NA GOD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70220485-7a3c-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1699011049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011049, "uuid": "7ea1550c-1201-4ff5-9620-2a7a6d0d35dc", "comment": "Malware payload (GuLoader)", "value": "41448a906b89398fbe1ca21718e8feec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011049, "uuid": "ed08febc-8d75-47dc-bb62-ccd5e1546afe", "comment": "Malware payload (GuLoader)", "value": "00efaea983bd75aa20453d6a0807f5f41d8b117ec6fa7e28d8ca58dbd54a441c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011049, "uuid": "a0150ae9-687b-49bc-b9ee-f3cca5790341", "comment": "Malware payload (GuLoader)", "value": "1e6001a1aa53c381e371f61476472b52eb93de13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011049, "uuid": "52cdbb4e-180f-4133-adc9-7cc6a06e3b94", "comment": "Malware payload (GuLoader)", "value": "a82b5314da3732cde69b591c4824b2f266f351e3073813a117abde633e28de4f1ad583a2287fc8ffab0258c90d9ea272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011049, "uuid": "06a72520-bf24-491d-90d9-b6e6dc168216", "value": "T10B1501A3794490F9FB7486313866E461DB6E6F3AC9A9044E119BFE1B74F12335ACB40C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011049, "uuid": "6a8ff058-9999-4d14-a832-efa49ccbd687", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011049, "uuid": "85a2fda4-28bf-43a0-a9d8-c07b6a177ec0", "value": "24576:AfLFpRIiQCdmCNQPtgNnkRoIL0GTnRQNJlGtQ:6OZ32Q1gN0oIYGTeJlGtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699011049, "uuid": "8caecb57-7572-4339-9c3a-92dec9b2a3fa", "value": 883216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699011049, "uuid": "c827935a-43d3-478b-bc72-f0cb06bb18c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011049, "uuid": "af470037-a32d-4367-a9ba-55f7f1f31002", "value": "00efaea983bd75aa20453d6a0807f5f41d8b117ec6fa7e28d8ca58dbd54a441c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb6e357-7a20-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698998935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998935, "uuid": "40024d57-5c5d-4abf-b22c-3bcf7bf262a5", "comment": "Malware payload (AgentTesla)", "value": "3e00f6658bc36989fe775244acce3cd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998935, "uuid": "e0ef6d65-84df-4507-b72f-6dc18fad0eaf", "comment": "Malware payload (AgentTesla)", "value": "010a6fd82bd5d20ea77e63b238793079e5e16a8b59fad51c07ae5bfa69a003cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998935, "uuid": "e1db5b78-6c57-41c2-b8b0-a524c1a400a1", "comment": "Malware payload (AgentTesla)", "value": "13b9a4527b2a81a092004b129983a51925702be0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998935, "uuid": "8366ce9c-2273-48f1-871c-6401ccc4fc7d", "comment": "Malware payload (AgentTesla)", "value": "151fe8338ff3ef2a71539454764f4ccdd61920720e864a22df06d3749e8df96c482c3a2bbbccbc8be0c0bd6f5a3246cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998935, "uuid": "e230f0a4-7a57-4092-ae5d-f80dd94e2c0d", "value": "T1E7E4D018B2BA2B2BD87DD3F5051575404BB5A96FB5BEE20A5EC320CA12A5F104EC4F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998935, "uuid": "4399db52-1754-41ca-af67-afbec9c1d3df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998935, "uuid": "5acd4e8a-e43f-4dd0-a04f-936c8eb50993", "value": "12288:rreHdg/m6NaHpRR4bFBPK5m0zJI9uP5WQIDglBqNtB3Qh9L4gp2BukUXO4Io:rreHdg+YaDYFBPF0zUuP5WQoMqAygp28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998935, "uuid": "60766631-db6a-4b4f-a707-c50aed25724c", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998935, "uuid": "3c2728e7-864d-4ae7-9eea-765e39958aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998935, "uuid": "e1e01d49-b836-4ae0-8f16-9113c3128d83", "value": "3e00f6658bc36989fe775244acce3cd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e6110f-7a1f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998417, "uuid": "e1c0674d-be06-428d-977d-b3ae0ced4de8", "comment": "Malware payload (Formbook)", "value": "6981fc2102b4a2e0f959b202df182f8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998417, "uuid": "77e09a2d-fbb6-4350-823b-6932b11dcc2a", "comment": "Malware payload (Formbook)", "value": "024aa4a117fa7c5952577b1e904510e09c0e048a7bfaf320fcbdb4f309c41ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998417, "uuid": "6e137343-f3a2-418e-b931-e08d7b678234", "comment": "Malware payload (Formbook)", "value": "9d4ec84685c8fe4fdceaff7aaedd69aafef9b3ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998417, "uuid": "d5be64a5-e694-4a1e-9ab5-5ea24686e23c", "comment": "Malware payload (Formbook)", "value": "cf5919f5bdb83f5fc75b159624ec59ace0fc5e9d124ea8f12027fc643fa96340e0626186e68c6dfc9e451f9481aff352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998417, "uuid": "bde02bdc-235b-4424-87c6-6e65e679850b", "value": "T1C7C423CE26600F33CC77A3F62A4152C01BBE911E0936D5B80ED350DF9656F62DA69B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998417, "uuid": "08571ec5-e923-4dcb-940f-c6f82179a972", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998417, "uuid": "87641c7a-0b07-4dd2-8cc0-b88908f4aee6", "value": "12288:hIkqVKSUD29C8S0EoQiJDPDTcqAvMZrjZqJ+OG24MifHit6xn3o:hIkqVQR68iJDP8qHrjX+Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998417, "uuid": "aa5edff2-d269-4357-913a-2702be2ff1b2", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998417, "uuid": "f4c78137-3f8b-4794-bafc-923190326416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998417, "uuid": "da7e8fd7-3b43-46a8-83a3-bad85d0d85c4", "value": "6981fc2102b4a2e0f959b202df182f8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9924b224-7a3c-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1699011118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011118, "uuid": "11e69a22-ade3-4fcd-9cf5-9336485022e1", "comment": "Malware payload (GuLoader)", "value": "9e3644f16c8431e478e493824d24ffa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011118, "uuid": "ffd442b7-c644-44e6-84af-82ca220219d4", "comment": "Malware payload (GuLoader)", "value": "02b776c6eea950061204a9fa6124ebf191d6127dda2522c5e4e07d3b95dd07fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011118, "uuid": "0640810a-a2e1-4dfd-a582-877a2ff9b726", "comment": "Malware payload (GuLoader)", "value": "cfd3a18a37117eb251454d901f12b99bb5a03cea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011118, "uuid": "b8660ab2-6eef-4f1d-a396-e0568d376c44", "comment": "Malware payload (GuLoader)", "value": "0aed100c6c944bdb7803a21694e5e9ccd0d6b7c54db2aeefe82e565c1ae73a48131e08af8f0b75d78857d9d3a49cc082", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011118, "uuid": "1caa1413-7e0c-47ec-85a1-aa6a1e3a34a1", "value": "T1831501A3760590F9FB7486317C16E421EF6E6F3AC9A9144A218BFE1B74F06335AC640D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011118, "uuid": "e0ce2f73-e0ca-4bec-bb45-1e8269bc34e3", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011118, "uuid": "b4bf8013-471f-43d9-b8dc-12176ecf3d62", "value": "12288:afLFtD/gX1Bcd1Xl01lvjnaQHro8gTBNo5UYrdSZ+9jwGQSneIDQlq2IwJlGOgd:afLFpRl01lvrvLo9NX20GTnRQNJlGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699011118, "uuid": "20f2ea48-d8bf-4597-8140-1147c45f051d", "value": 877208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699011118, "uuid": "4a96fcee-272a-4b07-8c51-d45a7ed60b87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011118, "uuid": "d93ab5b2-a1f9-47af-85e3-2b381fb1f8a9", "value": "02b776c6eea950061204a9fa6124ebf191d6127dda2522c5e4e07d3b95dd07fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f15178-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981259, "uuid": "608e99a1-336d-4477-ac98-2123e08981ee", "comment": "Malware payload", "value": "b241663e4810a1d900eea82ae7823c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981259, "uuid": "08c96b67-293f-4894-8a38-31e030cbccf1", "comment": "Malware payload", "value": "030d50d06dcf43594a9cca9afa2a2422912a323fb016ce91c6bfe9e00c015ff9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981259, "uuid": "2c85bc3a-7fe6-47c7-91d5-6b01020ab51a", "comment": "Malware payload", "value": "34f77589efc053b13affe4ca707a34d6ec711d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981259, "uuid": "778db46b-538c-4604-99b3-00b9b5831ed0", "comment": "Malware payload", "value": "52a3b03b07ac01483cf13325ee4758ee6164157602a6d89b5be3b106e126f44e8329f8b1105d8ecec39358bc4f9ece93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981259, "uuid": "24c81587-7a72-469c-9736-4c11a1f3efd7", "value": "T1C9F27E8B473D1472EA86CD30569686368D35B190BF65958B02B2DDCD6C63FE02B3524F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981259, "uuid": "ed0c0e7c-fd8e-4c0a-9c14-1bb16cd0cedd", "value": "805f14a5c1a242f58e5b7592e510e705", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981259, "uuid": "5a22e9fb-926e-4906-9515-9a71f966e4de", "value": "384:ujC1j7DbJpJgLa0MpFAi1IWd0GFc1lgHnndpkEYPLxBJeeM2hw:0mgLa1fvIm+lgHnIEwlhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981259, "uuid": "73663a2f-bdb5-4c16-832e-cfc6d03964c1", "value": 36392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981259, "uuid": "a86c945c-94dd-4725-af97-ff39dab4d35e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981259, "uuid": "4eaa5f65-3080-4180-a1ea-638cb0864119", "value": "SecuriteInfo.com.Trojan.MulDrop5.44865.21440.27761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2678d01c-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981290, "uuid": "9988f90a-86a3-4e5c-a03f-659ebb34c1ce", "comment": "Malware payload", "value": "900e575fcb8fe07d3edc318cd35d3776", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981290, "uuid": "ea0bcbf2-1289-45e8-aa85-18be8c4a4d03", "comment": "Malware payload", "value": "041f86a64abb58d4ae866ac429fbf13ec569e4fb0790755276c9d3bf46a53201", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981290, "uuid": "608b9cd3-9905-4d99-8fe4-756cccff310b", "comment": "Malware payload", "value": "ad5bbe19408c54418950a37d49632036ae03d87f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981290, "uuid": "a27ae117-2e29-4d21-8563-f0fb243b9d24", "comment": "Malware payload", "value": "71b2381f0dd74da2bded59bc62767eebc4036d46cff4667fc9850a9687df0e2f0c8ae2549afdef23aaa655ad3a06658e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981290, "uuid": "bd9e27f9-8255-4651-af72-b621ae8be336", "value": "T1CBB54A22FF80D80BD0B725759C678EC8A92AFB582D14A44B39E86F5CBF747813D32516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981290, "uuid": "2664def4-5dfa-47e3-8ddd-67e23f21c7df", "value": "49152:5xJZQvwWYTfY7gXlTffyW0fr6MTJqvyWSzXZ:5FQvwWYrYcXRfKj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981290, "uuid": "fe95d0aa-6edc-447c-b3ab-b31bba4b04cd", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981290, "uuid": "92c7f6dc-4fc8-48eb-af19-ca5b9123182d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981290, "uuid": "5c37b2b2-2ad7-4d54-a1aa-5109fd36543b", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.29747.29338", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab11721-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699028220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028220, "uuid": "637ca428-bbfb-40e0-b0d0-ec31b889c528", "comment": "Malware payload", "value": "39d13d4843b015f76da22fd7182da99d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028220, "uuid": "4f3e9453-c30b-41cb-b060-08ace0035306", "comment": "Malware payload", "value": "043f5ac15a748244f751ed648296b93f8a1307b17800f5766688aecae3967737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028220, "uuid": "6558da8a-655a-442d-a5d0-6af6f14c7abe", "comment": "Malware payload", "value": "ddf5f22999a72c697bf4a5d77d0345ca416794b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028220, "uuid": "971db1fe-fc6a-46f5-9cbe-1e4ce0967cad", "comment": "Malware payload", "value": "6073fa006145526815eb85d1a67c6ebf22973acb6f7754142206a4ae3e7b3f1c354f31b42a110c916cb776fc1627c4c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028220, "uuid": "a1aa713d-f0f6-4483-80b2-2ac9c1b13c28", "value": "T182A3F713EE943022F16385702936A65A7A357D751890AD0FB783EE483E70AC3A5F671F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028220, "uuid": "e67a4e35-f973-4626-a97d-99d681f4ac05", "value": "4e123ff51d799626dcd9653873a6e69d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028220, "uuid": "d93ad675-d87d-4896-afbc-e967bb0c6441", "value": "1536:B2MpAvCdoc99szg1hnu+BNXR0dRrPF6XVko4Af+y9f:MMpAvCdobg1hnu+BNX6Wt11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028220, "uuid": "69ff9906-660d-41b4-815b-e174cd53fd72", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028220, "uuid": "db576552-e436-4ae8-830c-a0f11c172f09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028220, "uuid": "c7bc48c3-0b28-4a19-af89-09aae22752ff", "value": "39d13d4843b015f76da22fd7182da99d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfba282a-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698998324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998324, "uuid": "fe6f6abc-9da0-4dad-a0ae-570a9017048e", "comment": "Malware payload (AgentTesla)", "value": "4ecc5878b5104eccd96ad00d5875777b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998324, "uuid": "5c064089-4671-4eeb-a6b1-9ceaba094c7b", "comment": "Malware payload (AgentTesla)", "value": "04945afe8de16a97558d4d2f29968e344057ec1bfdb4cb956bda13af1d42b158", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998324, "uuid": "e0711bbd-a961-4625-9561-08070bd51163", "comment": "Malware payload (AgentTesla)", "value": "fe6c78640ed03e60c2470204f852d9df0b5bc378", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998324, "uuid": "f82d551d-43f6-401a-9da6-1fa0ef622395", "comment": "Malware payload (AgentTesla)", "value": "f514c380ed905d29c2f1e370c8aaab62f83e0b1343f3d26ff8a54360a1451a277413943cf2d4115fcee6884c0424d09d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998324, "uuid": "6ae5661f-5c06-4c53-9673-9daa17d7662a", "value": "T1D1E48C9D7671FEAFC957C8378A543C20AE2C6CA64317F607A01731A99E7C997CE041E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998324, "uuid": "3a05226c-e4eb-4a10-b688-e583d11ea167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998324, "uuid": "03838c55-3206-4b63-9cff-e9fee707a822", "value": "12288:djTYVYACbc5VfJTucPDL9gERTTW6CFa2VzhnDYNps16ive:djUJzxucnSERWfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998324, "uuid": "122ddc82-5d42-440b-a3f0-fa96ee29d39f", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998324, "uuid": "ab09372c-15df-4e8a-a3d9-5bb984adb83a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998324, "uuid": "29c059b2-2009-4d70-9ae4-19725761aa18", "value": "Invoice 05-69400 with Po.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c17aac1-7aa3-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1699055119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055119, "uuid": "1b5f7976-5962-4797-bfb4-2ece8b7c4991", "comment": "Malware payload (LummaStealer)", "value": "9fb58bc9c06ef2e5ba1361a4fe1a4ea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055119, "uuid": "6d9621db-36d3-4a2f-8c33-6644ecec2f23", "comment": "Malware payload (LummaStealer)", "value": "050506129490bf4fc71dfedbf612532a669ea9b02f2d6b8311428601e915763e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055119, "uuid": "34a99d5b-52d9-47cc-a868-e5fc04293e04", "comment": "Malware payload (LummaStealer)", "value": "19fb8389c2ac3282ee9ca0ac637b6c259cbb6e1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055119, "uuid": "02be8f88-65ba-46da-bb9e-6c8b7b1bafd0", "comment": "Malware payload (LummaStealer)", "value": "459eb7f0baf4e0a8938396625500c4b52f60709a76d3c677512437c2add462d98412b919749da76d84073d8b8dad2342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055119, "uuid": "205ebd97-be5f-4484-8009-12ebd5c8a6d0", "value": "T1D526CF05FB60CE22D5191B37DAD2201903F3D48B9352F70B3A947AAA1E533EF4D4E59A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055119, "uuid": "9303435a-2a53-4f95-90e7-3739f021fc17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055119, "uuid": "2a84f515-3cca-4f91-8c39-cd1903f1906e", "value": "49152:t8VBiuJD8jK2N5YtUYoBT6Bcenz3QpI1qzEGZJ0G2jsqEA6F63TaHNdolLi7D:t8VfgKoZVCE8qzE8JP2AbBYDQNdwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055119, "uuid": "a8a89a02-a96f-49cb-9826-cb1b8fd40b31", "value": 4504392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055119, "uuid": "a3cce6b6-f304-44d9-9543-7335ad1f5d7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055119, "uuid": "4942be70-7d8e-4d2d-bbb2-72928080247f", "value": "9FB58BC9C06EF2E5BA1361A4FE1A4EA0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b973b53f-7a26-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699001723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001723, "uuid": "77e1d263-9be9-4f6f-b957-318692bae70a", "comment": "Malware payload", "value": "fae5afa46a089c073c3f9e5719711479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001723, "uuid": "d39f2239-02e3-4a35-9c45-53884c9321da", "comment": "Malware payload", "value": "061554b4df4eea3f0b7882ab554d8a28722be850ff7c1e1eeb3762021be3c501", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001723, "uuid": "da50eed9-efc2-45da-9425-a9b53f3727ab", "comment": "Malware payload", "value": "aa9cec0a912e15275d56047faad25fb3c3579a39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001723, "uuid": "fefbdb8f-3979-4278-b61b-cd5e2b7f7a22", "comment": "Malware payload", "value": "196b5af8dc1f8adb1755670c2462cc2f41836f60e67776e45b879d25f212da571a3b532f77b5563ce53f578f350c67e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001723, "uuid": "b468d7c8-0ce2-45b0-a6e1-047b4fe0c644", "value": "T125C46B76BBF19D84DD5D33B3C8406BE5065A437606F3E3885D286A526B3F6668B0B03C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001723, "uuid": "ff37f420-cda1-4ca2-b90d-b85fc0516037", "value": "03f91bdad97904026326fc3ace33b897", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001723, "uuid": "ea61718c-2ce8-4d8e-9dab-83b592f4b301", "value": "6144:qTNlPsSiE0grIlHAjNL7SuAtKZnbr8qz6xzS06d17GQxAAXcpGZ5wIzkyOD+lRX9:qFR0gsAjNLItQbr8w6xely1JcXgDsLmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699001723, "uuid": "df761867-bf7c-47ff-ac3e-57a5de0cd088", "value": 574384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699001723, "uuid": "58e3456e-ab12-4513-a475-c7faf300ad24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001723, "uuid": "c286b571-0afe-4455-a2f9-89cf0a1fb2eb", "value": "bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbc0c4d-7a52-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699020417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020417, "uuid": "c4f61f9f-c0e0-4f45-9b77-909cb96aa20d", "comment": "Malware payload (IRATA)", "value": "545b422bb86729f2883b9439a33d5f50", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020417, "uuid": "5907728a-42be-4023-a761-4a14acc05df0", "comment": "Malware payload (IRATA)", "value": "069075e397bdac0dd0248bb3f9effaeaa52dc97e93545be94c07a5a0e711dee2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020417, "uuid": "b0124f1e-44c1-4cc1-8ca7-5bd98d4045fa", "comment": "Malware payload (IRATA)", "value": "747d113aa6551db119c4f30a23c2ed75068dd838", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020417, "uuid": "4d79aadc-ba59-452f-a3d8-846eaab11b30", "comment": "Malware payload (IRATA)", "value": "a2a6b26040e1809890db19f6b61f2baf9edac5ebc31ca096449c7071eb9abae624c8437c98dc8da16697821b6eedac66", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020417, "uuid": "1670c907-d446-40de-9fab-d07ec8778751", "value": "T102E5330EBED5F216D0A7D4335A3042E2275419F92F06F943A202A3987BEBDD1A355FB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020417, "uuid": "203f139f-0ad5-4c92-8bd3-1155bbf2c15f", "value": "98304:znRNNvN8X2ziLF+l6mUHD2bd0djaKEARSE:znRNNV8G2LF+YmUHDG8nEAR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699020417, "uuid": "e09f7505-d733-417d-a545-9dacf7461d2b", "value": 3310129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699020417, "uuid": "73fd9ad5-2c01-4a1c-a495-f459754fe2a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020417, "uuid": "1b22d7eb-ac3c-4f68-9eb1-d7aadd8d6e17", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16093c9-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998300, "uuid": "55dd5db9-cf54-42d0-a48d-b6746e11422a", "comment": "Malware payload", "value": "797bd7a9e2c363e6107b006ea65317b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998300, "uuid": "28b3ec03-d4b3-4355-a327-a840917fbb67", "comment": "Malware payload", "value": "0759be64a71e9d50c0fc4a61e5c848093038096b915c4999e16325ae3d914243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998300, "uuid": "7d703f69-8aad-4f65-b96a-832fc059a901", "comment": "Malware payload", "value": "5d8d701a7c3202168e092df6e9a326365392e05e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998300, "uuid": "9580ea56-5fce-473c-878b-46ed9e45f9fd", "comment": "Malware payload", "value": "e7d5a5804d591274389e20a07108eec0bdd930040264fad4ac46c02083c04bb0bf324b45315651fea66bf438077d8393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998300, "uuid": "bf369725-e928-4ca4-b59d-2dce9d7c9a18", "value": "T120046552EBBAEE31CA34453F828573295F3E5ED141F2BD8E754CB1602EBAE40C5806D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998300, "uuid": "3fff0232-64f4-40d7-a7aa-1f565191fe0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998300, "uuid": "64163553-0812-479b-8c26-386c83445d50", "value": "768:N1gKTlTfLhMR6ES0JXtZhVm13j2tSHPWcSaY3:N11TlTLhM7S2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998300, "uuid": "cfe8c3ef-c748-4524-aee1-850de0200256", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998300, "uuid": "7217c959-6237-42d1-adac-951abb9dc453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998300, "uuid": "636d057a-d1a6-4776-bf86-88f14a542fa3", "value": "0987635367-3093876536738939837653678-30983767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168f7316-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698996725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996725, "uuid": "528228a5-7f42-4048-9cbc-60539e8880db", "comment": "Malware payload (RemcosRAT)", "value": "3fb7facd9d0019b6147f4373ad45c74f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996725, "uuid": "75122aeb-8344-45cc-9d19-7e067eacaa73", "comment": "Malware payload (RemcosRAT)", "value": "076cb0d213ac586409e68e769c729b08528817b9adc44fd8ca9675dee201a791", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996725, "uuid": "e905494e-3c9c-498f-a828-487b68739a78", "comment": "Malware payload (RemcosRAT)", "value": "fa603107dc479170049a81e4aa5951b5749ffe88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996725, "uuid": "b71615aa-2fb0-4f7e-85ac-0354970348ec", "comment": "Malware payload (RemcosRAT)", "value": "ac67a96f323941fce1ddcd697d209c5f9888420be4499e7105ea9409ff72febf202defdd4cf3417625440882a4143030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996725, "uuid": "1306005e-e364-4916-86c7-51901a0b6785", "value": "T122C5F1D093C84C72E06B3678FC9676D135A4B9F1AC0B68CA859C6D860EB5B787D3244F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996725, "uuid": "18bec575-f6d7-4de7-a5e0-9ae3ad1d9893", "value": "833a48f3eed13b70c2227728181305d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996725, "uuid": "79bcdaa9-a266-4c20-a658-55201ea439d7", "value": "49152:Udbe6JPqJvGkpy2glNjQyewXk/gCl2yu:UdbnkA2gnrewXl2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996725, "uuid": "d5ea2571-aee6-48b9-b5c3-53e588aa94a4", "value": 2569216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996725, "uuid": "92f39a0d-8123-4e9e-9c6a-b40f08f6f04a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996725, "uuid": "9b72c265-78b4-44dd-9df2-a4548566ce2a", "value": "Bitqqwkbmjrccj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056fedef-7a54-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699021178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699021178, "uuid": "e9c4af3b-e196-4d9f-822b-fb8ae25ce7a4", "comment": "Malware payload", "value": "b9c5f246d94d7458195732895e432a63", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699021178, "uuid": "96a7550a-f34a-4fb2-8e11-5f6b529c17da", "comment": "Malware payload", "value": "07785706261a4a907a5da93fc3b2734030217cca849a9bffa33a9bababa346a5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699021178, "uuid": "3c9c5c1e-9f8a-4254-8ec1-c49d0530adc1", "comment": "Malware payload", "value": "5bb202add00771388f2e7a3db27841d8baf0f131", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699021178, "uuid": "df0b21d5-ef3e-4d75-a309-7462adaa0bad", "comment": "Malware payload", "value": "7ff4a3c55dd6bfcb081ee2b3526786d898bd8888818532faf681a843cfb8acb6a00d572f57b9eb891b0a08ba16623e89", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699021178, "uuid": "f508d4ac-e22c-4051-9734-bdf27316514b", "value": "T13DF2CF278304E7C3F92A41F48D072D75FFEA2B1CA0C6A5AF01D6949BAE4077616DE41C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699021178, "uuid": "d1de1034-fd8c-4979-9bcf-002738afe1e0", "value": "768:/zJx1tzQG34dqgE1/DXcwUc1RoUPVRvU7gjJxzdYdktEoLfv06:Fx1tzg5E1ARc1RoSVRMijRYdktzLfv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699021178, "uuid": "1bf1acd3-4b9d-410b-bb40-dfd0dbd841a4", "value": 35286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699021178, "uuid": "bbe07fda-4a2a-48cf-bda5-0572391c6e36", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699021178, "uuid": "e9f129d2-a360-4ef2-b010-4c7eaa064ce0", "value": "Account-On-Hold-Document.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cf1299-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (OskiStealer)", "timestamp": 1699032916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032916, "uuid": "d66f1502-add6-440f-8585-6ad43c0c1494", "comment": "Malware payload (OskiStealer)", "value": "95c729597254d7d13131a1d787ee8672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032916, "uuid": "9eb17c3e-4f35-4290-97e6-6d557ae750e1", "comment": "Malware payload (OskiStealer)", "value": "078e034c9471d383cda140f060f9ff26960d0674cfc9d0c05d0c704dbe5cf9ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032916, "uuid": "03644d9c-2f62-4fdd-b721-459318bda5c1", "comment": "Malware payload (OskiStealer)", "value": "d44dd5beba366c2dd917ca0ed0ba5ff109d765c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032916, "uuid": "6aa19537-3694-4b77-89d1-1b5896cf2000", "comment": "Malware payload (OskiStealer)", "value": "d8b3b0460f789c1b639ed9eeabc710c641e80216c42b19529dba97efd02c9ebfb29c5d0f7108c016665b13e588771120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032916, "uuid": "5e863738-b161-4ed1-a1a8-e5c10c6ffbee", "value": "T1A2146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032916, "uuid": "a678b7f2-980c-4d6c-84ef-8a26fc8654d1", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032916, "uuid": "8a52596d-21e6-436b-b7f5-24f95790f592", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIF1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pN01Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032916, "uuid": "2f48beef-44b8-404e-951e-93d28d7254ef", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032916, "uuid": "6fc0b5d3-82c1-4fe1-bab2-eca47abc8b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032916, "uuid": "4218ec96-9370-4565-91e3-2b49c8c4fb87", "value": "95C729597254D7D13131A1D787EE8672.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c73f8e6-7a18-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698995581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995581, "uuid": "1cc9bda4-d9ad-4c82-8218-228769f5c5d8", "comment": "Malware payload (AgentTesla)", "value": "41820e80c9e72dcc77fef41d6c14b93a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995581, "uuid": "2e3078d8-c2fd-4094-94ee-9c149ff44293", "comment": "Malware payload (AgentTesla)", "value": "078fbf08ad3905c653a9cddeb1df7ca56dd1f5dd15cb9d0b0c48f5149fc90a40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995581, "uuid": "9c17e408-39f9-4b43-a420-5c917ca545f1", "comment": "Malware payload (AgentTesla)", "value": "c9b2f58856ca7d676ac3cf16dba52b87d9219ba9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995581, "uuid": "ee017bf8-804c-4ff0-a448-4f9547a2ffc2", "comment": "Malware payload (AgentTesla)", "value": "ca06b76345e2b85b9ead9d6ed5d4b4cd6db0f55aca53bf07743d148ffafaae3375c4869eabb519ea6c1719dc7a486d56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995581, "uuid": "2b195e7b-53cc-456d-aba3-e2c6122deb8f", "value": "T13BD4339BF5FB0993580B15F914B62B986FC683CEA763E8190A51221C52E14FCC5E4FE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995581, "uuid": "e723e2a8-0626-4e2d-b71c-9478b77f6e88", "value": "12288:/TVa8XQ/dgtwFRYH3lJZufk1kyl3bs2gdTKU++chjCynar7jns+5Q/v:/TM0Yu0YH3lpP3wrTb++gj47rFS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698995581, "uuid": "a93df6e9-aa84-4954-93f1-1f794694f7cf", "value": 600476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698995581, "uuid": "a272e278-1345-4cb0-85e0-d666ab7f7ffd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995581, "uuid": "e55e1301-429a-435d-8497-ea618bfd19d9", "value": "PO 2300982.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59d7e5f-7a59-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1699023701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023701, "uuid": "ec7b20d6-af7a-4abd-a221-d8266ac1eeeb", "comment": "Malware payload (RemcosRAT)", "value": "d5ea9030c78ee04887d07e264ef68323", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023701, "uuid": "e5f8a31e-c5fe-4865-a205-0f069efa1aa1", "comment": "Malware payload (RemcosRAT)", "value": "081c647554fa3bf28340de0aa9b61b2720677fb7c425b611e5ba0271dba929a9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023701, "uuid": "be847337-b6f4-42e3-a648-f8ace9962caf", "comment": "Malware payload (RemcosRAT)", "value": "3d77a8dc5294a5c067de946f2c5dcf23be62da4e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023701, "uuid": "9e861332-353c-433d-a7fe-bc6f2db8370f", "comment": "Malware payload (RemcosRAT)", "value": "dc865474174e2935623fcc106f49879a71bfd32e0f855847e01e309850903ff3ac59f927d23c6437290ccaa5a95c3ded", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023701, "uuid": "931b84d8-17d1-4da1-ae50-5b8d4657356b", "value": "T11D063396C93CD7BCF67C7069EAD4B94E758602DE2E8B2274503CC7E3552E1CA2E47482", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023701, "uuid": "e8a7e740-bfb2-4522-b051-aaef1ec73184", "value": "49152:/MuNlV71PmPNtHX/1Qt1h5N4/Ec0oEulzyktF9hZ+uuA8TDMlJvlk4UuKE+3z88i:/ZNVPmPN8jXc0n6yktThkHvMnVUuk3wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699023701, "uuid": "93b36ed1-19c0-4647-9aa1-c41119f96019", "value": 3683165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699023701, "uuid": "486922dd-0740-4021-b547-01649b717648", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023701, "uuid": "1592e358-de76-4c6f-b747-96681dc1ebc2", "value": "OverdriveNTool 0.2.9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780e029d-7a46-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699015357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015357, "uuid": "94d10f99-d27f-4f62-8359-7531f694560e", "comment": "Malware payload (Formbook)", "value": "bd3acc949cb577b1cd1fb4261b82f856", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015357, "uuid": "c3e16db2-5091-434e-b0f2-85bc185d100a", "comment": "Malware payload (Formbook)", "value": "09685a4b3b87ca9567a4f85ad4b050edd4054106ee9e9f6d939c6ae0e6ba8f14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015357, "uuid": "f2e7af5b-e7b0-45bb-b22e-d819f0b64a10", "comment": "Malware payload (Formbook)", "value": "0df10f5f99102beaa309f50011cead10a06ce6ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015357, "uuid": "0a9e28ff-42cd-4939-a436-24091a502f08", "comment": "Malware payload (Formbook)", "value": "f5025ebd6860ecd31c2824e50b9959b15ddd83ca8038bdf14735e699b79988731231d21f53ce81076c216da1496c644d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015357, "uuid": "88774f3f-f171-4698-87bf-d1d960822035", "value": "T139E412003BA8AB61C53C63FA54C590545BB79B3A47A3D74D1DD2F1D626A0B2CCE60F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015357, "uuid": "4f01e980-7e26-4da9-a222-4773e9704a78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015357, "uuid": "85d4e3b9-555e-415b-aaf4-34843f34da64", "value": "12288:hMSWMZgR/mZRM+Bt2ikZ1xR8D/rBWzHvSdMv0o7NgFY8w+PZcF+cty/Hu:LgkZR5pkgD/rBWzHvMMv0oKGH+Pz/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699015357, "uuid": "970cd600-07e7-4626-8ea2-9a3cfc5acc00", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699015357, "uuid": "f98d24ca-b6ec-4781-8b32-e610eaf139c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015357, "uuid": "43c43fb3-7d53-4f12-9f5c-6dcba1353c06", "value": "09685a4b3b87ca9567a4f85ad4b050edd4054106ee9e9f6d939c6ae0e6ba8f14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8ab978-7a6b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699031204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699031204, "uuid": "83f69f06-49bd-46a3-8293-07b3502b0f00", "comment": "Malware payload", "value": "0ebc5ceb432d636c8b745864dff8571e", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699031204, "uuid": "9e8a9195-da03-4fb9-99c1-1529db5e06dc", "comment": "Malware payload", "value": "0a83cfb368674976d0905d4d3b470959d3ae45383ebe48d5d0e6bb7037b36442", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699031204, "uuid": "66a56061-dca4-4f6f-ad2e-a3706b6c861f", "comment": "Malware payload", "value": "0e5c5a622eface2776cd0cd4375ed6c7652c0a5c", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699031204, "uuid": "031af3d7-13f2-4311-9dcf-6b5d1b539d34", "comment": "Malware payload", "value": "ea3ad9728b22528cf932b2e2c79997889e3839cf6bdf48e19e65cda37ea939296fd86215d57afddf19ae148a4cdfbc04", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699031204, "uuid": "27fa1d8a-adb5-40a6-817c-aff96044e442", "value": "T12A2401983435C450DD9BA5B11B5C3FC3A5CBC1F218D62023E076AA9F367EC23B4A15EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699031204, "uuid": "dd04be04-0907-44e1-8523-efb585f8d068", "value": "6144:iai3/or3B8vmAii7rmHww2ArEJmR7uPdRSAJF/f8:iai3Ar3KnrmQw2A4OAdRPF/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699031204, "uuid": "2c9a2b86-1aa0-444e-b43f-be313e3a77b8", "value": 212516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699031204, "uuid": "1e5d7589-3f5f-4712-b197-c5d9a6ab237d", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699031204, "uuid": "62083846-0ddd-434a-85e1-948b1127558b", "value": "claim-11-2-696AOA208-23.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f488f64-7a40-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699012846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012846, "uuid": "b108f019-e443-44ae-ad40-1988caa81050", "comment": "Malware payload (IRATA)", "value": "955f5a934e0538c3e14d5ae8b76395fe", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012846, "uuid": "bda88b63-760a-469f-923e-3b8b03a55410", "comment": "Malware payload (IRATA)", "value": "0b5659024bf0870609d813bc4f591907f8633810d8e4c028f0875f151cafb18e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012846, "uuid": "182ae233-8a6c-4e80-a1d7-c119d7df0e89", "comment": "Malware payload (IRATA)", "value": "7e4b61f2a2f8d7d8e674b8254560039382593b47", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012846, "uuid": "448548c0-50cc-4886-a3fb-d4a542576fcb", "comment": "Malware payload (IRATA)", "value": "afb71c7b0081349949a8adb9a649c645567bfbea49a839ef4828b4372f8518b4473c06325bb6687d39fad9d772f67bcb", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012846, "uuid": "e2132aa6-836d-46a3-af05-64634acdf4b4", "value": "T1A0D52353F366649BCCF6C37622742639547B4D68DB43B289295873FD24BF8E84B806C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012846, "uuid": "c50140c5-388f-4a49-8ebf-c8205751eb73", "value": "49152:LaTWD0xSIqZFfqctj2CHGOJcnJuPHqlXc5PtmXnxV0ZlXvhXCwXqw+9k+AogunxA:uE0FqZFfqc1dZ+nEPKloPkXxqZrXtawJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699012846, "uuid": "4a03b68c-f819-4ba5-b12a-da98b131e8f9", "value": 2826370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699012846, "uuid": "6570fc54-d2da-4824-9179-ed8a1835e81a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012846, "uuid": "b825fc3f-219c-4bba-a218-8f41a77c4000", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0620e1-7a46-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699015498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015498, "uuid": "c3931dff-7f0e-4923-af14-4e641986d39c", "comment": "Malware payload (IRATA)", "value": "cff015ab167cbabd897009ea3be260d7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015498, "uuid": "a6cd43f1-ce0d-4beb-9050-3eb04a74d2c4", "comment": "Malware payload (IRATA)", "value": "0bf42fd682467ba0d0ba3f8db9e55263b9b70bdbcc8580b9899ce4f70bacb4ac", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015498, "uuid": "1a7b721c-8846-436d-85cb-c53148c53dcf", "comment": "Malware payload (IRATA)", "value": "e68fe5815aedf1448cd92613e86a26036539572c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015498, "uuid": "a3d4b78c-78b7-48f3-afc3-e187fee4c4c1", "comment": "Malware payload (IRATA)", "value": "e3a49096f5cf41fe0886d31f22d095945939a6ea48cc16a0a16ac0ae1be28a7b9c8625cb33642b6ce7e9ec6b3312f933", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015498, "uuid": "0d20ae35-ee49-4946-b94e-f97b34b0d5c5", "value": "T1E3C52397F637E86BC831C13232452739501A1E4AD646FB8A365877EA34FBEEC47852D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015498, "uuid": "b0dc065c-f791-42ed-a5d5-2cdc910a3376", "value": "49152:HLFOp/cBT2DN3cycC7mhVlvZXukxOQgpWk9L53yJdT9cOuKo2qwUVmyt:rQp/cBT2B3pcC7mRmdzL5CJdTWr82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699015498, "uuid": "6edf1894-82f3-4767-826b-8f1d5e40fd8c", "value": 2740415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699015498, "uuid": "1f0466fa-188d-41e6-869f-58d2ca44e08d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015498, "uuid": "8df01546-3944-4ba4-8c16-c54933fb81aa", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527ab100-7a4d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699018300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699018300, "uuid": "5b2ab9bf-d94a-41eb-81c7-d65a02263b77", "comment": "Malware payload", "value": "f5f16eeed6eee9590c6d8dfc2e75b4bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699018300, "uuid": "16c3fe62-c526-463f-8d25-c886bf671c53", "comment": "Malware payload", "value": "0bfaf17eca96254ee40cd586b9741b4af344b7452e368db56dfaa44601eb8d1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699018300, "uuid": "c8fb7ed6-4cdc-495b-a8f0-5cdec1008a4d", "comment": "Malware payload", "value": "e0f1175ecb442acc5cb064da164c09a9a0d18928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699018300, "uuid": "92225eff-a9ff-4632-afca-fa4806aece00", "comment": "Malware payload", "value": "da66162c5e0c968cc9fde3d3a63c9fe8fc5a87722409574c938773ca15d7aaeeb1f35755781a67e90671a9d2719b8cfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699018300, "uuid": "67277d3a-8407-4bd7-a363-3dbc28fc7e34", "value": "T1A7B48C07BA9789B3C2886736C5D7211447B7D581B7BBD70A778E33DA280B7BA8C0514B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699018300, "uuid": "81bffa9c-32ac-47cc-a83f-361efe6a76c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699018300, "uuid": "aa1568e2-0cb6-412d-8e60-a76a14543b2c", "value": "12288:orTA9qzGVSha8tmTGZv8F2ePxLhiQcVdTZZBDG:f9cGMhPtmc0F2KxLkTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699018300, "uuid": "47cef3fb-bd22-48ea-b84f-f7711c2569f4", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699018300, "uuid": "adfb66c1-755f-4dbd-9717-1b1aefbf6fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699018300, "uuid": "626be249-35cb-4987-8811-6656b6f22b63", "value": "Swift_copy_MT103.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33fa17b-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699055024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055024, "uuid": "84e46802-92ec-492b-a929-3a13d0968b53", "comment": "Malware payload (Mirai)", "value": "71d5e4c8e8e6e5e88122ba50ee07a029", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055024, "uuid": "d78df8d4-54e1-40fc-b55a-83840890ec05", "comment": "Malware payload (Mirai)", "value": "0c7f66c1a1e12135b465790fcc7444884d91c222b7881cf3c9a95b0a09cca333", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055024, "uuid": "6b17fc83-1abe-40a0-a0d1-ff8d9cd90d4e", "comment": "Malware payload (Mirai)", "value": "eb2bd4eb8784b44ffebeb868392c30a317681a03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055024, "uuid": "90e8f1a5-0cef-4ab9-9e23-6737c8fb4742", "comment": "Malware payload (Mirai)", "value": "ba7e836f186ed78acbc824a3867679fde755eff162819ae33ce77c163fcdd5bbc781e5ef567dddd61ecf7d7966af7f8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055024, "uuid": "1f4242ac-cbd7-4aa1-8a68-9ce603e24e5a", "value": "T140933982BD40E926DBD01277FE6F108D332567E9E1DA3242CD255FA0368E90F0D6BB56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055024, "uuid": "1467939e-3072-465a-a048-400972fe5242", "value": "1536:DGaDGhBFkbqXK1RY9kT71hfdPkZYmArPcUZj8qz8t46Olebdua10dW:DGQ+vkWXC7jSoc+Iqz84VlgbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055024, "uuid": "0c384cc7-e52b-40da-9d9a-1b6bb6b2e6f2", "value": 91896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055024, "uuid": "0784e930-ff94-4777-9128-b9b0034db124", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055024, "uuid": "d2a67868-a5a3-4dec-a14a-8f555a4312ba", "value": "71d5e4c8e8e6e5e88122ba50ee07a029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591da0ac-7a83-11ee-8907-42010a9c0042", "comment": "Malware payload (Glupteba)", "timestamp": 1699041504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699041504, "uuid": "0c8501c5-890f-4ea7-a724-d1f538b05610", "comment": "Malware payload (Glupteba)", "value": "0c444889df7f7cb046f7624fba8bb066", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699041504, "uuid": "ec537543-024b-4788-b7bf-af4b3ee983eb", "comment": "Malware payload (Glupteba)", "value": "0e11a6be0205a2a9ffbe57ac11c8057c2d72fbd794c6303f445c3ddfc2fa6c97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699041504, "uuid": "196a0535-6218-49da-88a8-9cf31d4a168f", "comment": "Malware payload (Glupteba)", "value": "ab4780e4f2585c1f194234c2e8176eb235f96b46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699041504, "uuid": "733a675c-9183-4036-8f54-7fec994e9cf4", "comment": "Malware payload (Glupteba)", "value": "b7b79bfb076e85c2c4896b0d00c579b48d7485261dc984e9f9ed9dc19847bdc97e559f035f63fa8b8eb54a796febe22f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699041504, "uuid": "f1a9be38-a9d7-4b92-ae7d-e1f5f31eb2a0", "value": "T16A16332226D07C34F7259F325EEACBACF65CF5A08F14B79A1646581F09341F2C672E62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699041504, "uuid": "235a3273-58eb-4c5e-8722-5915f948f9ba", "value": "ce8b02cf0e0e47bfce02667d7460664f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699041504, "uuid": "e28d4375-446f-4435-97d1-04fa6a91133d", "value": "98304:LnOS1b6MajnaPzdpXcALUpDUQxYLmsaiP3vxHXczMFkGfkN0Sa2YzgHh6V:LOS1b6AbdpXJeEnaiPvWzC+yZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699041504, "uuid": "3793036a-c3ea-4911-a766-cffc3fcf0350", "value": 4344208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699041504, "uuid": "6787dc28-aed4-47f7-ba34-3734ef567228", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699041504, "uuid": "99700dde-c82d-4a46-9b26-919e95677ecb", "value": "0c444889df7f7cb046f7624fba8bb066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd35fa1-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699028201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028201, "uuid": "ca2ea2cd-0c38-4123-96a3-678b29f655f3", "comment": "Malware payload (AgentTesla)", "value": "ca08bea909227d337c5834852521faf5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028201, "uuid": "a2281c1a-4d42-4314-b080-42df74f0271e", "comment": "Malware payload (AgentTesla)", "value": "0e46c07c9956d2f864ea3caa1c85697892a14ad837882de38e3705b34c14bae0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028201, "uuid": "08d7afa1-d21f-4c0d-ac4f-960b82d0836e", "comment": "Malware payload (AgentTesla)", "value": "8c13cd3d6de8f2d86a00149f578400dd96126857", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028201, "uuid": "6c7b4d2a-6b08-4507-9618-02b4f41daca6", "comment": "Malware payload (AgentTesla)", "value": "3df85336a2bae4913168cfd3bcefcb741e61e99f9d277122461460b2ec7af48e6c0a4bb21502cc23680aef7d96c8e2ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028201, "uuid": "b39f50a9-5905-4195-96bb-e5fb17a84507", "value": "T1E6D41209BA7E4716DBBFC3FA0454A4480B7975EBA854EB860CE151DF6921F844F80F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028201, "uuid": "273294a0-1b75-49de-bcba-85d655eb772c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028201, "uuid": "b9ff015b-15db-4c46-b16e-6d7bad21f38e", "value": "12288:7Truqn7OOjJ/KuDcamvGzSVtcMp+NUOrhVOOwoyAPUl7f:757NJ/DFmv/Vtc7NPtVrwoO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028201, "uuid": "ae98ade9-2583-41b4-a9f1-faa6f15dde1b", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028201, "uuid": "f927f7f7-3dd6-4f03-a418-6efa52b843a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028201, "uuid": "fdc927a2-49be-4e11-b3bc-cb19ccd35eb5", "value": "Dhl express Ref-6853148094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacd328b-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998370, "uuid": "2131d962-90aa-4a57-80b3-93186687f4c6", "comment": "Malware payload (Formbook)", "value": "72a2006bee7ecdcc958be4f14931a97a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998370, "uuid": "4bf5ff13-028f-4312-801e-d9560b42cea0", "comment": "Malware payload (Formbook)", "value": "0eaae5d5053309b1c16854e101db54bd9856a3715ca88c744b2b87932d624392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998370, "uuid": "07964c19-8a95-485c-bbf9-986da90ab3b3", "comment": "Malware payload (Formbook)", "value": "b4962ef12f6a6e61e020db708278be819ed5f85d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998370, "uuid": "03f07f0a-0522-4720-92e1-a0b305ad2523", "comment": "Malware payload (Formbook)", "value": "3836863ed8e486cca8e938918e0e4baf638613764f93dcfb1d6a132a2b56c17f4ac9343195844936ef82f1a95e797f48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998370, "uuid": "f2832cc0-ea99-4438-a447-1acd858c372d", "value": "T131E423113FA5D733D0BE63F2A892156423B54B2AA113F32D6FD62ADC1121B62C351F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998370, "uuid": "7a769924-fcb0-4064-bde8-a3304ae0c0ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998370, "uuid": "a21ff7b4-6b63-4c7c-bf0f-b80fa7260a72", "value": "12288:YkCbGTqYNLB1q4d5Hbq9DJHgStd5abO3YuOM4x94bOogR/mZRM+:YXoqutd5HbqZJAavYNnKqogkZR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998370, "uuid": "f3485d24-2750-442e-beea-4e285c81f1ec", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998370, "uuid": "ae7d3697-f847-411d-b3b1-e1c15c68fcdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998370, "uuid": "d44c28db-e0e3-4b30-9d8a-bcc25b652fb2", "value": "7TIQts9hEgNHaI5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d796b41a-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699055031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055031, "uuid": "90756abf-f1b7-4078-b9dc-b80927003ff9", "comment": "Malware payload (Mirai)", "value": "d75f4c2d24921d6e232b88557c0f8e44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055031, "uuid": "848af278-bc14-4b6a-b918-c6a7e154eaaa", "comment": "Malware payload (Mirai)", "value": "0f3c5138a9adec0a9e9f63a825232d3c0715febdbc6f7d4263a67a3014fb9964", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055031, "uuid": "730bb18b-1293-4202-8352-7ca165a6b36d", "comment": "Malware payload (Mirai)", "value": "35b8a35fc3e4cc750a5e93525eaebbd8609f01b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055031, "uuid": "095b53bb-9ec3-449a-92fe-cbd406c829e0", "comment": "Malware payload (Mirai)", "value": "24fd0decfa12df23fdace45a5957476a2995c3f98e7a4199f9cb80191b38e41c4a8048258e4664e4b782394a0221f52a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055031, "uuid": "b0e17f6c-c65b-4c2f-9864-ed3a425bbc12", "value": "T18F632BCAF401DE7DF84BD6774C560E1CBA71B3D016831A2B67A7BEA7AD72158180ACC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055031, "uuid": "bf9e35e2-c39e-441f-b30b-ba892a3eb094", "value": "1536:23Z8R8M1OQkn+i8QDralQeuacWjcW0JcWcBASqh2R5ykNQJBF:23Z8R82OQk+lQeuacWjcW0JcWcBLqhme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055031, "uuid": "1d2311b7-7510-49db-ba6d-8fbb185724da", "value": 73084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055031, "uuid": "8f306d90-013b-4201-b6b3-8876e4bd4eff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055031, "uuid": "7acb0ab9-0fdd-490c-ab00-9945a5a0c669", "value": "d75f4c2d24921d6e232b88557c0f8e44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e666b9-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981292, "uuid": "5b3bf823-4787-4d39-87cc-97e440a2a02a", "comment": "Malware payload", "value": "3f2a17dce077f113b6c194a45f6ad8a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981292, "uuid": "22be28b2-6724-42ec-84e9-26f49516a1f4", "comment": "Malware payload", "value": "0f59e193ad32132c7021bbdad311b019e6280d25f519ddc3ab9cebc679037f2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981292, "uuid": "3960760a-520d-4505-abcd-a65eba26e19d", "comment": "Malware payload", "value": "c25a7a48425dc041e1f708e403a564823dcac4af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981292, "uuid": "d5b3fce9-0c00-45bc-a764-6518d6ba10ff", "comment": "Malware payload", "value": "c84f14e1bc1a7cbeea3925c9456f50ad521d6534ec925ea27be39df079b913f787cc875b5e1676fc0bba58bd4b84253e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981292, "uuid": "1cab02de-5fb0-41bd-8111-0b57286e3db5", "value": "T196F27D0223EBC6BAC26320319A17FBF567E69A1511E0958B2F621B1D7E71245FD3E303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981292, "uuid": "04c0f636-47cd-455f-a581-bb37223ba0f4", "value": "ce031612b07111be3a3089472e670d06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981292, "uuid": "311bae5f-8b86-4525-a95e-e1cc5db6d064", "value": "384:gaBhYO+xp+t33qAIZ17xkgaEDuNH4upfK0C3QxSXo7aPrruM8fLQfjkWC1Ty5aov:gLO+ji33w1WEaGQ0N7kWsTy5BcQh6D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981292, "uuid": "dd76c66d-cd56-4716-b2bd-308c129bf8e9", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981292, "uuid": "d61faabd-fae0-426e-988f-2dc20e852edb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981292, "uuid": "83eeab87-f99d-4c3b-b6dd-60886c1bd8f5", "value": "SecuriteInfo.com.Trojan.Inject1.19122.24205.25163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c3e1f5-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998068, "uuid": "c619d48f-8ed3-472b-b138-5cff38db7bd2", "comment": "Malware payload", "value": "d66b399e72bf10cc23c992ced530c3b5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998068, "uuid": "232569c7-deb9-4871-91b4-2e747cd27339", "comment": "Malware payload", "value": "0f720c2dcce4e4ee9a9ffe0c48e6c21fe81921b9c3a0e728b3e003db1599330c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998068, "uuid": "8db2a2f5-bcbd-429b-a793-584e0874c919", "comment": "Malware payload", "value": "e341d898b249f3b528c6b95eba397dab0543711d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998068, "uuid": "ea44b07c-1688-404f-b58a-681230cc1347", "comment": "Malware payload", "value": "ce2439a3c0cc7cfd1351371d94517cdfe830d1af4793a82d5fec61ecc115c198cd12d043eebb506ee07c3ef315782677", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998068, "uuid": "28d8bdbc-4672-4c49-93ab-5cfd0f78af11", "value": "T1B0E4237CFF708E5772E68208A199D35AEBF7F98DE073620D20A72C0458AE94073FA555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998068, "uuid": "350478c4-90b4-483f-b09f-5e6097e2d1e9", "value": "12288:jIAUYHZhNryAfOZNH8gPHChb0DAPPFjNHE5hhYEbj8lofqqQ7p6Ru:jbfN1LgDA1hkThrbwlX57p6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998068, "uuid": "5113b537-3d7a-449b-b4f9-d8801e9d9ac6", "value": 695864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998068, "uuid": "b6e3bdf5-4c35-412d-b505-0748cec3f3cd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998068, "uuid": "8f0f3c11-152d-475a-892a-8fc1c83d6b65", "value": "Auftragsbest\u00e4tigung.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5d40bf-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981246, "uuid": "d5b2e728-0e84-4e1a-a62b-f5ac3eef2c26", "comment": "Malware payload", "value": "81cc52364c8915eb52bea5da22578a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981246, "uuid": "93202def-463e-48a7-86c2-36ce84aad5dd", "comment": "Malware payload", "value": "10439efb40f9207b2a43afc5174a38336b59fcbe25f6be86890987769fba79ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981246, "uuid": "9c3bdc7e-b8e1-49d6-a256-518d2292f7cd", "comment": "Malware payload", "value": "4a177a3b41c239761fdb4ad646e99c6b9d48c4c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981246, "uuid": "b10df265-a798-4940-a389-105bacee593a", "comment": "Malware payload", "value": "b82904a955b48c9e10b99ccdf0943c55f9cd1edc20ca8affc50e27c6ca024be20f85f61e63732edcb180c4bfc9fce639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981246, "uuid": "2f60a357-5479-4a79-ba28-0d15c2a3d4fd", "value": "T1E3558D13E752C4B1D65816B00EFA5739AD7887610E36CE87C7E4CDB86E326B1AB2710D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981246, "uuid": "b40e728e-0cfc-434a-911b-05f7afbf0d0e", "value": "24576:E9JnAJt7T0j54Ad8xSDVH+v+MgzYLYDwYflYYJYgYG9Z:EgC5oxSBev+MgzYLYDwYflYYJYgYGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981246, "uuid": "926771cb-a31b-40c1-b85b-43b4bcc3d8fa", "value": 1389568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981246, "uuid": "400be25f-f0ca-4fe0-8574-0e35f9912f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981246, "uuid": "8f4661b8-117a-4ab6-a974-8f2c3962ac04", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15EXSUN.17142.19722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7690a73-7a34-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699007786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007786, "uuid": "b88959b6-9689-4b0f-968b-13a7def227f7", "comment": "Malware payload (Stealc)", "value": "cada954c54462294779895fcfa2fc18e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007786, "uuid": "8b95afc0-3923-4ab8-9c48-d967de87676d", "comment": "Malware payload (Stealc)", "value": "11600a65e9843dd9405b14825e0f8972e6843d18d56c919dde88e493d2a563ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007786, "uuid": "dd89aeca-a4ee-45e3-bff5-fd939cc72a07", "comment": "Malware payload (Stealc)", "value": "7772d66a511f9d94bf26cd16b8fa43c8afb59f75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007786, "uuid": "75be6e17-7e9d-4d8d-8dd4-3fee8df37531", "comment": "Malware payload (Stealc)", "value": "80c7eefbe866f6aef1b376a5c4c112e1419c5c04ae9352e9dd45f2d31a81a1fd7cba3f7d92df5e8013f7c0fdce432e4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007786, "uuid": "31d71ef7-f299-4a42-95b8-3605fc74949e", "value": "T140443B7352B17D72E527C6328E2EC7F87A0EB5608F4537AA12259E2F09B11F1C17271A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007786, "uuid": "19ab90e5-6582-4c4c-bbe3-10ae72dcbf08", "value": "9c4e228c6f6abc284bad94ad644731be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007786, "uuid": "a029937e-c690-498e-b5f3-e0e3edd529e7", "value": "3072:3+r1lYxGSukEpMyKSxWFm3WGjZiKuVx3DJNf+cJjaxd:4lYxekEuyDKojZIxD1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699007786, "uuid": "1edbe5b2-4744-4a88-bc6b-1d7d23966b86", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699007786, "uuid": "d6903368-c397-4587-bf2d-11e595204e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007786, "uuid": "0cdb5477-f34a-47b8-aef3-1055cacc25db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cb2fbb-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698998123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998123, "uuid": "0c0fbefe-514e-42ed-8969-abec889dafa3", "comment": "Malware payload (PureCrypter)", "value": "ba53bdd60b0b6efa84cdfb0cf7c85752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998123, "uuid": "87336ac5-a94f-43a1-9c7d-f97f7b1bed47", "comment": "Malware payload (PureCrypter)", "value": "11f6e26ef8a05340910ed5c91ead0071bac77bbb6a99cbeaa8d576b33b4dd061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998123, "uuid": "01026fd0-f365-48a7-bbbc-e5a4212763e7", "comment": "Malware payload (PureCrypter)", "value": "809d7cb8a546a5ca8efbddd17deb97abf2d9e1a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998123, "uuid": "fbb97a5c-dd5b-46b3-851e-7bfadc4cbb3e", "comment": "Malware payload (PureCrypter)", "value": "d26f8cd5b338e9617748f89bba2d492622d87f3c3eae19acb237225a0b718bfe53bef237316f92f00cc7cda3a5ae51ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998123, "uuid": "10888d58-ade0-43c6-aa17-53f764f9494f", "value": "T164335B17B71E5466C61447BAC89B8C781334DCC2B4D3CF5B788A7B0A2BA77BBD911206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998123, "uuid": "dc31e8de-a9a1-4a66-99aa-b08a40ed143c", "value": "768:tuPeg4Pl6FVd73Fxc0a7gJkPdGMRqIjNDk+KYhaK+LhtvirD+9BvPdD7Ypn:qqa5KgmzRqIj5nKsanLHqnYXdKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998123, "uuid": "ca3ea5fd-01cf-411c-9917-9f5cb3632680", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998123, "uuid": "d95c3dc2-4f73-4437-86b3-3a6bee9500b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998123, "uuid": "beba9a7d-739b-4c74-b3eb-d16f285f39ae", "value": "REVISED DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4ba821-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698997000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997000, "uuid": "18848c0d-8a9d-4a0a-8f59-1c7a1a14e387", "comment": "Malware payload (GuLoader)", "value": "78e86b0b473fd5b34bad76c692a1b8c9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997000, "uuid": "cdd4e3be-73d6-45a6-9d11-1fd5846f3641", "comment": "Malware payload (GuLoader)", "value": "14749f1a08f5c2755f860899d7d349be99bcf1cb2659a5e1d33ba3d20bbe452d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997000, "uuid": "78b59e3f-52ad-4901-bc27-e93ba24e7516", "comment": "Malware payload (GuLoader)", "value": "98d6d751093c283313b08704c63f19724744ef3c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997000, "uuid": "cee9f160-429e-4e01-8f6c-49f68665432a", "comment": "Malware payload (GuLoader)", "value": "286e632276b1fa292ad7fc6f25bf2c02d007812bfc5f66782899d64abdf15806eb63a92e038dc7b3e63e90f57fa1a8d3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997000, "uuid": "e7633516-10fc-4c50-b570-515eaacd18a8", "value": "T1088502B2177441BFE0265A78B027F66BF1816CA687DE12C6EE87FA5D0F73C06914241E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997000, "uuid": "35135451-c336-4473-b0d6-e99aa04ca0ad", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997000, "uuid": "606e2639-95f0-43ef-9b4f-f243983fa01c", "value": "49152:r0ER8cGD1XnSUNl6UeR/dweNhWf2/Lc3fk62miin0lNT:r0EUzNl6R/dvWu7cnuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997000, "uuid": "505dd6bd-8e9f-4c13-b684-70c6b466187b", "value": 1830121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997000, "uuid": "44ca5f3c-ec3d-439f-af5d-bc654bffe0dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997000, "uuid": "b65f2035-edaf-4f3f-9362-03a7677638d8", "value": "8654D098650000008900.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9882172-7a52-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1699020675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020675, "uuid": "608ca285-4658-4393-8a71-c7043a53816d", "comment": "Malware payload (MarsStealer)", "value": "9282dfad09de71adaded332890bb8bf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020675, "uuid": "d0fa88ad-587f-4172-8447-8e572994026b", "comment": "Malware payload (MarsStealer)", "value": "1671e83e843e98dadcebe0e45749120ca568409c3f8fbd60f5273aa6f8b7f589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020675, "uuid": "49aabf1b-071d-4b54-9595-00f28969ac85", "comment": "Malware payload (MarsStealer)", "value": "c53918d2a909edd58fa9369cd4e148584d659f10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020675, "uuid": "83d6a864-b761-4221-8062-0aacd343be3a", "comment": "Malware payload (MarsStealer)", "value": "378062857d6b41d544d9a173f8b924452d9c1be0d2ed562fef51d9dc20425b9e8ce18dae6866a0e50709548b0e84d6b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020675, "uuid": "d0b89004-b4e5-427a-a716-c9af6a6454fe", "value": "T1CA54097372E07C66E526CB328E1EC7F87A0DF9508F053BA61265AE2F05B51B2C163719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020675, "uuid": "df45121b-6654-4cf2-8e2d-911eb142e1ca", "value": "5fde42363e282ba9b6cb8d9d243cde86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020675, "uuid": "f7e159ff-60a4-4e3a-9d8e-92199f8183f5", "value": "3072:lrr1/uxeCyk8p8y7tgpJEMStbmcWXYQarsZ8AJJJABnMpw9d:j/uxqk8+y7ObEptqc8MrPAJvABn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699020675, "uuid": "10e852f1-cbca-43cc-aac8-198362b3fa16", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699020675, "uuid": "8a4e1e5e-c850-4e2d-9d68-1271e4befc94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020675, "uuid": "29c4047c-ed54-44f6-ab9a-12b81a53c1f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba19aee-7a9f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699053615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053615, "uuid": "5975f250-84aa-4d6b-9bf0-347c7ec3af27", "comment": "Malware payload (RedLineStealer)", "value": "1db3bccadef3506e6654889cde4e2d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053615, "uuid": "d56aef2d-7138-4ec7-8c20-96170ba9e05e", "comment": "Malware payload (RedLineStealer)", "value": "172f218bed376edaefeaca3e144df5148b9348be8a06cbfb9fd50803940e28e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053615, "uuid": "928699fd-1add-40b7-a846-b36211de76c3", "comment": "Malware payload (RedLineStealer)", "value": "fc9e4497701e1706e0b1c9a994331357022f391f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053615, "uuid": "a9cbfe12-048d-4fb5-9757-6d08b78e8b9c", "comment": "Malware payload (RedLineStealer)", "value": "5bf9e85190f200262054ca3e1ecfbbd2a8ea05562ad9405580aebdcc55005e276d87a295e71b0d9a857b68903879a7e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053615, "uuid": "4d85d211-94c9-4e17-be78-3912a981ab29", "value": "T14E853302F7D4A0A6CD765B708DFB1A476E39BDC04C20068616206EFEB961BE1D53937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053615, "uuid": "4a9273e7-68cb-4c30-ba65-db1abb8ebc21", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053615, "uuid": "3d8eb00f-4c32-411f-a69d-44743f4e04cb", "value": "49152:hVgkvxWMW+FLuLVjdGsHAWoA8KfT4988q3Si4z:VvwLVj8szoAeigz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699053615, "uuid": "d6e4cb07-d737-47cc-b5bc-226a1d4b5467", "value": 1862656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699053615, "uuid": "ed30dd15-82aa-4dac-b9c2-75ddacfa9415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053615, "uuid": "2e5bdffe-2cc9-44c3-9924-28614bbd1538", "value": "1db3bccadef3506e6654889cde4e2d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b18b0f-7a86-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699042660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042660, "uuid": "2af2cd68-e9c9-45ee-a73e-055d49de91d6", "comment": "Malware payload", "value": "10770c66fe83072328fe640528da1f3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042660, "uuid": "873cf2cf-c8c0-4128-b041-64a8f786b9da", "comment": "Malware payload", "value": "19d5668c176fd17ee00ab03bc0e122a54baee90f6c00ddefc40faa6ee762b9b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042660, "uuid": "f7962f37-cba1-4ab9-8423-fda6df93cb0a", "comment": "Malware payload", "value": "03bec9901e38c2840112516ea8d60e345094b2ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042660, "uuid": "dc76e33b-78ac-43a5-baaf-38b3210a96e1", "comment": "Malware payload", "value": "17a04a15aeb63681bea1d64a0dd5a024e97d4d57a46fc658087a5fb178c08573bdb8bac412f6c8ae93e20ec1106a8c38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042660, "uuid": "f3c15962-f102-4a0d-a9d3-4cae2485d3e8", "value": "T17ED412113EAC1B14D7BAD7F95460294403B678EE5564FB0C0CD6B1EA22B2F854FA1F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042660, "uuid": "2ae805ba-e231-4f65-bc19-3f576ca069a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042660, "uuid": "9bc86d20-3077-4188-99ac-e0939bcceb9e", "value": "12288:Ss0vkcVL2FND883gtBWPQinT6jwyS+9spv6T:Ss08aL27o8N3na9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699042660, "uuid": "0b60671d-96e4-4367-8534-0e9863c47c5a", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699042660, "uuid": "cd4f36f7-74db-44ee-a627-c82a3cbda114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042660, "uuid": "3977ef32-f5a4-467b-bde1-0e5f6532e8bb", "value": "Dhl express Ref-6853148094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec2696b-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996846, "uuid": "f6e816f3-66f7-476a-8f4a-3c873aac1e15", "comment": "Malware payload (GuLoader)", "value": "35a8d09f90bf40a9efc1c374411bec49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996846, "uuid": "5ffb5d2c-3b02-4fe3-b073-4f0a4b285798", "comment": "Malware payload (GuLoader)", "value": "1a3fcc316f4b8b404415a1e22f414431144fe6798374cc860a40eddceae9c31d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996846, "uuid": "91c3aff4-2f33-4075-a119-674eda70efcd", "comment": "Malware payload (GuLoader)", "value": "489bd8f3ea436f212ad8894041e458737894c830", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996846, "uuid": "f0a87eae-b42f-466d-ac6a-7da7091cfa51", "comment": "Malware payload (GuLoader)", "value": "59a437f7836326e11a50958c1c7e50ddfdbb31d7fcc3f5fb4ad70afc5d0c77b95cab4bbe6c1a1cb978ceb7388978f60c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996846, "uuid": "af8ef552-beb0-48e7-957c-c19736559720", "value": "T1D0F41212B264D863E8590173CCA7D6FC6FB23D5E1DD9024B33A9772E7832752B84E258", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996846, "uuid": "4499948e-16a2-4f58-99bc-ab87fd98c7be", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996846, "uuid": "3b488ad6-04ed-432a-b44d-3219aab60e70", "value": "12288:M0f2JEhxDZQSA9H35XMki6i3850evweXtTYVNPvwfj9HBrRYzzpTq:M0foEhxDZtiFMki6i38hz9T2PoftxGVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996846, "uuid": "e255b364-097c-4c12-a600-130899665e89", "value": 763069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996846, "uuid": "51df5d0e-145d-41ad-8c46-2c13d5cdf871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996846, "uuid": "7c00ab54-c339-48dc-9143-83d86746c8b6", "value": "Purchase Order 49545.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353cf4b4-7a45-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1699014815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014815, "uuid": "9e5b267b-67ca-4d29-9e5a-e7eb5b345853", "comment": "Malware payload (RemcosRAT)", "value": "1ac5f085c06e62b1e7495c2dbcaee566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014815, "uuid": "2477e911-2d5f-4fbf-bee2-c51c9e7cdd64", "comment": "Malware payload (RemcosRAT)", "value": "1a7ff7b597c60b6e86db234652aead8902507825d9d460ea99542d15830a566f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014815, "uuid": "8cc333bf-4d1b-4cd8-aeb1-77d1dcfc7fa8", "comment": "Malware payload (RemcosRAT)", "value": "489da1953a7f3196b46c6c795355ccd2f9c516ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014815, "uuid": "06ce88f8-eb18-4d65-bec9-929dc9506c8f", "comment": "Malware payload (RemcosRAT)", "value": "0b560824a06eae898b0e5512a4c1bf956992cff1a06adb49571e241118c4ca3949aa52103ab65b94ded7ecc2ca8ce199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014815, "uuid": "f0874436-204e-4e2d-a29b-eeb768b2887e", "value": "T10DC52369D250C0A3F65415345ED7CF31AF22AC54946086962BF9BE2F3D7E3037C1A2EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014815, "uuid": "c8f9f331-fd19-4d5c-b0d7-81ae1e0ad991", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014815, "uuid": "0f774a19-a3af-4d01-b307-d65eeb739d51", "value": "49152:kPR8QnXN81yUCV5VliUYmuyKLbokCQf8TlJoT9ESCPRGT8Psc:kPxn9+y3r5YcsboCc29DKGYsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699014815, "uuid": "05c44898-c062-4d46-8c31-78dcf3392e1e", "value": 2734784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699014815, "uuid": "42486706-17e8-4bd4-9a33-8dcdb3f27d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014815, "uuid": "c4cd3685-1a46-4be8-842d-fa8016f28407", "value": "1a7ff7b597c60b6e86db234652aead8902507825d9d460ea99542d15830a566f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df015e2-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981276, "uuid": "9f883d76-c377-431c-b2cf-935ad5ab7a39", "comment": "Malware payload", "value": "66bec5dfced1e17e3a7bf3d501784573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981276, "uuid": "6a1c9cce-76f8-4c72-8707-858a43b746a2", "comment": "Malware payload", "value": "1af9041d4e2696202c7ea5a68b6feebf5121d53d9be6443463b51d415022e160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981276, "uuid": "7e03f2d5-a82e-4332-9f13-b7901c3c6848", "comment": "Malware payload", "value": "d6bd11c4c5ba458b6594a79783c234b5727b6e14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981276, "uuid": "2b87c1fd-c234-44ac-922c-80b8bbe180b7", "comment": "Malware payload", "value": "a0c8bb03bc7f7ee9e049d71087f629bb4c4fed24b63c6aed6f7a2cc6aa77ee3ec36ed306a4006a5e673b06e76c36c863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981276, "uuid": "29b198b9-0d12-448f-83fe-cb6a1f381684", "value": "T1AEA5BE55BBC2CD77ED2B453044662B76D922FD078F068643A368FB9D2C73AB09C29127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981276, "uuid": "5aca01e9-864e-433e-b54b-099f73b0ae03", "value": "d2cb1fd87edd08c25ca51ee143d1ba9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981276, "uuid": "2245b31b-2585-489b-b8d9-3adb0631f584", "value": "49152:n4VDwilG4m9RS+s8KuqGaX0ToIBAUZLY:4twilG4m9RRJBAUZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981276, "uuid": "7322a9fd-9b9b-4c18-baac-afd9f99d4e6f", "value": 2063680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981276, "uuid": "54fce0a1-5398-4ea0-b227-4be5242bf048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981276, "uuid": "8329e29b-779a-443c-8ee3-b28db02ac14b", "value": "SecuriteInfo.com.Win32.Evo-gen.27372.11194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58efcb8b-7a26-11ee-8907-42010a9c0042", "comment": "Malware payload (RevengeRAT)", "timestamp": 1699001561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001561, "uuid": "580de67c-42d2-4a25-ac43-7b399958e2b2", "comment": "Malware payload (RevengeRAT)", "value": "06cbe7e4119ca545f6420e7b4100e3d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001561, "uuid": "a92f2292-6861-4328-9b23-94630a47d204", "comment": "Malware payload (RevengeRAT)", "value": "1d4ad36b22c945994e384ff85031a0612d5f7270d2a1ba9269ff9eba1de85bda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001561, "uuid": "a2a5a640-1117-4a53-a2a0-564dc3e11aa7", "comment": "Malware payload (RevengeRAT)", "value": "59732b92b35d7b2d5467bf1b7856cfa248b09e3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001561, "uuid": "16df469f-8a0e-4ff2-a141-524ccbb94f8b", "comment": "Malware payload (RevengeRAT)", "value": "0051d0b337c78025cd6c6f91dac22494796fa3251ec161d529c11603f6f3f07fcff09f33b04b736a2f66d01666304a81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001561, "uuid": "5542b8dd-b799-4ef9-b8a6-6b363321af64", "value": "T1E1B5F1A43290AF7CE17FBB3985D9101993F8FC8BA311E59A7ED2F9CC0931E488752915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001561, "uuid": "060dc97a-003b-4432-a0e5-d5538e8d125a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001561, "uuid": "b84d0742-f2a0-426f-9b20-c1b3e2c6b76f", "value": "49152:/o69iGjipDXClR//fzbbz129ZFwaWrCWUDNCpF0:F9CpzCb/rzI9PSyDNCpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699001561, "uuid": "e0de7d03-c5e0-45f3-aa92-41bb73cba401", "value": 2301952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699001561, "uuid": "879d993f-12d6-4200-ab94-6fdb16c133cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001561, "uuid": "602103e5-fa1e-4ae7-89c6-68e5cab38ef9", "value": "06cbe7e4119ca545f6420e7b4100e3d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8fc4cb-79de-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1698970801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698970801, "uuid": "ed6d06d7-784d-4eea-8d57-7cbd44e4141f", "comment": "Malware payload (Adware.Neoreklami)", "value": "843e10f79eb11537659c86c6dfd89287", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698970801, "uuid": "5a8544ce-18b7-4ad7-b767-307d148af661", "comment": "Malware payload (Adware.Neoreklami)", "value": "1d8848fab3c1b40c63ff1f16c15b9bdb07c52851fd73814c3e7a491a81b1dfaa", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698970801, "uuid": "6311bcf0-b45c-4b1e-88d9-db57821ddecd", "comment": "Malware payload (Adware.Neoreklami)", "value": "7c2e78a06669dfcd66a2f0570927f6dc25a90c1c", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698970801, "uuid": "1dda3d7d-bfd7-4b42-8507-e16068d014d3", "comment": "Malware payload (Adware.Neoreklami)", "value": "1590ca6afab81d9d77124a120a7718229cacbf6e97b7f11b70e0e00a5fbecefa16498d5386d95909316e8baed45b7993", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698970801, "uuid": "6f287411-bb6c-4707-aec4-d201a016bd55", "value": "T1247633D639E2C4FCE27138F5CA681BAA50F9D70307B649A31B4E471C5D2DE982276D22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698970801, "uuid": "2d863678-9cc6-441f-bbbd-d23d3ef4a326", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698970801, "uuid": "80baa05f-9cc0-4101-bf7f-7e2df7665599", "value": "196608:91ONv/mi1tAydUqHpImwO+Drjo7818pgeXJv:3ONvOiky6qHpIzfSpgeXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698970801, "uuid": "c033ba27-1e42-4f9f-866b-207748094dd5", "value": 7525985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698970801, "uuid": "66a19d00-155b-4207-b9c6-9853b0dec9d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698970801, "uuid": "35a49288-4372-4a5e-8219-3a208c9254e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30dd6aa-79fe-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698984505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698984505, "uuid": "d9632a78-7694-4a96-afe6-d7796ae972ef", "comment": "Malware payload (Mirai)", "value": "2b899c6e7a51bdcec7217fc188cfc3aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698984505, "uuid": "b57a8c76-53dd-4ae1-ba3d-d624f22cd873", "comment": "Malware payload (Mirai)", "value": "1f16218c07b8a92576430353007a28215333d03750150c08d5a6cf23a0dfb7e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698984505, "uuid": "3d110162-c341-4833-9486-5567a0589661", "comment": "Malware payload (Mirai)", "value": "5d0dd2a8a891d86063220016f0f1a5065ee24df8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698984505, "uuid": "0413edfc-22cc-4268-a3f9-765effcc4219", "comment": "Malware payload (Mirai)", "value": "9457b5ff29cfccb9367beee64c22b18a204c912b0808cf068941f4b96c370720493b464b156c881573115585415066f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698984505, "uuid": "ec876869-d918-4aec-bcaa-902b68ab7aa6", "value": "T162438D77D539ADD4C14C42F4A92985781F03E314A2A22FFB9E84C665400BB78FA4D7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698984505, "uuid": "7fbacf44-9652-4ef8-a31c-9a6ba525d3c7", "value": "1536:Ua3wtoCQ2bKDVqpo+HSN5Sy+CuVw8PlR:UAIQGKo4vSy+Vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698984505, "uuid": "9a9dce52-4f98-49c0-b2d4-02193813bf4c", "value": 58220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698984505, "uuid": "2619ae04-e26d-4aed-8f76-d26c3cac786a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698984505, "uuid": "f91dfb61-fbe2-46df-a076-095b68badc2e", "value": "2b899c6e7a51bdcec7217fc188cfc3aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f480e2-7a4a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699017077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699017077, "uuid": "3b6f3f25-d142-4218-b868-3453eb995efc", "comment": "Malware payload (Formbook)", "value": "5a237ea69b6e102d0357ba681a71821e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699017077, "uuid": "f1564f35-0fa2-4814-a4f8-6bb2052fa2af", "comment": "Malware payload (Formbook)", "value": "1f3303de538573bf37d25f36e43acd1e298e64960fa594e61099cc939613ccff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699017077, "uuid": "c2a7c248-8a01-42dd-846e-b652e3784d5f", "comment": "Malware payload (Formbook)", "value": "cbde419bf3302a44c20a5ae41dcd4bca12897611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699017077, "uuid": "61b3a05e-2a94-409d-8b0d-77f2d5dadeb3", "comment": "Malware payload (Formbook)", "value": "9f78c1a9335ef26d0e9ea80f3ab7798ec523b86bd8fbefaccaf621f1d5c0c06c4933e2ecd58f1047bb5c3627f088abf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699017077, "uuid": "99ceb4af-38b1-457e-ba41-7c17aabb4736", "value": "T186D4235376A4CF26D1BA5BF54406638083FE74A50653FF594EC6B0CBC88BBA483A1397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699017077, "uuid": "b92874e2-6027-4708-adba-fe875a0af60b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699017077, "uuid": "5ddffe2a-23d3-4b86-a8ba-c882b08577f3", "value": "12288:EIkubFxn1D8iZqypebyRswHmvB/gKWyoel9QzpI96uortUy:EIk+P9XUyp+yawHIBJBMlI96u6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699017077, "uuid": "90c74ed0-c065-4be9-a934-79c5a026f035", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699017077, "uuid": "dae8994b-4cee-4b91-ab90-aeece76c9c35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699017077, "uuid": "d0c39386-1f4a-4b6c-a7ff-efcc2b5b990f", "value": "SHIPPING-DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df64436f-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699055044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055044, "uuid": "3f3a73f9-230d-48a6-9643-9189077c165d", "comment": "Malware payload (Mirai)", "value": "edff20177be1357d60d1cad5b351f86d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055044, "uuid": "fb6071cb-fe3f-4ed0-9306-ce2fc2322d68", "comment": "Malware payload (Mirai)", "value": "1f70d7beec15257834004f444be1b3fe6612d96b60c8f5364ec645885759152f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055044, "uuid": "e93381aa-1311-4bbd-9b06-09ca2aa1666e", "comment": "Malware payload (Mirai)", "value": "30c9317ec6b741118f6d06380f34b981c9edf379", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055044, "uuid": "17576f6b-1a6f-46a9-9167-a48e586d41a9", "comment": "Malware payload (Mirai)", "value": "a6f9521fe7af2aed4c861896265e71aeb78608f1561acee7ea996c7c01b0addf37edfc34dc8c9a7b52ca5e4bf4b1140b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055044, "uuid": "bf9d0fda-2075-49f7-8af3-69f6b8d8d711", "value": "T1E9833AC8A6C3F4F4EC000A396477EB729EB7E53B6125ED9BD7CD6623A849702D00265D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055044, "uuid": "fe818afb-b9a6-4ea9-aa2a-ca67bef28619", "value": "1536:SfAP2iJ7jOlpCi8y88f7Tqu/yOsKHYg1v18H2WkWFv7hDuwQ8comL4s:TP267jkpytGTq2FxHY0vCH2YFuwtlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055044, "uuid": "c45a2b03-d566-42bd-a655-ff337b277fb2", "value": 82704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055044, "uuid": "002d7bcd-232c-449a-af90-b24ed9139489", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055044, "uuid": "cfd1a7f6-c4ab-4d1f-ad29-c37a2880eaf2", "value": "edff20177be1357d60d1cad5b351f86d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07ea983-7a55-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699021867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699021867, "uuid": "baecf11f-8a1b-45db-a971-b794d0ca1a32", "comment": "Malware payload (RedLineStealer)", "value": "0a9fa8dca54d3900ff19f692b02fda89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699021867, "uuid": "85c78c0a-4235-404b-988e-3093bccd3610", "comment": "Malware payload (RedLineStealer)", "value": "1f74859b736272094387b627cdb0f29842b985703c2ed8cba74a7c9c729623c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699021867, "uuid": "b415602f-fbaf-48e1-9f5a-4f69d21fe9c1", "comment": "Malware payload (RedLineStealer)", "value": "196414fa104e21408bbb55d65248e63af5d685bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699021867, "uuid": "f8ad3bed-2573-4e31-b370-34864c6c14ec", "comment": "Malware payload (RedLineStealer)", "value": "456bf3c5a81e868c508d9bcfb7ed9c989057cde6f53814e6a1c1eb5fd82c53fea1d162a8ffb787838886353fcb0289ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699021867, "uuid": "b908ace8-43bf-4a56-a1cf-71e97a820835", "value": "T1B7652322EBD41033D9B12B7086FB03C3177A7DA18E78927753A999996C321C4D371B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699021867, "uuid": "e1efd3aa-f6e2-4d13-b69d-268f6c72e38b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699021867, "uuid": "00bc4d27-3cca-47b3-84cb-f7b66811f585", "value": "24576:hyGh4WzDowdQVz2l+c4V/YZ+iVbKB/BArHEkkvoSS29FI8Btul8qA61R:UGGQUxz2lBvtQZArHHkN9FI8oA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699021867, "uuid": "39b00c57-d7cd-4e7c-937f-3c5b63f79cf0", "value": 1530880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699021867, "uuid": "1ed72d14-e49f-4223-be67-d7ba7557d391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699021867, "uuid": "f7f4fa0f-959f-4a4b-9d83-60b63d6a31bc", "value": "1f74859b736272094387b627cdb0f29842b985703c2ed8cba74a7c9c729623c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b621d1ca-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998281, "uuid": "9b68a1d2-378f-4f62-a0d0-153d96035778", "comment": "Malware payload (Formbook)", "value": "a22a4609ffb40d069b49bb8dcedf28fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998281, "uuid": "94de31bb-aa79-47f6-88b6-96973ed4212a", "comment": "Malware payload (Formbook)", "value": "1fe94fc7e68f38ee1973e1d21000cfa941d47a781702d161b9d6f5285e92111c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998281, "uuid": "33ceee2d-6ca7-4a18-b89d-f13d0289b15b", "comment": "Malware payload (Formbook)", "value": "faaabfd7af08acc5ef0bd32f90692e717684375f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998281, "uuid": "32b0c1d0-0acc-4ffd-800e-6d0d764e905e", "comment": "Malware payload (Formbook)", "value": "3f29010b55d80b036f2ff654641eec8afbeccce09983a5d006baf0178bc6605e627d30c28ab7fb42e5404c017a574238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998281, "uuid": "0a459ff6-212c-4d74-9ba4-1bacdc9d94a5", "value": "T1C794DF42EBF6EE72CA31153F876433316F6E6E8141F07A8A3218FA683CB9C419545797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998281, "uuid": "8f5428b9-3eac-486b-ad78-d01e0c315962", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998281, "uuid": "c846906b-e90a-4c55-ab04-91224606d417", "value": "6144:CYa6GSf+Df5DcxW1tYwL9Tu4iHGS8irwNhCdx41bkvI0axUFrmiku:CYBwmG9Zim+0Ncm+VayF/ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998281, "uuid": "4ee874bb-af53-477b-9166-4c841a842791", "value": 437358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998281, "uuid": "61fa0703-1ff4-49d7-8aa4-fc9fd8291696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998281, "uuid": "2fe00792-5775-4053-9dff-ed968f4ed2dd", "value": "PO#40296.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58507271-7a25-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699001130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001130, "uuid": "75c29f48-da59-4a75-a868-c3c567f51086", "comment": "Malware payload (PureCrypter)", "value": "a9d2227824e3038b83c0eb469f2690ba", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001130, "uuid": "4cae7753-0ab2-473a-82be-213a335a65e7", "comment": "Malware payload (PureCrypter)", "value": "1ff4df41eca0a13953ed08a1d2f373b375e6841884b353395d9a30632b81733b", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001130, "uuid": "5870a546-b793-4917-b048-d96217566048", "comment": "Malware payload (PureCrypter)", "value": "cc7c399a72bf6801bb2ce9810b09c91ee872627f", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001130, "uuid": "949abb2a-b203-479f-bd70-02a44dce8b8d", "comment": "Malware payload (PureCrypter)", "value": "39547a3514654f0e8ee326fd842da7b06b37da27d5bcd719ce2b648cf6f76fd8267d9b893cc12709dbf833c98dc65083", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001130, "uuid": "be774d38-806b-43d2-b7f4-e6bbe62a1ae8", "value": "T1FA24D607B6A689B9CB95173BCFE704044366E58AA6A3D7097D8F13E90B037B79D00787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001130, "uuid": "62693691-1a3a-412e-b94e-5f3e16c56590", "value": "3072:l9GqYMwpm5UspfNVE/wGC481l9bNydMh3PizZYph7nKq:tY3pm5Uefr8wd481l9bNydMh3PizZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699001130, "uuid": "30a2eb96-e75e-416c-a7d1-98d1903f1901", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699001130, "uuid": "656a2419-aa79-48e6-8334-b63828113ee1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001130, "uuid": "99986b89-9689-4977-aa2a-dcb9a9848d5b", "value": "Quote 7005193740XXXX.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594c4966-7a6b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699031197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699031197, "uuid": "fc111e4e-0832-4c06-ab6b-46a3e05e0b54", "comment": "Malware payload", "value": "b5ede0ff77517fdf30a66dea5bf78d61", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699031197, "uuid": "9efad5d4-43e4-4665-b2ca-a95e646baef5", "comment": "Malware payload", "value": "200b16b4b38eaa85db2a040f521782ff508949139711dab6a32b93cf078411bb", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699031197, "uuid": "ed806f31-ec2c-4f02-9d9e-93579907444f", "comment": "Malware payload", "value": "5b1c623feb44ccf65a6559b16077a3e78115c7d2", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699031197, "uuid": "c1d38dbe-0e34-44fd-b639-953896f1ea1a", "comment": "Malware payload", "value": "66dab3cfcb8e9a77b9e945ec2b16c12a50561206081698fb21564de8aa13da3b065a6da4043b51838799cda3593d4ed0", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699031197, "uuid": "019554c3-d5f0-4c36-8abe-8bf720bf5dda", "value": "T1282401A83435C450DD9BA5B11B5C3FC3A5CBC1F218D62023D072AA9F367EC23B4A15EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699031197, "uuid": "fd7f13d1-6434-4579-84a8-a96cb4d8129f", "value": "6144:iai3/or3B8vmAii7rmHww2ArEJmR7uPdRSAJF/f8:iai3Ar3KnrmQw2A4OAdRPF/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699031197, "uuid": "932326a9-de98-4743-8bb7-18e4090a5741", "value": 212456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699031197, "uuid": "50adce3d-1da9-413c-a1f5-1e32c617284c", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699031197, "uuid": "d9908672-5e24-4134-958b-e23756e9f509", "value": "claim-nov-2-169EAO249-23.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98665ec-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698998287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998287, "uuid": "2afe1ede-3525-483c-8aa7-46a1f1a3052b", "comment": "Malware payload (PureCrypter)", "value": "f2e349d86b057ba53a1b8e7dcc595ac5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998287, "uuid": "65f991f2-7c50-478d-bf6d-771e1e776b8c", "comment": "Malware payload (PureCrypter)", "value": "207bfbe64871f4b4140f97ed5c877283469a344339d96a909c99f5067ecf0aac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998287, "uuid": "15585b3c-18d1-43c9-aab7-7640347b3a26", "comment": "Malware payload (PureCrypter)", "value": "578603ffc80014db69bbc9328fec0c231c4ec81a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998287, "uuid": "4faf8abe-91cb-45c1-813a-3aa700dfdc99", "comment": "Malware payload (PureCrypter)", "value": "fc4e334c22cf917cc4c827dea62d62ebf42c4c8afb59f8e530da27a50422963582d88a51227862acb70e43e0353013cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998287, "uuid": "b3131688-5406-4ded-a789-014dc3b2eaba", "value": "T1E004C952EBB6EF30CE340A3FC245B3255F2E5E9181F27D8E304DB1652EB9D01D5446AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998287, "uuid": "886fb37e-a478-41a4-a452-f532237cbb1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998287, "uuid": "a47040e0-def0-4ed2-8521-8b211f4fe441", "value": "384:mpfOEQv+iA8Cnepmwww6BKpwWowwwlpESUJXtdhVm13jWtSHPWcAwaYi:CncRpESUJXtdhVm13jWtSHPWcFaYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998287, "uuid": "3c4fe885-a2be-4f6a-82b7-6e9b040e99a9", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998287, "uuid": "a3a88a56-bad0-4d95-ba41-953b8e4fd1e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998287, "uuid": "94f23c51-92c2-4991-b4e8-c77dac547505", "value": "PAYMENT SUMMARY.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c007c3c0-7a13-11ee-8907-42010a9c0042", "comment": "Malware payload (ItsSoEasy)", "timestamp": 1698993573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698993573, "uuid": "295b161f-0b22-40ef-9c32-45af421807db", "comment": "Malware payload (ItsSoEasy)", "value": "b4b6c316ba4285d42649026d38f9ea43", "object_relation": "md5", "Tag": [ { "name": "educational", "colour": "#BD4D03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698993573, "uuid": "23bfef5d-dbea-4c26-9e9f-e905f1706a88", "comment": "Malware payload (ItsSoEasy)", "value": "20d724d8e30e64f74aaab99ab360c896590a8faa06b8d1ac71424660a2e08d3a", "object_relation": "sha256", "Tag": [ { "name": "educational", "colour": "#BD4D03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698993573, "uuid": "6fc86ad1-95b3-487b-b251-6188150d84fd", "comment": "Malware payload (ItsSoEasy)", "value": "64687275e66785969585d29020fabb011865af45", "object_relation": "sha1", "Tag": [ { "name": "educational", "colour": "#BD4D03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698993573, "uuid": "de519033-63de-478d-9e31-b2db0538b3fd", "comment": "Malware payload (ItsSoEasy)", "value": "d06e14c4fa985259a1ccda306f033f2763e3f1976436e12bf414c5c1cfc4b7ee091c87c38f8d5be313d981ccdfe53a53", "object_relation": "sha3-384", "Tag": [ { "name": "educational", "colour": "#BD4D03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698993573, "uuid": "803cb819-c0f5-429b-ac32-09b62e6c63a1", "value": "T1B0369D03FC9560B5C5EFE230CA75969277317888233127C32B55AABA2FA3BD05E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698993573, "uuid": "9de80f9f-2c5a-425b-b532-9b88f354f615", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698993573, "uuid": "48e53cf0-21bf-4f6b-952b-d822067f07cc", "value": "98304:ZApL54mSFSoK43LHfMRuP4EyhIW6aZVzF4je4:wTyK4jfXPxXeZVzOje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698993573, "uuid": "1a5537e3-86a6-480e-9c7b-a56958bdd197", "value": 4941824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698993573, "uuid": "2775f797-02c4-4037-a440-f7cf156f7a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698993573, "uuid": "e24a7d9a-1f1a-4a18-8518-0cb4dcc8df03", "value": "itssoeasy_win_go_v1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a83c35-7a40-11ee-8907-42010a9c0042", "comment": "Malware payload (zgRAT)", "timestamp": 1699012957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012957, "uuid": "295c380b-a2e5-4b6d-8520-8fd88e3d69b7", "comment": "Malware payload (zgRAT)", "value": "f37586bc168dd77cc3e78b28035ff080", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012957, "uuid": "dbc4e6aa-fc2d-407c-95ee-9da4168c7a9b", "comment": "Malware payload (zgRAT)", "value": "21ccb72ebf58fb8f08b713e7fa404f325e7cf6fc84187951ba907500f7791dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012957, "uuid": "8750c825-e9a5-4f3c-a578-e2f362a64fe0", "comment": "Malware payload (zgRAT)", "value": "a95ea82cf02e6a4a03101b89ed9d3385778d91ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012957, "uuid": "c000afa7-bdc2-40c7-9673-c16fa059f24f", "comment": "Malware payload (zgRAT)", "value": "dd07791ca1db4c8294ab57c755c33731e4ee105f39b239a2b752a5fcff1425511336fae105f738e14670e9a252976ed3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012957, "uuid": "e199dd75-a6bf-4c9d-95b2-97dd0ffa5010", "value": "T1DC55AF83FB46E86AF22403F6D49A60149AD4C1C0A36BCD05BA4D73D757127ADEEF1287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012957, "uuid": "310f01c1-ad4a-4562-8f73-fde4e1f9b5ef", "value": "24576:517VBDUqp008fNKgNzHZT5dFEf321NYPc5bwys8tFiVD0HajI:0CfgNzHnd6/yNYK3s8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699012957, "uuid": "35cdb0fd-7826-459f-8f3b-25772b7a9165", "value": 1402368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699012957, "uuid": "b61d17fb-7f5d-43a3-934f-4c1d3f16a307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012957, "uuid": "14b9c7ac-077a-48d9-acc6-aac39296123d", "value": "21ccb72ebf58fb8f08b713e7fa404f325e7cf6fc84187951ba907500f7791dd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0edaa75f-7a1f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998430, "uuid": "db6afa2f-db5a-4a09-9066-a91ef88d158b", "comment": "Malware payload (Formbook)", "value": "451793e6ca0c5d018fae092767749133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998430, "uuid": "c573e119-00c4-4fce-9eb9-f7db0a5af43d", "comment": "Malware payload (Formbook)", "value": "2230b251f4acccb3ec401aa9d70e85a5dc390ba5bcf25a4f11761256d1d18016", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998430, "uuid": "e70169d2-6cb0-4fb3-91b0-240fae3d036e", "comment": "Malware payload (Formbook)", "value": "efbb6000f882c1c9e712484580b55947688dbe6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998430, "uuid": "25957a9a-ef03-40a9-9687-339051573482", "comment": "Malware payload (Formbook)", "value": "ecb5b6d0caf3afbe05a811463274229726b67bfc661e8c825c8170d3d531b0b5acaf8ccde8340a92b52beac2803b58dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998430, "uuid": "9463d18a-1c2a-4c63-814a-878efbaa41c4", "value": "T18CC4238237742B22E96843F141B1E6906BF9246B1094EB745DED70DEB8EBF011691F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998430, "uuid": "83167d44-615a-44e9-9fe9-b9ae8c8be095", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998430, "uuid": "c7c61510-7229-4952-9172-239695a45058", "value": "12288:GIkQxHvhFLUe8WovG0DY8h6KVU//LQSbsvEn7:GIkQxPIe8l/D/h3q/ErE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998430, "uuid": "8ed55aff-aa2a-45b8-969e-37d6c8da82b6", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998430, "uuid": "2e74b678-bfef-41b7-a143-4679ba399963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998430, "uuid": "7aa23707-f1b2-40b5-9c12-a11c6b94e145", "value": "451793e6ca0c5d018fae092767749133.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff76273d-7a94-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699049085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049085, "uuid": "1627cb66-191e-4c92-8ba6-a58bbdfd61ad", "comment": "Malware payload (RedLineStealer)", "value": "8e05c72da260ffa2255ca5b309377959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049085, "uuid": "6e20427b-4cfa-49b9-b6ee-7fb4f6fa692d", "comment": "Malware payload (RedLineStealer)", "value": "229e859dda6cc0bc99a395824f4524693bdd0292b4b9c55d06b4fa38279b3ea2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049085, "uuid": "bf1834a4-f83c-45c7-91cc-c5143557f181", "comment": "Malware payload (RedLineStealer)", "value": "14031a40973ef9851a9e6dd2d1843b00247c32f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049085, "uuid": "e82d8886-74c3-425d-90ff-962ac795fcf2", "comment": "Malware payload (RedLineStealer)", "value": "6fde48be1a3eb710be344e6a2499b1c69a34634b951a2e529e6b145def5d26a3d1cc65f118ce718fab064897cf41992e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049085, "uuid": "5fcb5986-ec15-47c8-b43b-3fe95ea995f4", "value": "T191853323EBF49427C876177021F207A31A393CA49874916F7F96EC8A19B1781B674B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049085, "uuid": "6b20ebed-5179-4209-bada-22b5b61a139d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049085, "uuid": "0827d077-a2b8-475f-892d-ce842580382d", "value": "24576:dyHo8DR+yHRO8U4EkyicLd4nkszZZz169AHg4XHXQn9rpWwRGNRXhSYOID:4X4yxO8U4UicLC1ZZy4XgnlpxYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699049085, "uuid": "e80435fc-8715-4c98-a260-77b0afa2fe9d", "value": 1870848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699049085, "uuid": "686f3aa0-c2fb-4827-9501-0f7e28d7ec7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049085, "uuid": "26f913e3-bf5a-40c0-93b3-f7a95d6d3f5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aaee566-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699028246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028246, "uuid": "0c031b72-f430-45dd-9843-a0d396b88ce5", "comment": "Malware payload", "value": "38c79d6507011f24770636bdf71e4001", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028246, "uuid": "17fc3721-7d3d-4ea1-8a91-a0a8815d5c45", "comment": "Malware payload", "value": "23a11d00d1a3a9aacd9a41640b1e7e7fc8a0dafd2b90d108518b96227b12a8de", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028246, "uuid": "58f07e74-ce4c-4643-96c2-841bb0bbc15c", "comment": "Malware payload", "value": "ecddb2bc72ab4b895cd39126903bfadd5394c086", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028246, "uuid": "9377ff0f-3926-4313-8971-720138630594", "comment": "Malware payload", "value": "997ec7a3c00762c9e0a78e053aacd4ecb9dd37abfb8001f8f1a6575ec41bc15447b9adf6b426e32032ef056c3addc4a5", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028246, "uuid": "ecb81ee0-f740-4f28-8f97-988a4baa310c", "value": "T1EEE423DCA082EF48E1EA9013FB551D809DEE6A943331B8E5F5DF58CB980C8AA549F117", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028246, "uuid": "835b0e06-2cce-408e-b6db-a3bb2d04f503", "value": "12288:eTMv3YulZZuls8BlKNnoMV4S65USbkeVL5qPkUIFS2aNysZDm:e+39EzBlKNnlWbXMMUIFeflm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028246, "uuid": "698a5ac7-c203-4435-b7b6-8ff35dff7432", "value": 684388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028246, "uuid": "1b9641d5-810d-4fee-bbf2-696f639000c8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028246, "uuid": "cc97423a-7346-4feb-9083-3c0cbfba5100", "value": "Pedidos.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96afa1df-7a86-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1699042896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042896, "uuid": "47dcf316-4a10-486d-b127-98cd710a8ddc", "comment": "Malware payload (Amadey)", "value": "1a265bd414a47d27f77f4f05348a7793", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042896, "uuid": "43289610-8d3a-4f5f-a867-921a79afbdfc", "comment": "Malware payload (Amadey)", "value": "24720fe2a8166285e14dfb79218120bee12332bd846548169bf988da43b8310d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042896, "uuid": "2d70531e-35ca-4ffa-89a1-e8522cf36465", "comment": "Malware payload (Amadey)", "value": "93bc046f22ba5d538f1e780062df90765fe9f1e5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042896, "uuid": "57708846-7bcd-4676-bb04-eccccf8dec15", "comment": "Malware payload (Amadey)", "value": "132d3f027384873108a197c65c0440c7139b601228ac700ba859d520adff5077485578dddaa694d261ff7420d58758d6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042896, "uuid": "fe56128a-aa8f-4b6b-9766-a03be305e49b", "value": "T1D0853395EEF04216CCF66370A9FD02C327B07C619E35A36763A5671EA8B334615307BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042896, "uuid": "c65107a9-a29d-4283-900b-ce9e21dd02ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042896, "uuid": "385608ad-3f6c-4129-bfcc-d265baaa772c", "value": "49152:jtnVQWqjQT5m7VCe6aeLrtrFj1iATunT786UsB:sWXlmxxgRFpiATi86P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699042896, "uuid": "dcce3f6d-4632-4770-a2d3-fa60153a0397", "value": 1868800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699042896, "uuid": "8ea3b3f0-56b6-4cab-8961-f6d02ec4972a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042896, "uuid": "089447d1-10c5-4cdc-a87e-6ae05708a95c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8114646-7a1d-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1698997936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997936, "uuid": "232a8e1a-9ebc-41cd-88f4-63c757bbd772", "comment": "Malware payload (NanoCore)", "value": "049b3006c5921d2f2414c4ebcf063a98", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997936, "uuid": "9e6e0c76-50c8-4ea8-b825-23ec23614fd1", "comment": "Malware payload (NanoCore)", "value": "2591a9311a86e838ae87d5bc29352907d99d4c83b5c83fa5853d969b0189a94e", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997936, "uuid": "4aec4632-f6cb-42f2-b408-4a323fcb8e9e", "comment": "Malware payload (NanoCore)", "value": "ae715ead1c8c639e58e625c180142519fb710a3d", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997936, "uuid": "f83091c5-1ed7-4af8-b06c-62d738ac3d9d", "comment": "Malware payload (NanoCore)", "value": "78b5675111bef4a679fa5f1f98e79a89cf200832b194a71bd1b12e30553f06485b6e959ab5507e50756193da35c5f5ce", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997936, "uuid": "173b0d75-0555-46d6-b9bf-254cd2524a11", "value": "T190935CE2DF94161D494B27AEDC424962CDB8801E7713062AFFED078DA20795C93FEB45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997936, "uuid": "3348a15f-5270-49f4-bb43-fabe395bd8e6", "value": "1536:GtWVAKDExo0cPljwxpxzb7Zh2It+uW1wuQifXOh19iwnOFeBajpy4:0OhExXc9jwxph75t+XmXi/uLiwnseBc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997936, "uuid": "a8385565-fdfb-4e71-91de-016b62b01f24", "value": 90711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997936, "uuid": "bd95d96a-144a-46d6-805c-04ce3cb261cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997936, "uuid": "9bf4e919-34a9-4d2b-9344-4c327ad4199d", "value": "UPS-49A829NDJWT\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc51409-7a6d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699031986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699031986, "uuid": "f3612919-d9c4-42c5-9b5d-01bed72c637a", "comment": "Malware payload", "value": "c93714ec7eee12e4bbc180aecf4485ec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699031986, "uuid": "0f815af2-31b5-4639-8cdd-bb6442ef7084", "comment": "Malware payload", "value": "25a8ca6283e68fb32ba64d6cac665c5f722515c6a7281add605ab67d0be5f2b3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699031986, "uuid": "5947830f-dff9-4d61-9456-c2af68cbc3d6", "comment": "Malware payload", "value": "a9d478546688abaaf0711accba6194bceef4f476", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699031986, "uuid": "88dfab47-48f4-4a87-8ddc-b86e68c7eaa5", "comment": "Malware payload", "value": "bba04ba977a7b8e32a064c171f5149fa93ea4462b648cf409ddbf3368d449b7772591791647cb1706013e81578df0a31", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699031986, "uuid": "e4a1d207-2e44-495c-a184-116b303a62d5", "value": "T15F14022B1D152CD0263C6F7761E7869CEFAB22E7418105C7765C78088F7BF11A6876B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699031986, "uuid": "6ac98e71-cfde-47d7-8866-3bc2af650923", "value": "3072:MemUT8OSAMw8zrmX6tBYUIfzvjp3RvTs95qnHnMVM37:7GAuzrE6DJIL7pBvTsenOML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699031986, "uuid": "4842b347-6719-4f8d-94a4-9182cc3a96bd", "value": 195630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699031986, "uuid": "70569011-7fa3-45f8-9fe9-0c2d329dca1b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699031986, "uuid": "5dd0d1ae-adb5-4747-9e7f-e6abdec9096e", "value": "Payment Receipt .SHTML", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9b42c7-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1699028171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028171, "uuid": "9e9289cf-594f-481c-b51f-81cd905b98f5", "comment": "Malware payload (NanoCore)", "value": "bd481241e00768de9f777efbc91354dc", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028171, "uuid": "48ae9fe3-49a3-4356-9beb-cb5cd0fe86dc", "comment": "Malware payload (NanoCore)", "value": "267cefab83c6f261c58b65cf0279bc02050a2f3dc3af7a41128cf8678af88228", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028171, "uuid": "b0b0a418-5873-4f36-afc8-f1039472ace1", "comment": "Malware payload (NanoCore)", "value": "328ae8426517080afc9bcc0057ea14ea91d03c11", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028171, "uuid": "ab6323e6-70c1-4a87-ba78-ade7374aa824", "comment": "Malware payload (NanoCore)", "value": "e3da9da7c3b2691d32c0a668dd796875c5fabf62cbcdc135600b41b5d49905b74bd257e954cbf8e4e6aeb5b131a45092", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028171, "uuid": "b1ac6537-9107-49c5-952a-6ad86f2d67dc", "value": "T1CF935DE2DB94151D4D4727AFDC4249728DB8811E3627063AFFED078EA20B85C93BE749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028171, "uuid": "8ecf69f6-1a38-40e4-8a76-0f0c76a0b49d", "value": "1536:AtWVGKD6xydcPljwQhZrbLZUIIf+yWowAQ85XJp1LLiwcOFeBUjpy4:aOz6xoc9jwQhBLKf+71F8tJp1Liwcseo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028171, "uuid": "950fd193-e979-4db7-bbee-afc329fb46ef", "value": 90697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028171, "uuid": "b1b9b599-6425-446b-a68d-a2709433eeb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028171, "uuid": "0b472ba8-1480-4975-b765-5c7e45915500", "value": "Attachment-3_RFQ10004\u00b7pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdec987d-7a1a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698996603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996603, "uuid": "8ddf7034-27e4-4f71-a054-1bb5ec6e8911", "comment": "Malware payload", "value": "c52a9dc4f2358835ba94e761b5f04a35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996603, "uuid": "d2b1403d-7ee8-4bed-bb2b-b6936bd64f68", "comment": "Malware payload", "value": "27b8640f0543b6f188357421f73e9918f6a38f5fc6159cd2466fa448a32f424d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996603, "uuid": "38387a70-5aae-47a9-82a4-65130f19408a", "comment": "Malware payload", "value": "83fdfca9e93b7924e145e933bb8e2fa74ee51834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996603, "uuid": "5bc3c947-bfa5-4343-a26a-ce8784e672bf", "comment": "Malware payload", "value": "46145c90e9c688f8d7719f1f24475b8ba249930c4e9078a51f2687e4c5496d9ffbcbc132adeb17899aefe0accff177f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996603, "uuid": "1886ad1d-f32a-43a0-82fd-72ca9ca40bc0", "value": "T1A37438043F4A4653D19E677B80991144A3B0DC2AAB8FEB4F9C4233F92877352FA4A757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996603, "uuid": "fc656253-75ea-43d9-984b-a5f8231fe735", "value": "6144:sRgc2lOrSZPpLhWTZ+UVsjAMcwTv0PzWUl+IR6uq5O8XCktUSGo5kVH/c/dUt:ggUVsjYwT0LWUl+IR6uq5O8XJxGoafcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996603, "uuid": "165baf3d-06cf-4a36-a85e-a9973c9ec3e5", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996603, "uuid": "b7732ccc-1867-4f26-bfa5-414dbf7cfc45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996603, "uuid": "531ad8e5-af4b-4c98-bb06-1b090c1fba35", "value": "MPS202310038742916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611276fa-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996850, "uuid": "4ed246d1-dfbe-4b9b-81f9-e6b7df4be4c6", "comment": "Malware payload (GuLoader)", "value": "4f4f68ef8d8e4435618b6195b0a236f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996850, "uuid": "70353b2d-6bed-4a5b-aeb7-ea750cd650c0", "comment": "Malware payload (GuLoader)", "value": "27f598db14b0b24b388c48d2856045bdd2675e3bb82db4c91046bc04de6ef094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996850, "uuid": "e272a41c-146a-4e8b-8ed7-0f084e0ea4b9", "comment": "Malware payload (GuLoader)", "value": "f31fee2bf828fb0519f00dcfb9022488024324b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996850, "uuid": "0f067984-1c12-4c05-9b78-c8dde6091a56", "comment": "Malware payload (GuLoader)", "value": "e81dc86a2fc0ab0a471194e6adf81b240c7b426091e2cfb45ee57eea095023026190685ddf292dfe9a536a5b8bc11dd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996850, "uuid": "4a5f91ab-622e-40c5-a588-2b03e5eabad0", "value": "T1B3F4120236A0D827C41E05778CBBE9FD6FBAAD5E6DD4028B3395732E3877661B94D204", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996850, "uuid": "bb7556fb-89db-4bd8-a03d-d00d7fb642c9", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996850, "uuid": "08880f99-1969-4666-8658-4283760a7d87", "value": "12288:M0f2JEhxoH9msJG9IfoyyAnHEypIF9C7rw6z5FKweXtTYVNPvwfj9HBrRYzzpTz:M0foEhxjf9IgsEXFYo6zfg9T2PoftxGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996850, "uuid": "a0ca2449-daac-469b-b2d2-655ece99eae6", "value": 745505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996850, "uuid": "ae0ff291-0003-422d-9b00-ed4259585768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996850, "uuid": "762d5431-6e2e-4bf7-a8b1-6a834d782dc4", "value": "Orden de compra 49545.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72634d8b-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998168, "uuid": "30131dcf-0f9b-4cdb-9392-c5db7fd8cc1a", "comment": "Malware payload", "value": "b0fd66144027542afaa5e18fcff76432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998168, "uuid": "5a254aed-c010-4305-bbe4-21c3711f97d5", "comment": "Malware payload", "value": "289d85835f3f245866719c64904328c214fd908ada830fb7201a23a54d1607e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998168, "uuid": "500c7cc3-9197-458e-80be-ad03ae3cebab", "comment": "Malware payload", "value": "e5dc365fc3ec4bd3c7477ad7cab7eb41a32e1470", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998168, "uuid": "796056dd-8e2b-4381-835a-adec181870c3", "comment": "Malware payload", "value": "4f2a92c110887a3c661aabcca1da1e89e67d9dd98c28bdcd83ec56fb316bbbfdf7a8867e668e2d606fbb9997179c9b11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998168, "uuid": "0c89b702-82e8-460f-a71a-ffa7c8707135", "value": "T1BE043A0FB7AA85B2D1420B3AC69B522403B4DB92B763C34B754D33561F127FBB92524B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998168, "uuid": "24ddfeda-ee9a-4eb8-8c2a-e4aa84f75f24", "value": "3072:FA9C48YIyaKIgjSfVpu/Xzn9I8amefhAP8t2LHqYX7:FAYyawjSf7mXzn9lAAEGqYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998168, "uuid": "7a16605a-3182-44fe-9149-4c2c09762308", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998168, "uuid": "92ea903c-da59-4a79-855d-13043ecb4978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998168, "uuid": "d5a325c4-7ad4-48bc-9ec2-c03ea85bb3a3", "value": "Gqriesvfi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7792be81-79fb-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698983144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983144, "uuid": "ef66134c-01fb-41af-8136-bddf5fdc31e0", "comment": "Malware payload (Mirai)", "value": "a02222399723652f9dbc18f3c4fe9167", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983144, "uuid": "9b67b237-e2fd-4125-89cb-d3d6d556f9ac", "comment": "Malware payload (Mirai)", "value": "29071bfcff5714523feffefacfa2a1366d3dbfd217158899c1246dbbe0346a6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983144, "uuid": "dbd2e783-6803-4f41-a4cd-a4817da2b6f5", "comment": "Malware payload (Mirai)", "value": "fa8eb013ee92fb2b81020dc08155d46599f7ac7d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983144, "uuid": "18287da8-baf6-4c93-94d3-a875ac05d15d", "comment": "Malware payload (Mirai)", "value": "8a33e6dd315309c75b42f4646ec8700a42e5602d010f92ae63ad023377a15de21bf14785698a800d1313dfbd594ac26a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983144, "uuid": "cf305e45-b11a-4c54-89d8-64dba2d19feb", "value": "T18483C50A3E31AF7DFFA8C73547B78A219A4823922AD0C585D1ACE9015E7434D741FBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983144, "uuid": "564bf58f-a1fa-4bb9-b985-535ed4e57ff4", "value": "1536:esBXDnOdlCiQd1JW2kx6zrDV7z0Zw51UiymCBhdUqmo9Iw8PlROlC:ZDnclC5Bd0ZwUiym8Uqm+IwF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698983144, "uuid": "23a65ef3-bf7e-4573-a203-5ffc66ea097a", "value": 81592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698983144, "uuid": "706de4af-b39b-4c2e-8d1c-908fc9f80255", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983144, "uuid": "67904ec3-03af-4ff9-b5a8-5fe1cbbd4629", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259e3746-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981289, "uuid": "62791d9f-085b-4284-82af-cfb749b45483", "comment": "Malware payload", "value": "1d7f9e0b9b337300bfbdda639caf4f4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981289, "uuid": "a73f8d24-f0aa-49bc-a1ac-cca20306f271", "comment": "Malware payload", "value": "298ad80135f3eced3e915a8077eb4c0bbed8ff2f59365edd6f35de10a3a2368a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981289, "uuid": "4c135062-d78a-4c9c-aef0-7bae0c27f6c0", "comment": "Malware payload", "value": "a24e27069f285fe1d8da2fac05415aae1502d56e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981289, "uuid": "e84d28ef-f198-4978-9374-e78d0841ee39", "comment": "Malware payload", "value": "ef8a00528b426f2c49cb61e3e026e9943cab035cf7062f61803ef5910a64101a9224dc016079c9a05a5a7b1e7302b559", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981289, "uuid": "c76e7670-55d1-4e83-a514-7ad2a43a77aa", "value": "T1F4641F977B81A4A2E44B19F275AFC9BC31598EA0EE874D097D8DBE3E477B004098C45F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981289, "uuid": "b8d26ca1-58ec-409e-8bb3-f5fd37e8b192", "value": "b0cf5b2a5a62c2b50f185a74e0aea542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981289, "uuid": "7cb23546-ee95-48ea-aede-371536bfcc16", "value": "3072:+JfcFQaP7OYJb7lVm5JLlZ07hwurB/kp/Huvk2SJAh/Ivp:+4QtCjmMprs/O5SJwgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981289, "uuid": "1fc792bb-9ddb-4b3e-8913-03551e9375e4", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981289, "uuid": "97da1ff4-7e71-4767-af44-fff26fb173f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981289, "uuid": "1311642a-6339-443e-97a2-ed12707431f1", "value": "SecuriteInfo.com.Trojan.Click.12648.17855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eaae10f-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981277, "uuid": "cfd9c355-31fc-4d03-9ea6-8a8ef3212b3f", "comment": "Malware payload", "value": "d9439578de4681f164345d981ca6b4eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981277, "uuid": "cdb39187-6600-4fcc-a5dd-e3c21951bbb1", "comment": "Malware payload", "value": "29ebf2e349c0e2ccad6ddc5ca2a5255e42e3ac438d859c7ab26eff6a7bf5eeff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981277, "uuid": "d6254161-2258-4523-b169-d27462485666", "comment": "Malware payload", "value": "e4bb1007009b9fd42529e2f0c63d923ca603c8ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981277, "uuid": "ae7af505-9a51-4d19-ba28-93e61fd13795", "comment": "Malware payload", "value": "db8d3c7df1e2f4f56596b3789ac47635a8c0458ba6d079f983e89ad4a480fc08b4e63998c4e2db660592953305476789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981277, "uuid": "3c9bc51e-a094-45b7-84bb-12defb358d4e", "value": "T1EC057C17B6F380DAD3611A73CCAA2736AF7BE7950B55CEC35244CA284A321B15C3A375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981277, "uuid": "8010d9c5-fac7-416d-8722-e94591956b8e", "value": "12288:DqQ0D1JV+TOwh9PtPtUvzAQ/VOPSprt91nT2mXOU:Dqz1j+awh9PtgOPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981277, "uuid": "c31cf8e1-9d62-4335-865a-dd515d945486", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981277, "uuid": "2cba2254-f265-4798-bee5-a1137bf6044a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981277, "uuid": "9b318b8c-d97b-4218-aca6-53a8a4cbda78", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1S437JY.10066.3700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51b6769-7a1d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698997931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997931, "uuid": "705c3626-41cf-4951-9a06-96803d9ffd5e", "comment": "Malware payload", "value": "7ef701b1933e5ece235066dc26d41eb3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997931, "uuid": "012d792e-a992-47c6-8432-ae66942791df", "comment": "Malware payload", "value": "2a3ae96a2ec5fb7fbd6cad61a7c080c2df87d23bc72a9fbd627f67c2af489b66", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997931, "uuid": "987a3ece-8333-419e-96b8-1c829ba661ba", "comment": "Malware payload", "value": "1643d8643ae0b6f8915d42efbf24303a4252b294", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997931, "uuid": "042a14a0-17bb-4d56-b958-932897b60f76", "comment": "Malware payload", "value": "c96b81ded540d9b40eb5767d830dcf87a4040c1850b86d8dc781e38352b6bbd5d4568813a371546eef3c9a4b0e0cd848", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997931, "uuid": "bcd18068-99f2-4b9b-86d4-9717fa24cce6", "value": "T19E123209381A6C5AF86325A270BA7CCF0475F3A942D8587125ACF5BBEC2CADC35708C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997931, "uuid": "b4001a8e-eb21-44c9-88b7-69ea0bd87f12", "value": "96:NFhYhrkpF4ctlTlM8knaje4xDNpF8aM8EzhelvsNSOeu975EpdKNA38dao/6C:LbjTik64xDNQxgvsNSOe87Gp4NA3OFiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997931, "uuid": "d7214073-ff71-43d8-920a-2a3132fae87c", "value": 9859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997931, "uuid": "dccdbcba-6532-432f-afaa-252394ec2c70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997931, "uuid": "a3bf14ee-9d94-4f26-83c9-8439304d839d", "value": "banezhteb.com Secure Email Setup(pop3).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c0c1e4-7a4a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699016994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016994, "uuid": "937bdd99-9ad2-4401-99e7-5b0db375ff01", "comment": "Malware payload (AgentTesla)", "value": "fad205e206bc81d9a92a897e9fdf5b4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016994, "uuid": "95ce8652-8b5a-4f83-84e2-c7c784f7a917", "comment": "Malware payload (AgentTesla)", "value": "2af98f9f107a9fbea618d9f65a9b12aa08726ac6956a6c39cf5afbaa0bb1f6fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016994, "uuid": "2801f785-61b5-4011-802c-be6686322a4b", "comment": "Malware payload (AgentTesla)", "value": "e97779ffb45e7276d3dd72237085d6827d084588", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016994, "uuid": "6faa08ea-de25-43b7-9b94-d0228d2efeb8", "comment": "Malware payload (AgentTesla)", "value": "49958bb01970ebc271ea36b6d04e0311d90eabd1f2d23e2ef05a407a93f6c1402ff57f95faf95f856c0801b0a028f8bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016994, "uuid": "4e72fab9-3e1d-4e6b-a023-f52e9462cd6e", "value": "T176C22817BBA7C120C1596A76CCA6121403B4C7827A67DB1B388C232D8F537DF1B9BAD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016994, "uuid": "fce2221f-891a-44c2-a3ee-1262f0937d78", "value": "384:+KTQqNGQ8z/Sh4ZHMjjjjjjIIjjjjjjjL+zQT+Iun0pGhf9vwEG9/XwJwq6uJfqM:3tNY/ShiHeT+j0AC2GLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699016994, "uuid": "e4bdd138-c910-4972-be9f-e30e448c4e49", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699016994, "uuid": "4cc1f1f1-03c4-4143-a5d0-4eb2fca3a53f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016994, "uuid": "e657fa61-6252-482c-8dca-649513380e64", "value": "2af98f9f107a9fbea618d9f65a9b12aa08726ac6956a6c39cf5afbaa0bb1f6fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a35812-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981253, "uuid": "a7d9a799-7336-4fb0-9a5b-a9aeaced6fc7", "comment": "Malware payload", "value": "8c391c277dbb175ac64bb784e821decb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981253, "uuid": "8f69e9d9-1d4d-4437-aa11-d58387e15c1f", "comment": "Malware payload", "value": "2d21f467a3c591d95b451bed89de30813990ceb70e1081f22d46d8c68355d0a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981253, "uuid": "dc0aaebe-a128-4e32-a073-0aa188db1e0e", "comment": "Malware payload", "value": "0084d5378d63d55371f79eb3db11fd43f6eb36e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981253, "uuid": "5d05ab06-179e-4a9d-a5ac-fb47f9f78d0d", "comment": "Malware payload", "value": "7c711f60811a312b354df7552806d13dff1fd174768f91bbbe0bb96d339e15ef207f104f7b3d95bd63a28315e6af5821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981253, "uuid": "aa1c35ed-0a27-45c9-a78d-f597e383f1c7", "value": "T104557CAFF5C24B84C3C62A7028F61779BDE455864A3ECDCB2AD8DD696C33530862F191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981253, "uuid": "70c12057-6376-4385-9d19-a5525aef5ba6", "value": "12288:Im0yk1YYPCk9PxAIAaKUzZ0DSHElKh0ygP69bGNOjt9T3FZT2cwpT:Im0ymCwPKzavaDSttbGNKjKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981253, "uuid": "b4f100a3-0e78-43c9-abec-7e8312374d22", "value": 1359872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981253, "uuid": "c39cc507-5982-4345-afca-7285393a31ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981253, "uuid": "2713cd67-4314-40cb-a975-69cff9bb5541", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1FX883P.32280.27724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7414e64a-7a25-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699001177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001177, "uuid": "cd2d9559-725f-4c72-96b1-cabd5dddeb35", "comment": "Malware payload (AgentTesla)", "value": "4ef3d6fc7ad802ff545ced3b54432715", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001177, "uuid": "2582bdba-3731-42c7-a43b-072bfa33b186", "comment": "Malware payload (AgentTesla)", "value": "2d5033463b7a9dd0efc32ccf56ba05d592a9921b8c956e4787e7479db26cc71f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001177, "uuid": "7a254abc-950c-4482-9f6d-cb88e12e16b3", "comment": "Malware payload (AgentTesla)", "value": "2ec0c7b9f96470969e2c11e6a97c392dce336939", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001177, "uuid": "8bcf8c16-8edb-49d3-9295-0345161fdbe0", "comment": "Malware payload (AgentTesla)", "value": "981151ef1ca0d6cdf5f4cc3906c1a51cb8013d0b846186d341377fc0434315a714265c131029896809688ce91745437b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001177, "uuid": "1f183a87-2fc2-495c-8ae5-f83b8420f726", "value": "T1ECB3D01DF214F855C663987E88CDD0D762093C669E46E30F3094BB1E1E7A6C3479BA8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001177, "uuid": "11922797-6634-4d69-9466-beb0aa7cdf6b", "value": "3072:zXI84FN/Kt01dvjT/I8b7c28Gs+fHtI6dHC:zXGFNhnNc28KNIcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699001177, "uuid": "8fdc9375-ea77-40b1-9e9e-8bad18f3494e", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699001177, "uuid": "cec56ea2-4854-4162-81ea-a2c8f79673ff", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001177, "uuid": "2e1a8e61-9c2a-4d19-a910-29a53fa845da", "value": "revised_quotation_for_purchase_invoice_order_3rd_november_2023.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34a20e1-7a45-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699015027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015027, "uuid": "7a102eb8-3a39-430f-b6ac-64c5a5811df9", "comment": "Malware payload (IRATA)", "value": "838cf94bdba88536e077f1e1ed692e96", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015027, "uuid": "ab90e70c-2ae5-4ff1-8bdc-c8e3a6244066", "comment": "Malware payload (IRATA)", "value": "30b8de60ac3938874260f31610c463b790c356c7958a1392ffc8442c4c5eb787", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015027, "uuid": "04033c27-55e0-4b6e-b630-17ae604aefa9", "comment": "Malware payload (IRATA)", "value": "d81d1ee092b53d4b6be34c77549d19b7f79ce226", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015027, "uuid": "957fce5e-8f06-4ed2-bd00-2bca52da4274", "comment": "Malware payload (IRATA)", "value": "384153cf5121402536e741eeb21233db207bd355f300b28a7be26872c62109cd4b341ae01da6e531274667eb62b45ed1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015027, "uuid": "f8c28e76-63b1-442c-b16c-22d01c9318d1", "value": "T15EF5AD97F395A86BC4F39372817513A5428B4C228F83DBC76D24767C29BB9C41E49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015027, "uuid": "7e454b70-8bf3-47e8-8182-94befb7b1b1c", "value": "49152:xO34HnRM11HxgDgLCr8MF16Hm13PJTSYWkPM8NS5FrBbxhYZFFi:xO34hgLCr8MeHK3PgYWkPM7Fr5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699015027, "uuid": "ea548820-ac24-4c8f-ac31-5458aebc85a1", "value": 3518845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699015027, "uuid": "c32e4a59-886d-4aad-ab4f-cbc61418711f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015027, "uuid": "6de9dd86-7456-43a5-be48-210a08c6211a", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf0ff36-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998400, "uuid": "ff87ae30-2d88-40f0-acf2-4d8d967bf86f", "comment": "Malware payload (Formbook)", "value": "64e25a4134d33448d33c5d0d250394d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998400, "uuid": "f6f88b79-d0bf-4e13-bab8-3e83c6079e7d", "comment": "Malware payload (Formbook)", "value": "321409ee266700ca2cac296c34e8c77358c43503b2376df20a613445ef5b23af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998400, "uuid": "d84b0604-2e0c-41fe-beba-83313fb78a46", "comment": "Malware payload (Formbook)", "value": "1bb06491beaf2be78243a399c21f79003459afbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998400, "uuid": "a3c66a5b-88da-4cae-9641-ecfe47b9bb43", "comment": "Malware payload (Formbook)", "value": "c7c04266cdceb6f6d4dd39dd3405aadeaa3c035b979d85d84462ba8429192f6b7f1bf6b2abc8bd30c1cd34fac219548d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998400, "uuid": "470689ad-e148-4958-86d6-fc9261c7ac42", "value": "T1AEC423177B5A1F32DC71D3FA0650BA81437E63161062FEED0ECD70DEA90BB914269A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998400, "uuid": "c9715f56-a017-4067-8c71-7ed33543749d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998400, "uuid": "3c50b185-1e97-4bcc-a39c-6f8dbf586e63", "value": "12288:WIki4yrkLyfxKrqdQhj7D80RSSj2v56/Ctg5/sXRD5NAw:WIkfyrfhdy7g0RSSl20/sJPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998400, "uuid": "4453e704-e7f9-4aac-9707-e861717b723c", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998400, "uuid": "0da97cfa-fb37-4041-9a13-99caa4774ffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998400, "uuid": "f5f0f17a-a8dd-4074-800f-83b341ab5f61", "value": "64e25a4134d33448d33c5d0d250394d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462c172f-7a51-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699019998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699019998, "uuid": "5e3e955e-e66b-4fc5-84a6-ad42b136faba", "comment": "Malware payload (IRATA)", "value": "7c9deff98c4937a44c54ecfad0a82237", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699019998, "uuid": "e57aa88e-c9ea-4f38-a42f-b89948f33481", "comment": "Malware payload (IRATA)", "value": "3291b69c2e299bdfcba2e337f5a04d60dc63ddcf171e469f1848f76e20358d24", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699019998, "uuid": "135f6420-c0bd-4f3f-8c68-e48a362aa5a4", "comment": "Malware payload (IRATA)", "value": "79451de1c474b7b098e38a901c77874622516c40", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699019998, "uuid": "ec585ac9-31ea-4465-bc6a-3f3c28757af6", "comment": "Malware payload (IRATA)", "value": "c8826c378a9403d4263a5859dec8450ced366b449805e863990cffe9b1a3ed9218b09858484f7884b6f25c0ac59a8e56", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699019998, "uuid": "8f1c0c9e-ec5f-4f42-87d5-cf1cd333ee19", "value": "T192851243F37AB827C832D1322096173562165D25C943FB4AB98837FA64BBDEC4BC46E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699019998, "uuid": "3679e11b-d346-4ee4-835e-52a4cf87196f", "value": "49152:IsFkk6EXL/K/w8FEXxs75YZyYlELuUWd40EGqTcFYa:PkkBX7K/w8N75oyYlsuUWd40xma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699019998, "uuid": "72603d45-d91f-4825-b9d9-5b4d0728fdac", "value": 1776691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699019998, "uuid": "2bb4fbcb-e94d-4186-a632-0005ab1e66e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699019998, "uuid": "017bedf3-c760-4103-8588-d4a57173904c", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9b4d28-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698997109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997109, "uuid": "8d5a0048-b265-4b8e-b204-f939fc76be57", "comment": "Malware payload", "value": "0b85199c4e1f974028b889ee9c0c5b75", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997109, "uuid": "ba81240c-5edf-4fbf-9f48-4b8a16172298", "comment": "Malware payload", "value": "32d11c8f56a0f2951a8180d5b92b50da0c009ecc55495a839f46114ebcda11fa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997109, "uuid": "60aa2d93-2914-4755-89db-02b0decd8254", "comment": "Malware payload", "value": "c6086181466987a7c25b8590f2ec47ecd6a94914", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997109, "uuid": "d86c2b08-f1a1-4675-aad1-3335bc5566c7", "comment": "Malware payload", "value": "962a9c417d3207c63829c65685e138e0e7465292b537c14f90e18b9c80d03ae368b6cb30edbf0d64c571b31f64f69eec", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997109, "uuid": "eef1afb5-ee38-4b86-8df8-f9b8828795be", "value": "T10E04222FFB798A24E154E2300E5145D700A6BF80EBA956C9B2EF7E7424B867437117CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997109, "uuid": "a18ef8b0-ce22-4af8-bc2b-e4814c1e1f9e", "value": "3072:iD1an9jvm+oZPnYN2qRV6uOo3Hyr2UsdKMc8OzIvTEB6K8o39HyDEr5DyGCoivf:ibCAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997109, "uuid": "51260b2b-c1e5-45ad-a247-4dbb69f0bc89", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997109, "uuid": "43b34c95-cec4-44d1-bc40-12d14222467f", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997109, "uuid": "21776f56-afa7-4907-9632-84315c3dbffd", "value": "1 \u0434\u043e\u0433\u043e\u0432\u043e\u0440 \u0410\u0432\u0442\u043e\u0440\u0441\u043a\u0438\u0439.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3cd2342-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996989, "uuid": "2234d7d7-2ccc-41ee-bd22-58bb4860fe64", "comment": "Malware payload (GuLoader)", "value": "b08fbec4930798b82201c6727e621add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996989, "uuid": "70704e63-7eb2-467a-8265-1e0a2aa67676", "comment": "Malware payload (GuLoader)", "value": "3319b38427c53146b5434e748b7d65942f8aa2b0f97938699c1ff6bc20b114c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996989, "uuid": "984d165e-9cc2-4137-9118-5a802b64279d", "comment": "Malware payload (GuLoader)", "value": "9e2f2f7fc27cda8b862354070aaa17c3202c7d98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996989, "uuid": "e1cd9960-00bd-4d7f-a447-44beffd76357", "comment": "Malware payload (GuLoader)", "value": "4dd7c86799ddbd1ec2e239bf0034e5855b9713b4c213d2f713d1f6e2cdce428a553dea8892c6ae68b73c1197b89da4b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996989, "uuid": "b1d443c8-9cce-44e1-8f13-b19db44edc69", "value": "T1FB8502A2177442BFE0365A78B027F66BF1816CA6879E1386EF87FA5D0F73C06914141E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996989, "uuid": "7aee558a-739d-4906-a9cb-b80a4249d76d", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996989, "uuid": "96ec32e7-ee8d-4677-bd8c-0665de606cb6", "value": "49152:r0ER8cGD1XnSUtIVyUdweNhWf2/Lc3fk62miin0lN:r0EUzt8dvWu7cnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996989, "uuid": "b0a3e5f4-fc69-4d10-9a57-f2936d800d89", "value": 1848073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996989, "uuid": "9844a2c2-6aa4-4ea7-8584-6b2d24bf002e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996989, "uuid": "11721cf9-1be9-4dd3-a67e-d8b24dae0bee", "value": "564923591_2023-10-02-08.49.23.010743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f331b9-79fb-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698983136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983136, "uuid": "45f25b7c-84ef-4f87-81e1-a17e39596957", "comment": "Malware payload (Mirai)", "value": "bda3004a1ba216e324de15b83daefece", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983136, "uuid": "d3815894-8085-4482-ba42-ce885cd528d1", "comment": "Malware payload (Mirai)", "value": "33fe9edbf8f4f3a6a7dc7284be3410230338a78c7f8f6e31dc052dcaafdd505d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983136, "uuid": "dbf9eb3a-63cf-4e5e-9748-21b0dac8f8a3", "comment": "Malware payload (Mirai)", "value": "b84fa914e9b4630ce9495cd4c53c8fbf0d146800", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983136, "uuid": "c7402a9b-207b-4f12-b1b6-eeb0674cdb5c", "comment": "Malware payload (Mirai)", "value": "440c1edc4a20d4014bec58c49a0be3cec7f51b667b44ecfdf0f34e3aacbea02462288abf12daae5f48e6fcfe1c70c2a1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983136, "uuid": "c23f00f1-6992-4b0c-9e7f-6e8a6dc23501", "value": "T14773E946B891CA56C5D553BBFA1E12CD331327A8E2DF7213DE106F147B8A82F0A3B951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983136, "uuid": "44733ca6-55cc-4e3c-83b1-8d9ee87d34fd", "value": "1536:J9nU8xMt+vlTLqifne+lqTq7lYowOlci70W3kMqiM60bAYqw8PlR:lEqT9ne+lqW72Ol+60bAYqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698983136, "uuid": "3606378f-b3cd-44df-94c2-d7e6f5bb38b4", "value": 74924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698983136, "uuid": "5cae285f-7c28-4961-a8c4-15ebd29b1b75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983136, "uuid": "5417c767-282b-4755-8126-3d1cacd4bdca", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0022b95c-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699054670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054670, "uuid": "a84dec75-8f35-41bc-afd1-b83b22d761df", "comment": "Malware payload (Mirai)", "value": "8224dcab983707ab95fb7f386f650729", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054670, "uuid": "9c29c4ee-a194-4f91-8467-42092838a894", "comment": "Malware payload (Mirai)", "value": "341b969bcf08350ebf1d6d58cbcd6073aeb01984b87e2068cc7237ea0dbabae4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054670, "uuid": "39775fc3-3cae-4da8-b6c7-8f6bbc9dea92", "comment": "Malware payload (Mirai)", "value": "fd6d903151478dfd5e07c1502c47fe4e2894d38f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054670, "uuid": "83d489dd-b484-4bdd-8681-df816303d2e7", "comment": "Malware payload (Mirai)", "value": "ef9055339b0f34563e0975f04cc4e13da0650c8e386ca881c1569b67c21f094619569e7a41d5b0048f63152f3dc655c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054670, "uuid": "ba0675f1-c282-4d76-ae53-b0f597f3f8d7", "value": "T107F35B86EB409A13C4C61776FAAF014D3322E795E3DB33068D185FB43F86A5E4E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054670, "uuid": "7e6ba570-94d4-4836-8c08-0ed14c3582cd", "value": "3072:8hBH+VbboySNhxPqtzktJqV7lAEVFApIUWG+oJM/9ipRVVV:O8VbFSNheGJqV7lAEF3G+CM/9uRnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054670, "uuid": "5e676500-b6a9-40b2-a5c7-b197dd4e26e8", "value": 167023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054670, "uuid": "78eecd9c-8517-4489-9853-1f468d36d81e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054670, "uuid": "f2fc4b39-3851-4f85-bd1c-2da01d1d911d", "value": "8224dcab983707ab95fb7f386f650729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9436cf09-7a53-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699020988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020988, "uuid": "f70452b9-4524-4c75-b1bc-ff0fa68993ac", "comment": "Malware payload", "value": "59ad14059c59289e1e80520ac05d3ae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020988, "uuid": "61031a5a-6aaf-4261-844c-9fcfe008a3e1", "comment": "Malware payload", "value": "3479fcdd129e1ba2e85c4bb20a0d5dbbea099a16433a00adefb56bd7c1c00118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020988, "uuid": "7e7a3e60-fbd1-4486-9e15-fe2352b021d0", "comment": "Malware payload", "value": "cd9eba108e05a7c91e86d269e27cc4e2bdd023c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020988, "uuid": "41e34a47-f69f-4fd2-b520-84de0165be1d", "comment": "Malware payload", "value": "4b6f87da7f998c13648d02217e0032e69eb584cc86b5cfe1be01cbe7252c1d9e0d76563a792d3144f8a96b2e9e703206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020988, "uuid": "c7d3b0ee-a4d8-47fc-9147-8d34f623e564", "value": "T18F355A899F4ADA13CD504231D456C6F72A09DE9FD602D3735BEDADB3308738867882E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020988, "uuid": "87c156e8-1757-41eb-92e2-d09473230779", "value": "12288:cz9RQ0x7ycp766M+Sk4ctHfaivikRslbEZW8Jk47DHFlS5krVOnpznA3kJ/gAmH+:czL9Mn2HfaP6waDllLopDAOmHg9e50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699020988, "uuid": "c4cde562-02c5-45e6-b7c3-519999c3f254", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699020988, "uuid": "de745a64-6adc-4d3f-b9bc-4e42fdd0bc3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020988, "uuid": "67b82f80-9f3e-45c5-96b3-6e341d8993cf", "value": "SecuriteInfo.com.MSIL.Kryptik.BMG.tr.30925.17889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34b1041-7a96-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699049843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049843, "uuid": "6c1787f1-441b-4d9a-b5bd-096d9e1fbacd", "comment": "Malware payload", "value": "4af2f7b8c7ca55e8c01d1b8287c1f2cd", "object_relation": "md5", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049843, "uuid": "a33889ac-f834-4942-b14c-2f6db3c814f8", "comment": "Malware payload", "value": "3522dc6099d020d55229f0431908297d0a1961d2c30bb584cc530b1ae1b72e5c", "object_relation": "sha256", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049843, "uuid": "d5e3bfe1-1b04-435f-b786-bd0efbba4e89", "comment": "Malware payload", "value": "2c478d492370676b6f587b5f72ec8fda64bee40f", "object_relation": "sha1", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049843, "uuid": "bd16e8fa-791f-4266-a238-8c98ae2044a4", "comment": "Malware payload", "value": "cff0ad0cc517c665fbbeb4b71a9690a32b581f5fb11f9df30e0e28a4e5560f6ebdb49672a97408dfc02de9eb152a3f47", "object_relation": "sha3-384", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049843, "uuid": "ab160a30-e8d7-4308-b0e2-71f78279c61c", "value": "T155169E237681753AC05B0B3A5537A671893EBF91BA12CD57A7F4384C9F31680793A38B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049843, "uuid": "e66ee955-79d9-43f3-9ab3-ba155fc4b04f", "value": "49152:2isfnzE2NCnMCb918EzI+n+RcwPIW5+S6SWvONKVwbcst:inJNoMCb91LBn+RceYmbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699049843, "uuid": "4a385fb6-3c1c-428f-9fd3-f6f1126e7dc5", "value": 4157944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699049843, "uuid": "dc968800-f5e5-4c2a-83d8-043ceef7f6de", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049843, "uuid": "1c23afda-5f55-436b-afff-5179ba2a10dc", "value": "DB7F8.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e45521c-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698998027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998027, "uuid": "fca40f39-db68-45fe-b8d8-c999199d579e", "comment": "Malware payload (AgentTesla)", "value": "de51940d1c9f9c34b2c5612938fc6a9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998027, "uuid": "062f20f4-eba1-44d3-a8ed-ef3541d3efa8", "comment": "Malware payload (AgentTesla)", "value": "353e4ce2d80b1574912e9bd1a89a204008e327038126a08e812c999aaebaf386", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998027, "uuid": "3bf84621-0f33-4b9d-ae20-468e9dfb63e9", "comment": "Malware payload (AgentTesla)", "value": "bb0b49f8322d5667b0d0c172e32915f16da777a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998027, "uuid": "2c173085-1bfd-402c-af0e-ae2668d51273", "comment": "Malware payload (AgentTesla)", "value": "1576c9d16a298fc7b001f5c59d84a9981a14111701bb2beaf5389532b38626903e6311a5948a0e2d5b2c4af07c59f1fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998027, "uuid": "39bfb8ca-e85b-4bf1-9210-1787c1e102ea", "value": "T13EE4E004B2FB1B67E97AA3FA405675404BB569AF75BDE20A4EC360CE11A5F110EC4F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998027, "uuid": "82570658-06fb-47e3-b61f-1d597ac350f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998027, "uuid": "46af4e0a-c2f9-41db-a666-84816a6fa67e", "value": "12288:QreHdggT6CLd+SZpaUueWVjPLsPbra5YwaKIIxHZjax3ZmjEg8TgInXzDR19:QreHdgINUwaUuFV8PFwa1P34x8McXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998027, "uuid": "390d3337-c863-4dae-a5d8-ecad9afaa99f", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998027, "uuid": "535fafc8-d252-46e7-88e8-55eedc52a03c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998027, "uuid": "004b8489-2c78-4c56-aa7f-76d8d04b0cd4", "value": "DHL express Ref 6853148094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46172ab1-7a41-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699013126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013126, "uuid": "890fe988-612d-4ed5-b90d-88acc7c3d998", "comment": "Malware payload", "value": "e8f09e8ee4dab73496431a9ce0085220", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013126, "uuid": "7b6f40ba-cb3c-4d1f-84e6-dab53cb963b7", "comment": "Malware payload", "value": "35fbbdd5e9f4eb79bf3d21c19a558633b07e89d20760c30aacdbf350fc7d6b13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013126, "uuid": "bd927130-0cfb-4e14-956d-9d142f6e9d11", "comment": "Malware payload", "value": "704676005eef56aadf1c98252940d70426de6af3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013126, "uuid": "ed3aae9d-0534-4cdf-a3b8-d375e68dbbf8", "comment": "Malware payload", "value": "cce1d11a48f08e22058eb80b20f91007368bb524ea0afa97f03e34f000ec2c6a6e4b310c9f2e99f5c265c41d614b850f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013126, "uuid": "efe82124-3aaf-4735-a01d-58c72dc2b931", "value": "T141640F03AB87E8A1E32527B7D4A6604482B0F58027EBC5067D7972F757123D5EEF128B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013126, "uuid": "648a96d0-35f9-4dab-8404-ef419ae5a6bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013126, "uuid": "a29fb56c-74ff-498e-868c-8d9f6107534e", "value": "3072:buEHfL5opeQC6CjUdD5nQXSFDXETQnrHcEs1gAcCFMkwJt:Lj8CjUp5nqS5UTNH1GbhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699013126, "uuid": "4362e418-3335-464a-9865-8fa630040414", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699013126, "uuid": "8c07f83f-7c15-4a2a-aefe-4cecc0059e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013126, "uuid": "9e374132-c9d3-4d20-a35c-3e47634805fd", "value": "35fbbdd5e9f4eb79bf3d21c19a558633b07e89d20760c30aacdbf350fc7d6b13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a2883f-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981294, "uuid": "cf8bfbf9-b5cf-4f40-874a-af7e19ece3cc", "comment": "Malware payload", "value": "eff98a79e02c1f4507a557eb952bb03c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981294, "uuid": "a4051353-5947-469e-a724-8855ecbe4669", "comment": "Malware payload", "value": "36041e279ac1f80af0e6e2ac34ecb21aa1b2cfefdef6f78962603d2b72314238", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981294, "uuid": "816272bd-fda2-490c-aea7-7214fa6d136f", "comment": "Malware payload", "value": "d5e16959cb5627317d1602de186526742d317368", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981294, "uuid": "dc0ba03a-9b23-46af-ab92-5dbd34f2f9ef", "comment": "Malware payload", "value": "acc66fc27331debfd1a4a2cec15161ae3e8874d5375b933395b26d584e676073d452adfe9defecd62f2399a5f40dc4eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981294, "uuid": "b4e02527-86c1-47e6-aecb-a437618f9d78", "value": "T167457C31F2819433C1AB5A305D1BBD6C5531BA869EE8A60A27F76F4C6F767803D21387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981294, "uuid": "a52f2f6e-973f-4501-b013-17c5ad2dc017", "value": "24576:GCgbV5DZ5LppAHy5avE7R8RrynMDVGyfNIHbYYnry:GCUxZ/lco6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981294, "uuid": "f313d599-60fb-4111-98c1-10d8bda0962f", "value": 1225728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981294, "uuid": "3e79bb49-82a7-4b34-91ce-c962903c77ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981294, "uuid": "0661e102-4bb4-496b-b745-2bda3e392b7d", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.19187.370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2fd6b4-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981296, "uuid": "3aaa6e6a-9e97-42e6-ae77-fd4c83f37b5c", "comment": "Malware payload", "value": "6332ec01eb5308defde24b886c34a839", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981296, "uuid": "458a83de-6506-4726-9be4-5a9975315fd9", "comment": "Malware payload", "value": "360ad85a3a0fa8d525d8c0cc8e12b7d0727f69ee7c9b368b7c9ec50c52bac21c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981296, "uuid": "e89036bd-5dca-47ae-bfac-b6b445725648", "comment": "Malware payload", "value": "a0ad42ce4e1df97ba826ec7f72cea5687b80bb34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981296, "uuid": "9a5ff814-b72b-4202-a194-96b9174efefe", "comment": "Malware payload", "value": "f7f324dae59fb87c6a0cca49f106869d3ace3e635e1f2e6d41a2d0f158aeee5c39c9b8b7129ddbec7f67e23f64fabfc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981296, "uuid": "711b247f-0e5a-4799-aeab-c1d64bc170f4", "value": "T1F8B5C55CBF01B89EC2A628F41B155BA225E072B31D14998FF78C9F2C2D7C5B6DB1C606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981296, "uuid": "fea1c35b-2d7b-4665-a117-131e7a462a98", "value": "2e13935cfd0c583fde7e737a6ee6c384", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981296, "uuid": "5d933bec-b5a7-4767-bd6c-f2bd26f06651", "value": "49152:kufzrsdzlqC/bAuwDgPW0AgpDUXXAHF3giDKEVpwCzcJGe+l8tAWYC3NROhel:kufzrsdzsC/bAuwDgPW0AgpDUXXYF3gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981296, "uuid": "72e3dcd0-1914-4fee-a4eb-fd9602143117", "value": 2457600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981296, "uuid": "6d75406b-e336-43bc-8039-81cf3d8c447f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981296, "uuid": "16faeed9-f204-44b5-a00c-477bf954a33b", "value": "SecuriteInfo.com.BScope.Trojan.Downloader.2019.29876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c32f22-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699032932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032932, "uuid": "cdfe8dd7-8385-453b-aeaa-c3c46b04e8b9", "comment": "Malware payload (RedLineStealer)", "value": "d5e9742ea32944bf7b147fe8bf9a8054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032932, "uuid": "6fc5a74a-b6e5-4e91-bf98-4d06c8db1ee6", "comment": "Malware payload (RedLineStealer)", "value": "37b9e74da5fe5e27aaedc25e4aac7678553b6d7d89ec4d99e8b9d0627dcbdc12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032932, "uuid": "1e613506-7b45-405c-ab14-2b0e8fb7e17e", "comment": "Malware payload (RedLineStealer)", "value": "e04fea9ed997d9ad2d73dd8ca661625d7292eb98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032932, "uuid": "a9950ce0-bf79-4eef-9c04-80b16669c824", "comment": "Malware payload (RedLineStealer)", "value": "73847ae5e2dc23be8c1d9c05581d7cd333787eefc3dc13cc6a8892907164024813c97097701da8ca7c1da2e477c80e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032932, "uuid": "0324412b-eaa7-4bdd-bcf1-705dc74a0050", "value": "T1C3752307BBE88123C8B1577199BB47930B32FD6C9D14336A3E8A115E08E71D8A87176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032932, "uuid": "831d69f7-464e-433d-8c96-03f0bddf0a57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032932, "uuid": "e4225855-58be-42b3-acb4-406c71a885f4", "value": "24576:cykE98sHFjtSf0Oo6uU46Rrx+ywzC+i+qGHWtXo4eUoYDMn+BEMZk7ctys:LEMjocOo6pr+PC/GHW/eVYkKEMCgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032932, "uuid": "0c816175-f7a3-4335-91b2-686582f2217c", "value": 1605120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032932, "uuid": "72661ced-a364-4782-9ea3-e3bbfa7ae939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032932, "uuid": "b2b016dd-b038-4f43-a5df-ef8fdd367f65", "value": "d5e9742ea32944bf7b147fe8bf9a8054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7a1524-7a34-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699007743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007743, "uuid": "801c0fb3-04ff-41d1-bbbc-7c0c702b9c69", "comment": "Malware payload (Formbook)", "value": "f48c7a1f4006735fbe94b72fe5a1a2d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007743, "uuid": "1849c672-3344-4422-bff2-0435347c654d", "comment": "Malware payload (Formbook)", "value": "38049c6c8b70728eee0ec280abd6bef7a3eecc10a0ae541bcda4b6f3312d4bc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007743, "uuid": "3a5847a4-0266-4cb6-ba8c-ca5d4474f407", "comment": "Malware payload (Formbook)", "value": "ea07025089cbfe166d1b80034c7cff0a09bb5138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007743, "uuid": "be603458-0d4a-4a94-9b52-d3a56bac7e05", "comment": "Malware payload (Formbook)", "value": "f5d34d1d43e1b1661a382a9312e6a7ded88b4e5bf71dca041ffd9c5e6d204fed21a0c0de1aaea57c3f55a27376a50c07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007743, "uuid": "e42226f9-3371-48a8-af51-85cd476681d0", "value": "T1DAC42300667EAF63E9BA93F40994658173FA6A4B4412DF875EAA34CC54E1B0207F1E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007743, "uuid": "c441694e-9597-4e6a-8d6a-70f2a0210fa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007743, "uuid": "2b509ae5-1f46-4f76-a9a3-a4391437daed", "value": "12288:YIkWiFV3y3iWOvLLdr1YPVkGiVEgMTk2QF4+Pg/FJDECr:YIkWCXWOVr1aVkZW24+PgPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699007743, "uuid": "d2e35b22-78de-4f8b-af64-a654804bde7a", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699007743, "uuid": "4a80b465-cb2e-4271-add2-f9e5a41e581a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007743, "uuid": "02011515-ce24-4d61-a14c-a0d6d991cfda", "value": "RE.Documents Purchase Order products 23100290683pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7a6d7f-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981250, "uuid": "9716fd4a-fda2-44b6-90ac-fd06e97153d4", "comment": "Malware payload", "value": "4017c6e192ef2465c9216f0e264277f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981250, "uuid": "d2f6d9cb-20e8-4ad7-910f-80fa9f65cf71", "comment": "Malware payload", "value": "38b4211d9a28a42c1ce1794ed6c6fed94784bf91547305c4aa9e646dc843b937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981250, "uuid": "4b557677-a388-48de-9e3e-8b93fb50b657", "comment": "Malware payload", "value": "e0711c898b90c5dd3166efff88d5ec6ed910f1f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981250, "uuid": "c797cac9-4deb-44e4-a7cb-cfcfd923b396", "comment": "Malware payload", "value": "5e828457f273d7e970a622d84e8fbb5d4c13cfd598f87923a9842b859c2e834d5ec7f721efeaabb981227ec0589c0396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981250, "uuid": "322adfaa-b8db-4ae1-8e59-376fe887f5e0", "value": "T19555AE46FA8380E0CA86A571057BA3365BFAB5CF0A358EDF12B8DA5C5D338505D37623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981250, "uuid": "1644efb3-190a-41f4-8e6f-84d73008fa9d", "value": "12288:MDTMzermEwsuwkPjcZkT5bXk06JLODR2XVp1ZxBtXggs9fbMhNlfO:MDTMirJuhjcyTdX4ODRwVfXg1bMhNNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981250, "uuid": "f150a122-8c51-4fb9-b1fe-b237ca44b7e8", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981250, "uuid": "1e718fda-2df5-44ea-8d74-c5403e23819b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981250, "uuid": "93720b81-4c77-46b2-8c30-62e182d8e894", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15EXSUN.25463.1993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5689ba52-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1699032910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032910, "uuid": "f92956e5-e804-4884-9240-a4f925f26480", "comment": "Malware payload (Amadey)", "value": "e538a13d55d116777c2766732b2511c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032910, "uuid": "e4b91191-c17f-4b64-980e-030766a7261c", "comment": "Malware payload (Amadey)", "value": "3982986ebc039ab0e704c819d657c2d1014109b45aa86f058c81ff04771dcb50", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032910, "uuid": "f75e006f-da57-4f11-bb0f-9c8eac6f2e19", "comment": "Malware payload (Amadey)", "value": "45feafdb23b355d9e1530b16e7c1bc819997ff3f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032910, "uuid": "659ccc93-e6b3-45ec-8329-51c84278685c", "comment": "Malware payload (Amadey)", "value": "dccf91c9e629f3caca127b8951d468d73eb47173107dd4d6404469359e8f60a8357a52c017f071fd0e51cb711459eaf4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032910, "uuid": "cb7ca5fd-ba67-4ce4-bca8-0d539c23465a", "value": "T1B6652393ABE480B3D9731B315CF742831A337EB06E34826A734195964E735C6963376E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032910, "uuid": "a99a73e2-2e8b-4a82-9ffd-a628a099b502", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032910, "uuid": "6e8a0450-7dee-4391-a49c-13e5d3be217f", "value": "24576:wyO81yRBuAsoFsmFYkQkNexHOLIwsZ8IZssi2ZrjbDMLyCDPk:3WRBPxbFYqeRuIwsZjZDZr3IDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032910, "uuid": "9bec00a3-4e6c-4c73-a88c-7a774483f65c", "value": 1468928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032910, "uuid": "a7736736-7ecd-4e29-bf29-f58aa5d308bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032910, "uuid": "bf01a15a-9dd6-4242-8f5d-c4828bd7f475", "value": "E538A13D55D116777C2766732B2511C2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c4e5d8-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1699028045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028045, "uuid": "096525af-e241-4a26-a150-1388f47657c0", "comment": "Malware payload (RemcosRAT)", "value": "9a392f1615ee57504b13326609b85798", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028045, "uuid": "4cf7579d-dbd3-4001-a550-e74fb34b4ea6", "comment": "Malware payload (RemcosRAT)", "value": "39b4aba5e8641981ee7c36537c71403e038895c5699f172498fb99f51f994b85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028045, "uuid": "2c09f4f3-a54e-4b45-90cb-ac6377be1b6a", "comment": "Malware payload (RemcosRAT)", "value": "c7c949b3157bc1494edd91ebbaf36d663d06e27c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028045, "uuid": "ff694913-66a3-43de-87c0-acf36aaadf07", "comment": "Malware payload (RemcosRAT)", "value": "f1fb5843947ceb33865df99ceffb1b42ba0649ab67be5298dc2ec85485bb34a2e5a1bf5edd8eb54d23006df81011a4c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028045, "uuid": "62d79f11-a4d4-451d-a487-a6eae261e721", "value": "T16AB5C0E2835C8873E55B3678FC993AC43625ACF5AC0BA8DA469C6D591D70B703E3940F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028045, "uuid": "4317734e-626f-4a48-8b9c-98d8302f92cd", "value": "aed486c97a3056cc8315be050383ea24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028045, "uuid": "a434e81d-db31-427d-8761-1fd239564e4e", "value": "24576:IZvkwR6rJQo6sObXVFvGkpyct5iWHANjQyedWlRfTDvxGl3/TVK/xEgGz20w69cH:IPrFvGkpy2glNjQyewXk/gCl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028045, "uuid": "b7eb01a1-e809-46e9-a24f-083d0efee95f", "value": 2434048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028045, "uuid": "c875d79b-24c4-4c38-9b74-e2561fd7f455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028045, "uuid": "fba6aa2d-3127-4e40-a4bc-d368c34f1bf2", "value": "SCAN_SOA.PDF..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff145d0-79fb-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698983131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983131, "uuid": "e2102adb-6a9f-4fc9-8eb4-924ee533dcb1", "comment": "Malware payload (Mirai)", "value": "16b190dc598ae491c1da1f80f4b697f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983131, "uuid": "fe86783d-2f9e-410c-af8f-5ed7d673d0a5", "comment": "Malware payload (Mirai)", "value": "3a17f392181e28a63ad5762ffe5a51267bd9d71d478c94acf328a6a0f3db86ca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983131, "uuid": "bce46ce1-f47a-4d2e-a66e-feeaf7d063d9", "comment": "Malware payload (Mirai)", "value": "fe4b1a263e0e6eea7f8a3075acb00cf1a278b8d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983131, "uuid": "21cd4f1b-75df-488d-afd3-bff22c68e6c6", "comment": "Malware payload (Mirai)", "value": "93654862cabf6d6a137f035d9c82f3c9439265bf0679b25379377371b988c0c24b05b24617230e76055a79dd1bc0dead", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983131, "uuid": "553e777b-500b-414b-9fc4-b3694b50ce29", "value": "T1A3530986BC81DA53C5D492BBFA5E42CC332123E8D2DF7217DE156F543B8A82B0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983131, "uuid": "b7828440-f193-4375-bb83-12846893d7e8", "value": "1536:2I1WvUAB7ej5YtIzDgyYcR+MxOtmfBw8PlR:/1SUABLiucR9stOBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698983131, "uuid": "9e64da78-c870-489c-ae80-29bc6cb6c953", "value": 63192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698983131, "uuid": "d1ea679a-21ab-4065-9bcc-a510314018e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983131, "uuid": "eb985f36-b14f-4df9-9b16-cbf950bfce4c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb5ccbb-7aa4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699055716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055716, "uuid": "c814f918-98b6-477c-95a1-3c6e96683244", "comment": "Malware payload (RedLineStealer)", "value": "a282cabb0a734484e878843b039dcba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055716, "uuid": "2f7ffe3d-0ae2-41b3-8d5b-d46bba36cd03", "comment": "Malware payload (RedLineStealer)", "value": "3a38b442e5943fc91da9dfc20beba22560217bcfde63e5432220d2fc285a9635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055716, "uuid": "ef0597f8-fbba-435c-b36a-f6f3c560fc37", "comment": "Malware payload (RedLineStealer)", "value": "ba06f9f7a257431f5faaecf89e4e80d08ce506a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055716, "uuid": "0084c84e-c744-4346-9c9d-b177c2e64121", "comment": "Malware payload (RedLineStealer)", "value": "4101c8ae00f9e4a64db7005579875f895a676593525818f69f5f3fc33f688a7f0a92858bd535c273b173dddb31956a09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055716, "uuid": "ab9aac28-991d-45ee-898b-6f43aeea96a4", "value": "T1E1B41253A6E9A073E8F067748CF706C71B337CA19A78866B33499C4A0D72785693172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055716, "uuid": "158dae7b-e94e-441f-98b2-f07cbdcdf70f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055716, "uuid": "7c08ea34-beb1-42ee-a817-1464bad71207", "value": "12288:TMrry90sSAw2qjjDMxJ0w2B92umQIh7u:4yU2qfYxJ0w2PRmQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055716, "uuid": "ec01a967-be11-45bc-bede-4eb1100e593f", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055716, "uuid": "01dc3945-b39a-467a-b6af-dd14ace24226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055716, "uuid": "0dee4c6a-53d8-49e1-b781-c9239c679338", "value": "3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1068f875-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698998003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998003, "uuid": "73254a74-d6ba-457c-bc92-a235d26b9aef", "comment": "Malware payload (AgentTesla)", "value": "c67c1b9a5b0b4a50f0e3236040f4f73d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998003, "uuid": "31f13f36-b9a4-498d-92ea-ea5eb79fc4d9", "comment": "Malware payload (AgentTesla)", "value": "3a835ba5ec5b577df4066e1635d0fd150f189992464836df6400ed6a416cdfd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998003, "uuid": "21657565-40bb-4fae-8314-db946fd4f697", "comment": "Malware payload (AgentTesla)", "value": "44d7b0643eabada7ec819950dea41a482ebe2fb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998003, "uuid": "43cd7fe7-eeb0-426f-8c3c-18fb79976b2c", "comment": "Malware payload (AgentTesla)", "value": "f597b7e273ca83c2af965b53348fc86bc2ff93923d92d694ab6a7abb39388d0b922f3c8efee8a6bb3583160dd822ee78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998003, "uuid": "dd5b8f11-6146-445d-9f2d-e94e7583e5b2", "value": "T162D42301730C0F2BDD5347FC3955959003FB28552AB2F34F0EA9A1ED6A22F548A76BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998003, "uuid": "60caf304-6d6d-45a4-9542-c3aed42df84f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998003, "uuid": "9fc3cfc8-6ac5-4518-b546-7beb9e3053fd", "value": "12288:qUoh6rbjl6hRHziRdwkbOwsERO1or4k2/A1JydoM3D5n/g2Ov+Il846:hokrbjlcRHz8XE1XkSA18oyBOvRl84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998003, "uuid": "39ac78c8-0538-4ac6-9b6a-d9f0f133f9cc", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998003, "uuid": "83271f66-63eb-49ab-b71b-cabb4e952555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998003, "uuid": "e9cba742-066f-439e-ac0b-8b3075a0861b", "value": "Yeni sipari\u015f_0211023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa2c9ce-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698998351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998351, "uuid": "b6a455d2-cebb-4964-befa-d00420474b1a", "comment": "Malware payload (PureCrypter)", "value": "b136295b37f7d24007490431f569ec6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998351, "uuid": "e2aa256f-400a-409d-b68a-a1cb906f1d3f", "comment": "Malware payload (PureCrypter)", "value": "3b83efc7295a80d27235252f0bc384fb34c5625383a28e8c9742c6e1af8d9eaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998351, "uuid": "100d8b07-001c-4f5d-a6a4-06d37a737594", "comment": "Malware payload (PureCrypter)", "value": "e53a1cfcc9e4a505e22bc5980c62187ef0295445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998351, "uuid": "402bee4e-5c4c-46f2-9d1b-2e741a775782", "comment": "Malware payload (PureCrypter)", "value": "db781c3f28ea69dbed37849fbc42366cb8a1a7f89cb9b21b56130dc6fb8729c330e1d970507bca1437ff313c692db184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998351, "uuid": "a383bb98-dc42-470e-b7e3-b61ba0be54d2", "value": "T141F39752EBB6EF34CE24093F8245B3395F2E5E9181F27D8E304DB1652EB9D01C5446AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998351, "uuid": "be37e1bc-b2a8-4333-ae24-f28495384a88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998351, "uuid": "e20f28ea-fd52-4114-91ed-2b44186a5d86", "value": "384:dwBXtJGtUZmwww6BKpwWowwwlpESUJXtdhVm13jWtSHPWcAwaYr:jiRpESUJXtdhVm13jWtSHPWcFaYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998351, "uuid": "4e255269-ddd3-4885-b6f8-cfc538c6788a", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998351, "uuid": "0f388e41-1deb-41e2-80d6-e15f0817890c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998351, "uuid": "a16e31a5-d5d7-41f5-b050-70621bff8736", "value": "SI-0266_SML07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea518e8-7a21-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698999504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999504, "uuid": "3ea50c58-cb59-4063-a4ab-596dcbeeaae9", "comment": "Malware payload (IRATA)", "value": "4d574bae5fff5bd09b824d761f8956a5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999504, "uuid": "b8ae899f-e569-479b-a574-913f29d7df16", "comment": "Malware payload (IRATA)", "value": "3f926df6b78fd56369f4612bd42dce8c184d576b264d59ff798287e80cc773ea", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999504, "uuid": "afc34281-4f8f-4724-96f3-95f6d3dcc1f4", "comment": "Malware payload (IRATA)", "value": "bff397741b8ee906907c276126c6f3e86003c36b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999504, "uuid": "46d830a7-07e5-4fdc-90b6-715f403e8798", "comment": "Malware payload (IRATA)", "value": "f3e61e2bcd3ac1b4a60619af2e8b3837b0ba6d37668fcefe5b753b0bd0ff02bb6cc8542160aaaf88c2986f48bb05f938", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999504, "uuid": "5a8a424e-d8b3-449d-8cd9-f370d71e20ee", "value": "T1C3362353F6779897CCB1C372A1751A35613B0E19D787B64A2A1C73BEA4FB9E807802D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999504, "uuid": "582c2a18-bbf4-45a7-aee4-5d09bcb095bc", "value": "98304:b8XlDkkrXNsfSQngGz7PFiRzuhemEw/xuXnBwKIRs+FvHdlQ4+pT:bIlD/9a5zrFiRahemEwx/dHdlQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698999504, "uuid": "21f7a8d7-f5e1-498b-90f6-c03306ca0ac2", "value": 4877389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698999504, "uuid": "4daa9c30-1112-46ae-9396-baba9307c3b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999504, "uuid": "143cc310-fbba-4c78-b673-3d72d2d4d8ff", "value": "LoveLand.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1c4c43-7a2a-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699003202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699003202, "uuid": "57488c75-6d6d-4291-90a2-2bfe1535a156", "comment": "Malware payload (Formbook)", "value": "5dddea03810077168a10feb4ad645c10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699003202, "uuid": "2ff83b75-b602-4f7c-aec0-94abb9c25371", "comment": "Malware payload (Formbook)", "value": "40203565c21de2f3923f1c4bb185068706f0bf56366cb099e6483737020b2ae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699003202, "uuid": "3269f384-bca9-4532-94ad-bc82e4a847a9", "comment": "Malware payload (Formbook)", "value": "d2090f067e0f903107a6c1e3c989853437b0e0cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699003202, "uuid": "d4af0b4c-eeda-489e-a1f4-c20d42390e18", "comment": "Malware payload (Formbook)", "value": "fd5db1540456d5ca63f407da65c4f9d4df8884c9efecc91361813d41ae3157bac714ed581212a70117d1d3a257a3c112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699003202, "uuid": "168a30a0-a98f-47c4-a29c-606a62f7700a", "value": "T146454C0C7BA4E818E17E47BD50926154A27963097F46F74E67D058EC0E7EF238E1A2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699003202, "uuid": "e1b46b18-6597-4246-9ca3-163d2112fe6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699003202, "uuid": "9eac1043-b888-41d1-9d0d-63bbe85c5345", "value": "24576:tRf8OazPMhTzTB4BOEkB/YAuseX7KvO1YAuJMi+sPV3GykDfMNVzCOgKIQtKoCoL:b8JzMz4BzpAuserKvpAuJMi+sPV3Gyko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699003202, "uuid": "898729ba-74a7-4521-b13d-7ee4e170b5aa", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699003202, "uuid": "0beb8704-8a2e-442c-a8b9-316b20756cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699003202, "uuid": "e3a99d19-8983-4c8a-bcb8-af2c5a75ca9b", "value": "SecuriteInfo.com.Win32.PWSX-gen.27260.9749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f8d620-7a56-11ee-8907-42010a9c0042", "comment": "Malware payload (Urelas)", "timestamp": 1699022229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699022229, "uuid": "33979d00-f603-4832-813c-1bdc6c3d1693", "comment": "Malware payload (Urelas)", "value": "19ec39f2f9f444d667967009fb09d6d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699022229, "uuid": "5fdee706-646b-45ee-a8ab-6593e143077c", "comment": "Malware payload (Urelas)", "value": "41d875ffc919e005c8d5a3e41e48a4763c232b543f292253912275c13668a0d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699022229, "uuid": "d4862459-ac83-418b-adaf-41401bc2953d", "comment": "Malware payload (Urelas)", "value": "5311a41fd105f7841f7da9c076956e2f1fb96516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699022229, "uuid": "0a28a6fd-f847-40d2-82df-7b00c5caee18", "comment": "Malware payload (Urelas)", "value": "1413fbd8d30b15789102a38b5e00b3fea2f96a7c861704cd9b59768a2e26843277de94ad7d115050c17f5a478846ce01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699022229, "uuid": "e71a1df9-dcad-415c-a6dc-98eeb4fbb36e", "value": "T1BC14AE1072C58034E0BA023006E59B51593DFD719BA99D8FB7C86D9DCAB86C0BA35F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699022229, "uuid": "9aad829f-7535-4817-9b8a-3d0294eec14b", "value": "d0a02458b96b0a6cde3068c96d1cdba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699022229, "uuid": "16fba73a-0f83-48a1-bdbc-9c5c89ac8d72", "value": "3072:llfTVlvfdEDRmyc+XA60Kj4omjuVZ6rNp0w:lpTV9rZllomjuCNp0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699022229, "uuid": "0c9ed545-0a8d-47b4-acbb-384d3132c817", "value": 204228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699022229, "uuid": "56f94002-ee95-4e29-96c2-9023be1892ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699022229, "uuid": "1e608bc4-d547-4007-8b2e-5bdc8ecb6457", "value": "41d875ffc919e005c8d5a3e41e48a4763c232b543f292253912275c13668a0d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc4f803-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981248, "uuid": "d3106468-6328-4462-9e92-6b67c08f03dd", "comment": "Malware payload", "value": "e8887fc3f40db140368eb1fccd588df0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981248, "uuid": "d755ebf3-d0f3-4fba-bc09-ece19fc4cda2", "comment": "Malware payload", "value": "437121698e0a8adb045ff91083be91981062d153643dbb171fc81679be0a2f74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981248, "uuid": "7af7576d-2d2b-493a-985b-8535d95339a5", "comment": "Malware payload", "value": "ca53c5374a84c681c6d03141fed03cf4c7e9925d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981248, "uuid": "ce89d1e7-514e-4fa1-a1ba-d805476cda90", "comment": "Malware payload", "value": "01b3bfb59b182478030104477a9e72a373aee2c6aeb97329a7389da98b1eebd2deda0ca16a4253dbfdaafbf597ad0f2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981248, "uuid": "39e67947-b0db-41f4-a78a-cf6afebd01fe", "value": "T1F765E90BAA830C4ED5D634745A3FC72CBADE62D886C120F66274CF5D9B5A20771BD6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981248, "uuid": "1c50ce86-6ac5-4fcd-986b-ea4939caa4f5", "value": "12288:vPYU1gi0BQVKBOkTix6Bg4Y3GgZfLtFBVg:H3iQMUd6e4YDTBVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981248, "uuid": "ededc8ab-7521-49dd-9242-55675f679a3c", "value": 1527808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981248, "uuid": "a687ee00-3739-4040-98fe-0b017de7ddd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981248, "uuid": "cdbc7700-2f8e-4c76-951d-8b91d8213ae1", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.6950.30749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c3ae45-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996883, "uuid": "6e6dedb2-1663-47a6-a247-05f3ed6d2131", "comment": "Malware payload (GuLoader)", "value": "290a3d722cb85d5ee0cf004fc3136729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996883, "uuid": "cd27824c-4f5a-42e2-8954-fb5127778954", "comment": "Malware payload (GuLoader)", "value": "439da9f0ad845eeafead327d4fea93b73d008671fb563d42ecd2459f83669800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996883, "uuid": "7c0c473c-2246-48e1-90b0-7d2d2a26b441", "comment": "Malware payload (GuLoader)", "value": "b8bef509983a6301b094cd4f838e2bcaff23055e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996883, "uuid": "e0063d5d-4d1a-4b45-8c96-c82b052036ae", "comment": "Malware payload (GuLoader)", "value": "3de3e56f06d5082f3c9dff21b36223b5fb3e9016640afc8870a74b096fa27abe843e7aafd78a4f70f2177211a002b705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996883, "uuid": "49639553-f06e-4ad5-8557-8d53cd9d2e40", "value": "T1AE1523A027D0C4E3C77F21705599431EDBF8EE2214ABA3979F007E5CADB7F819A16648", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996883, "uuid": "d0ed451e-9f69-416b-8b88-ca4b51b502af", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996883, "uuid": "cf11160b-7d84-438d-bdc6-52055df82cc1", "value": "24576:INPx3TpzzamewHsGVA4IS2dz6uc1L9J8xVCT5ATqY2BXY6+g7:mBTDZXVMZdz6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996883, "uuid": "0711497b-7fd2-4a77-acfa-b2fb8890594b", "value": 882281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996883, "uuid": "55dd68b8-84bb-4c2a-91f6-87559d75e8e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996883, "uuid": "20bd3b55-c601-4076-a71e-2c10d61e7b3f", "value": "Postless.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfecd48-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698998050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998050, "uuid": "3af643d0-7336-476a-9ab4-2c417b0c90cf", "comment": "Malware payload (AgentTesla)", "value": "3a2fe16cc146d8cf34ac300bd0978c8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998050, "uuid": "2264939b-161b-41ce-9e74-62a796aed2ce", "comment": "Malware payload (AgentTesla)", "value": "43a9be811611717939ad71f7b92ce62bd44cc096dcc463338952a7aff113c29b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998050, "uuid": "010cccdb-eb2d-430c-aade-71d62daf2919", "comment": "Malware payload (AgentTesla)", "value": "004e99a4d9daf6bcf875a529dba37e56c51fd0fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998050, "uuid": "a2f13520-d933-4a6a-9f2b-c29b7b1f6082", "comment": "Malware payload (AgentTesla)", "value": "1b1af6d6e96588aa9bb1a6d59e3452be41b719eaf13db75e2dae218d5c2f845df111c6af3ff9d70a2909a38ebbcafb37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998050, "uuid": "0344392d-a97d-438c-851a-5461691a5437", "value": "T120058B1676B595B1DE44C736C6E7491083A7EE9167E2D60C358E72ED0B323BE8F03682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998050, "uuid": "b6ef9ddb-be51-45dc-93b4-945039a11208", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998050, "uuid": "03f3eba1-403c-46d4-aa50-6c2f4c99b061", "value": "12288:OHXHNA9yJkdjBloAAjCh9aA6nUp0osru3dEuSDRl:C3NzJkdVlth9z6K0osruquSD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998050, "uuid": "fda9bea2-f34c-4605-b330-5a0219be882e", "value": 842000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998050, "uuid": "3f5d49d3-7b3f-4fcf-a309-822c28cb5ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998050, "uuid": "c2adf09d-8b7e-4b3c-b823-33f7778c06fa", "value": "QUOTATION_NOVQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf68852d-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699055017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055017, "uuid": "2cf6c99f-b0d0-4bd0-a3a1-3a7b225dd99e", "comment": "Malware payload (Mirai)", "value": "e35f51cf88831bb3d0d0aa9daa173bd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055017, "uuid": "7b4014a9-af76-483a-a9aa-c730cf8a64f6", "comment": "Malware payload (Mirai)", "value": "4529e98bfb802a72acf822ee11dd898c1fefd1db829c93d0acc4eada72c4b4cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055017, "uuid": "2033436a-ec3f-42f6-8802-5781d9885af9", "comment": "Malware payload (Mirai)", "value": "1d6b0c2e8380401b707a7be49303bf399721b465", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055017, "uuid": "d6ae551d-9222-4743-a9d5-0268a1740620", "comment": "Malware payload (Mirai)", "value": "8156e8022872474dd678d0bbce0d95e9c3aa99d4e7f0711f0df58d847a619b2fda663a4c880b6a8f5821a888d2671668", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055017, "uuid": "6f484680-3fdf-4a2d-a7ce-ecf537795970", "value": "T12DB3C71ABF601EF3E8EFDD3345991B4525DD562A20A87BB1B930D818F64B24F19D38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055017, "uuid": "734d1367-ec42-438b-b93d-2563487a34a1", "value": "1536:16P86pkqrX+aDtoVvg6y+dLrSDMRzJORQmWQGpZvKS2+2BuZsKZoma10dqdR:1I86pkqrX+aDkg9QmWNkBusUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055017, "uuid": "d9deebaf-29b6-4150-9d79-17510ae42bc6", "value": 117364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055017, "uuid": "dddeae12-7118-4f3e-8827-6747a40e5ba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055017, "uuid": "522fd470-4706-4ace-ac67-cee1e9d5fea2", "value": "e35f51cf88831bb3d0d0aa9daa173bd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9526966f-7a20-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698999085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999085, "uuid": "f72ddd02-1c41-49ff-96ef-dff66bccba90", "comment": "Malware payload (Formbook)", "value": "e39183f7ee68b1aa66bdf79157319634", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999085, "uuid": "affb3f55-e082-4c6d-8bb9-f1f145cad737", "comment": "Malware payload (Formbook)", "value": "46714c9ae42535b3a3d0aaa31e73582177a7b5d517584aff2206dd37d2ffa373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999085, "uuid": "9d271ec1-498f-404f-ab18-a3a3b35a1c52", "comment": "Malware payload (Formbook)", "value": "8b7d7119d3e1a8d246656e3d41f5ba0362d296d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999085, "uuid": "790ff65d-e782-40f2-b329-e1f19d2df57b", "comment": "Malware payload (Formbook)", "value": "1907a911693ac0c3161f122b9b6c0b28fb4ae76b25fc2aaf1b5fad821f44102cc7cc7cdb3a0b3387e84ecc8e18ebf3c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999085, "uuid": "8049c17a-efcf-47e5-9885-ff427a6bfa45", "value": "T133C4231733BD0B3AD43E43FE84551B858BBF4466A031FA690EDD60D98A96B52438DF83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999085, "uuid": "5c6e7833-667c-4fb9-a7c2-840fafec8bbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999085, "uuid": "22138ee2-4077-499f-bd85-18ce1f158c86", "value": "12288:fIkw1V1QSDvA0wKXdSFocjZ6M5rcJ3cwG9GbEz2OM:fIkwJNjA0VNS8M5rOxGwga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698999085, "uuid": "37156d1b-c4ec-4345-8fe2-1a40fd7cfd2d", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698999085, "uuid": "65fc7cc1-e4f3-4d04-954c-2e5a084253f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999085, "uuid": "7bab2668-9e42-4202-8c26-c0ae46f208c7", "value": "Nuevo orden pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1915b5f-7a1d-11ee-8907-42010a9c0042", "comment": "Malware payload (RevengeRAT)", "timestamp": 1698997925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997925, "uuid": "77be5548-6a82-424c-b77e-28d9a6b32652", "comment": "Malware payload (RevengeRAT)", "value": "bbb90989095181bc4f00538a6fb2c758", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997925, "uuid": "7e67d56e-36a2-4ac1-8a59-ee7ef4fe8aae", "comment": "Malware payload (RevengeRAT)", "value": "46b454c387c2fddf9b75c3dddf419dfa328608b7662eb868a62b7c0ee98bc7e1", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997925, "uuid": "24147326-020b-4b68-ad69-d8faadc44a08", "comment": "Malware payload (RevengeRAT)", "value": "231a483396ae02f50a0047fe2c89278c40410f85", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997925, "uuid": "b3fd1ec7-7728-44d9-8a1b-187ce63da45e", "comment": "Malware payload (RevengeRAT)", "value": "4855c2574c7b320cb044c586fcc7137b60051b18fdcaa2be8ac821f2b5ba356e0768e1b9cddbc846925135e2dfb413e3", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997925, "uuid": "209326d3-f1d2-49e9-90dd-c8fdd685587b", "value": "T17DF1AFAC700FD021CBB2693DB1770C9B721AD63286C16B8A119D806C5DA21375B5B42B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997925, "uuid": "51000d8c-e354-4618-97c2-debb950bfcac", "value": "96:ZEKr9NP111qA0UdV9X+2HpKYGkSM2ltjffRlunaKH2xyfljLkx7JO4ctDj23CE:xrXP/1TV9XtHpKFM2nF+aKH2MFkJcNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997925, "uuid": "c31d3d41-416c-4c11-88d1-a07c47649254", "value": 7962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997925, "uuid": "59be7adc-032b-4525-87e8-f1dc08d07106", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997925, "uuid": "88cdb7a9-6255-49c7-88f7-d0ce4b3deb1c", "value": "Reserva Detalhes.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aace0e47-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998262, "uuid": "5098c0de-323c-4dea-9f91-2fbd6e5ef638", "comment": "Malware payload (Formbook)", "value": "4b172871150d7074e7738bca40df8ef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998262, "uuid": "b3cc3bd3-0f38-494b-b42f-128ea8e45dcb", "comment": "Malware payload (Formbook)", "value": "48651fcaf687d844bf32deb03c419c63e52f295739c4c0dbed2035290f75c2bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998262, "uuid": "490e90c8-1daf-48ec-b8c6-433d30709101", "comment": "Malware payload (Formbook)", "value": "167993882dd1617b2b53b1daabad25bccc827448", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998262, "uuid": "60afe122-0767-41d7-bcfd-3dc166428fb9", "comment": "Malware payload (Formbook)", "value": "8f1a03d1861cd94225406ac70d21c83c7e00c780ee8c6e05dfef5d2bd1d4cbd6f3988bae6a6917cf5fe933f47acd740d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998262, "uuid": "097ae99f-2096-4c17-962a-b104eb0cb6a8", "value": "T1CCE4E10476AA5F93C5BF83F60661A41017F56CAF1428E32A9DC2B0DE1676F130A95F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998262, "uuid": "6b7e7a5b-d379-4012-9b7a-b72869ea8711", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998262, "uuid": "d6cb4c7b-8dfb-4ba1-9c21-75107cd58273", "value": "12288:JifONZ2DqTMyMbDHrRO5tPwEoiouXbkXHaex26wB4szThbsFxgr8XP7hX:eOvx3GrRcJXGx24szFOxgrajh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998262, "uuid": "cf6efea2-a3a5-4c59-bf59-ceed24e3a871", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998262, "uuid": "bee99a0a-af1c-48d6-82a4-3ca55a822ff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998262, "uuid": "69cc385f-b8c0-47ce-9495-a81138256c38", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24ba699-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1698998275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998275, "uuid": "dce7f5b0-c537-4675-803d-71446c3fd52c", "comment": "Malware payload (njrat)", "value": "aa1f35538a26f5ba1da750053885c1ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998275, "uuid": "fa116e94-bcfd-4326-a979-f337edd239d8", "comment": "Malware payload (njrat)", "value": "48f62401b33fe45c1fa47ebf941bd9ccfe38f439c78ba1a5bc99a2a8012d5aad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998275, "uuid": "b625599c-9c39-49dd-972d-2b0413d0ee44", "comment": "Malware payload (njrat)", "value": "6d3ee2659f79110a13a2275b7e36b0727fb98231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998275, "uuid": "f30f227a-2186-4fdd-84e6-c18cfc8c7b69", "comment": "Malware payload (njrat)", "value": "99ec00fa57c540f520ddedfa28dba3883a62705380bce587c0d053c8c0217b3e6a615c54f20242e9c04104713c1b21eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998275, "uuid": "da0c9289-5c1c-42be-be67-ae28c029ae9f", "value": "T12144A512BBF9ED36CD7485BF82A5B2241F3E6E9011B1FDCD2849B0941DF6F008954AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998275, "uuid": "2241d61f-0e30-49f8-9019-bbbdb5f4d789", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998275, "uuid": "8a2e423b-105f-42c1-9099-7a5c8996193d", "value": "1536:phnnno/3h+bRFGYzgRNbMKd9jUxh/u7SEhBo:Dnno/3h+b39gRNbMKLUxh/u7S2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998275, "uuid": "a767de31-b114-4c9b-91ad-d96bba3ec669", "value": 255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998275, "uuid": "11f37f5b-f829-4e1c-88d5-161efa2d96d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998275, "uuid": "c7b70cfc-7854-43fd-8110-c9ff0b72db75", "value": "aa1f35538a26f5ba1da750053885c1ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79eafe67-79fb-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698983148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983148, "uuid": "1b6cc69e-3b06-43d5-bb14-d903b03206d0", "comment": "Malware payload (Mirai)", "value": "aded81a920114f8b57dccde53dc96c76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983148, "uuid": "83bd6b0a-2888-4d5d-b7fb-9d10d522d662", "comment": "Malware payload (Mirai)", "value": "491dac3670dd1fb7051eb89241af6559dd3d4bed13430260aa89e7fcd179d534", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983148, "uuid": "f4102789-9f02-451d-a66d-c283a9a18019", "comment": "Malware payload (Mirai)", "value": "bdaf7e381cbdd048ddddae66be676fc0d0c41c1e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983148, "uuid": "af33ceb0-faa2-4b17-9cd2-886bc48d7e75", "comment": "Malware payload (Mirai)", "value": "9d5157e6e1906590d17ecc2ac54c4bee4b77b0c9c821d436956c513be627528b207298368f108c43ab8d4e383d5c9f8b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983148, "uuid": "6c851074-ed62-4163-96f6-13fb10a07cf6", "value": "T10083C6097F644FF7D89FCC3B09B95B05289D950B25A93B397930D408B34B65F2AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983148, "uuid": "e60d517c-753a-4694-8521-1f8c1ef1bb12", "value": "1536:dJ7F8suV+lVajQzh07eQjujR1DgQk8ye/2+NLlesw8PlR:dJJ8s2+lVajGZ1asw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698983148, "uuid": "62668d04-736e-4af6-bd13-80d533d975e4", "value": 84232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698983148, "uuid": "dc1f9c9d-ce04-4f59-8e42-5e9c7c117b10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983148, "uuid": "c9ae1443-ccc4-4e14-ba2e-c8a9504e0821", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0caedbdd-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699054691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054691, "uuid": "d812c7f8-b8a7-4940-a74e-5d2a603caef9", "comment": "Malware payload (Mirai)", "value": "6cb0e6c6548da77c851dd0f3218f70f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054691, "uuid": "b7c82070-507c-4bd3-a97a-fe8e84feef61", "comment": "Malware payload (Mirai)", "value": "49b5068c03310dd1959d0cd6bfc132622af3099c086663ca176ecaefc4c44ae4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054691, "uuid": "53117fa5-c5ba-4b5f-b677-d3375934b080", "comment": "Malware payload (Mirai)", "value": "8ca50a1d2617263ecb4cc8a4c06f6d225e6c3eb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054691, "uuid": "ac1788de-8bcf-4c58-9d6d-a61ac4207cc5", "comment": "Malware payload (Mirai)", "value": "8730f9bef331d1585897a4ce2ef52ff249b6bcdc3a245267fa034c7d2cacbf1ec3f822e637166911cca43f6b37301a57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054691, "uuid": "911a18e9-c047-45fd-bdf3-e0611fdbe187", "value": "T123C2D030269B51A2F270097B8DBCC94B77096672F0E735A377814654C99273A1BFC78B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054691, "uuid": "e629d229-8469-4f1a-9c48-79fc15969c36", "value": "768:QxJnN5wwUcgxbm9h57/GFh9QpZ+p3/4s3Uozh3:ncjzp/vZalzh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054691, "uuid": "496c1751-7b5e-4429-b4c9-ee145b9a5ed5", "value": 26776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054691, "uuid": "ca083073-5134-47f0-bbfc-42620a71663a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054691, "uuid": "6964b391-2a74-43fa-ab9e-ac2200484b3d", "value": "6cb0e6c6548da77c851dd0f3218f70f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e860f5-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996825, "uuid": "c48e3be6-8fef-4551-a2df-e96f616457b0", "comment": "Malware payload (GuLoader)", "value": "8832e1bc8cbe072eb8644b5d7f20274a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996825, "uuid": "83b9f46e-65e7-426e-a81a-bd06322458fe", "comment": "Malware payload (GuLoader)", "value": "4b5a8f85f8044786fa1657717c6bdf60d659f8062decc5fd51813057d1a6162e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996825, "uuid": "5f8a12d7-47f0-4c79-84d1-31cc1b5c0ad4", "comment": "Malware payload (GuLoader)", "value": "47e631c8ed2e7496ea5836249c8c3cd12e96c807", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996825, "uuid": "5728bcd4-95dd-4123-bb62-3dccf8c320ce", "comment": "Malware payload (GuLoader)", "value": "1c244907dc4181b2df6d0720072cf7bd41d6a04054a8505958ef9ef60eb3a72514ac35dd93f4d3aff8a9f7389e57b994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996825, "uuid": "c2786326-5603-4f31-8e76-c2ac40655a32", "value": "T16D6512E37E144DF7E8291030641B09A3AB756FBFE682193A3199FE2B5C7225B060D53D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996825, "uuid": "27d9ee6a-f417-4941-815b-f0c3d4cdbca6", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996825, "uuid": "03799d36-9227-4659-bdf8-00d813596545", "value": "24576:eZmBzEfUlWq/OPiN5y33nFWKq8WucI+9vrc6NlrBe7pyIvR5V1e:6maUgq/OPiNc33ndcI+9vrcode1yWRPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996825, "uuid": "67954b11-16a9-420a-a690-935c5a3fcb72", "value": 1436119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996825, "uuid": "b060d430-68ef-4b52-88b5-de33054f00e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996825, "uuid": "fe8d02ed-2aec-4ce7-b2db-0f7c5df3b3fc", "value": "Bissernes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f9116b-79e5-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1698973671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698973671, "uuid": "63b60f57-912e-44e8-978c-d21070380096", "comment": "Malware payload (AsyncRAT)", "value": "2dc6e07cdb37926efc831aeb2da73ccb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698973671, "uuid": "3443c81c-6d33-48df-9448-b865a6d29a08", "comment": "Malware payload (AsyncRAT)", "value": "4c6643ccdc2f77db1061b7137fd12409c26b2ef89267f88f57f3784b1f94270b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698973671, "uuid": "9b2090b6-db25-4e9c-8ee9-d9a1f9f89203", "comment": "Malware payload (AsyncRAT)", "value": "fc0e2a730992857394e7ab2dfd8a662ed0507244", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698973671, "uuid": "6fc35a83-6887-4ede-a7cc-d9db38488870", "comment": "Malware payload (AsyncRAT)", "value": "a2456f8437185051a344c434b02e36567a9e52f2035350912a7c39c127d33ef9f1795a9d2920f0b521cdcb2e927f6704", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698973671, "uuid": "5187e552-688c-41d7-9fbb-7f296a405d54", "value": "T1AF237D403798C13AE2BD47B4ADF391458675D26B6D03CA4D6CC415EA2B23FC59A036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698973671, "uuid": "498fd533-0673-45ee-a257-01da7ef87081", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698973671, "uuid": "a953772f-0671-4d4f-b1e8-16f3e86cbfeb", "value": "768:V96mxUTILWCaS+DijWD+RPpiP+8YbZge24McD0vEgK/JzZVc6KN:V96AKWjWCRvzb2m0nkJzZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698973671, "uuid": "34f0c197-6a10-468e-86a1-8a5dea7baa81", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698973671, "uuid": "cdc5d851-dc53-46e9-9859-f7040af49fa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698973671, "uuid": "978e74a1-1a6a-402d-921e-3bc94d767977", "value": "bRhZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb48156c-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699054984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054984, "uuid": "f0c29ef7-d481-4715-9e62-aa3c1cd376e5", "comment": "Malware payload (Mirai)", "value": "5530c17152391d44173e6f577eddcc7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054984, "uuid": "949f9653-f30e-40f3-aa8b-516b2776ad97", "comment": "Malware payload (Mirai)", "value": "4ccd78ab3e9c7c42e82fcc78b34aab7657a34c8432913f512e0d095d3e475344", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054984, "uuid": "d1b3f397-97d5-468f-9f71-7bfbfb833f65", "comment": "Malware payload (Mirai)", "value": "607dca179977f239757d8ceae5061754046cfd52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054984, "uuid": "8988a7f1-759b-4239-8e70-dc69d3e1214a", "comment": "Malware payload (Mirai)", "value": "b3d44e28b29b4c693cf9f940ae1c275528a7700faca5a061e80725a09bfbc6189c8c9c1d1b324e2fcce7870723fefdc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054984, "uuid": "55865ea4-9ef3-46d1-98b0-d9fa26fb9a3d", "value": "T103B2D014F2566ED8EFBDB8B5BDE5DCCC77D92B4C72A249B24110AE20A106911FA16BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054984, "uuid": "d72e5c71-54de-42b5-bcbe-fe0a5c2f78d9", "value": "768:mLExZlAmh0PMTKXfrnB0p76vZD32cJ4uVcqgw09a:mLE3loQKXDnCUtme4u+qgw09a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054984, "uuid": "19ff9932-606e-49c3-b9ca-b1fc138001b0", "value": 25644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054984, "uuid": "7cac7a60-f7ac-41a9-b594-4242a4e5f4a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054984, "uuid": "b1d41fa6-189e-42bf-b891-b6f70020911c", "value": "5530c17152391d44173e6f577eddcc7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5f91de-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981278, "uuid": "64ea008b-5d36-421f-885f-1b7216856458", "comment": "Malware payload", "value": "cbf2eb25a5d7836e850f3b38b6531c69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981278, "uuid": "904c4411-0f40-4ce2-8a84-ef2cb793e529", "comment": "Malware payload", "value": "4ecb587faaa17049ef8f2ebce72bca6e20b230ecc8f157b0abdee0ae6a9b7a81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981278, "uuid": "138f5d08-a768-41d2-804e-84b13329dc50", "comment": "Malware payload", "value": "59885552f82a17afab44e449408a3a5118c70d1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981278, "uuid": "dc4e206a-e2b4-4d89-b263-7350b50a437c", "comment": "Malware payload", "value": "9ab0907cd62bc7c05bf8fea761d53a4261a5cfa4208bebf7732237f3b629fe337459278257bc8b42603a76e4b0b7b164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981278, "uuid": "08b6b097-8240-4dd1-96c5-8f614bfa34ec", "value": "T18325126D730988B5C06E0431E96367B66E171C619A050E2F27F1BE0D3CB6B447F2B5EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981278, "uuid": "f36673a8-485f-4c60-9abb-15027f2c00b4", "value": "6144:8y5PctysxiEjXhEOy7juOH66aPvxcdk78REsDOAWkweLm9KbbLmc6W:8QUtyEhgXaZPvxcdO0E8WkweFXLmzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981278, "uuid": "10d49b1b-3c93-452f-b36d-f04ccd2a1894", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981278, "uuid": "6440e55a-b322-42bb-a676-767090787ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981278, "uuid": "20b2041a-f8a6-431e-898f-ee1a62ee7f7c", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.27256.32096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ae27b9-7a42-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1699013558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013558, "uuid": "c6ea08fc-147b-460b-9864-ee2ee01ecd84", "comment": "Malware payload (GuLoader)", "value": "82c1cb97956338f551579c792163568c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013558, "uuid": "94009584-d715-4772-a057-2b2b546c8e7a", "comment": "Malware payload (GuLoader)", "value": "4f22fda1b8750f74b9888362da59a7207f21b3c2321a77ec470f30ada4bbfe62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013558, "uuid": "7190719c-4782-4af6-99d3-388eeed859b2", "comment": "Malware payload (GuLoader)", "value": "bf505df2b425f0e4d5866841c188910e2326efec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013558, "uuid": "2487918b-0067-4f77-b33a-8e8e69009cea", "comment": "Malware payload (GuLoader)", "value": "3bcb6ec315b7fc14696233a7055d7141c4d9ddc1655fb80078ff0d43407f0271e95d3c9d75d99bbdfd42bf8ce9df6cfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013558, "uuid": "e013c972-8eb9-4a1a-97f9-15eeb6564456", "value": "T14DD401417A50C992C9294530E0B784A6073ADE34A9C51BDAEF4BF76E3C32598B90F77C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013558, "uuid": "25ba2df4-f17c-4fa6-bec0-d6c73671863b", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013558, "uuid": "ea0fe846-962a-4a7a-bbff-d4c29f1088bd", "value": "6144:o48T4kdmSlLDllqQDBwyV+PYPBmF52NoJy88WG3uVAPa/MdY7Bu+dA29jur/WRlf:obMLSlllqQDKXINF82+K2MABxRh7B5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699013558, "uuid": "1a57b584-a6b4-477a-a3f0-2f96ab7b095a", "value": 637806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699013558, "uuid": "87ab61ce-e23e-45d1-861c-f0fd670021af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013558, "uuid": "0e2a75dc-93c6-4eee-93ed-d164f6955be7", "value": "4f22fda1b8750f74b9888362da59a7207f21b3c2321a77ec470f30ada4bbfe62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59a46e6-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698997072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997072, "uuid": "1689f5a1-6af2-4ee8-a87f-c09490283a86", "comment": "Malware payload (GuLoader)", "value": "ace6da016dbe62de41d37f890cccd3f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997072, "uuid": "bbac7511-f403-4cd9-8780-dc83e7a55fb6", "comment": "Malware payload (GuLoader)", "value": "504fabaf59d6e4bd0d8ae73063979d43ed204f234de00bb02a8be32ae34c19a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997072, "uuid": "5072573a-2a58-456d-a33a-e2aa06826baf", "comment": "Malware payload (GuLoader)", "value": "107f1172ff1d6ccbb3cdc3ff5d875732c1d2d62d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997072, "uuid": "2e7c2c3a-ce62-44a5-98c2-f724839c3b7a", "comment": "Malware payload (GuLoader)", "value": "68bed32e8255243d85097ad8e855b902efd9ff9d46298588fb549cb840e27b2f8c02d98c359ede504605380c1bc33bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997072, "uuid": "e7b5f8a0-b4a1-4bfd-b770-492081ac22d2", "value": "T1FF65231A6A54D143C35139BE4976D2F5A2B26D41FC1482E3DF38BB4EB87A2C0BB097D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997072, "uuid": "b86ee4cb-11d6-424d-8c38-5a7a4b654b4c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997072, "uuid": "b910dde2-5d85-4c3a-8240-c57d3b06e78e", "value": "24576:4Kk6ZwssbqDuv+9gk7LwbpclU12Z1owyMsMtBH9I9QoP8YfyWhk2xRUASHJcPW8Z:9kMsQugwbylFZ1l7wQokD09OuPWHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997072, "uuid": "f707434c-96c5-4d78-a60b-0e6e6d81a004", "value": 1484749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997072, "uuid": "86ebe040-f0b7-48cc-ba6b-a9586cb77ab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997072, "uuid": "d5dd40f1-9824-439d-8b09-7862b7172996", "value": "TELLIMUS (LEPINGU L\u00c4BIVAATAMINE)-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fe6d26-7a40-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1699012800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012800, "uuid": "47895b3c-f89b-451a-9c39-c2100c1012f8", "comment": "Malware payload (GuLoader)", "value": "33f64ae22aa24d0dffebb22aa8ebbbbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012800, "uuid": "3102c446-1c74-4862-a6f0-08cb9d5e7700", "comment": "Malware payload (GuLoader)", "value": "50a240dd81f289babfee552b103ca3a5cb94eda0db53ec8c5ccc6afa0970b298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012800, "uuid": "c906ad86-db42-4866-9314-c37309988fff", "comment": "Malware payload (GuLoader)", "value": "e5007832bcbe47020c63c1c9362501f0dd1263dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012800, "uuid": "8cac87e9-85d2-46c3-9fac-93824e76d89d", "comment": "Malware payload (GuLoader)", "value": "29d843337ffcdf310c978b173ba45c78059fb0bff33388ab7daff7a134a0c93e5c10751ac3737733eff7297faf98c2e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012800, "uuid": "168bdfbd-1723-40bc-8284-9c579d3695db", "value": "T1239533E53543DCA7C9B3037A63238B78BB912F706E549B0B26907F336E36A706C58558", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012800, "uuid": "28c36230-b184-42d5-8eea-f32cd12f2dfa", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012800, "uuid": "e71563ad-7e1c-49d4-981b-032c11de462c", "value": "49152:PVCluwN/DoV3jO8n8eFy9XSVLxizErmc05gb/P:PElLq3q8nBFkiBAtc05gb/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699012800, "uuid": "80771747-6530-4a7c-92fd-292b890fe36d", "value": 1903536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699012800, "uuid": "95200e00-5547-4ef0-954c-fedabd874739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012800, "uuid": "f709a3ff-5209-4ebd-b086-5fe871abf5d1", "value": "50a240dd81f289babfee552b103ca3a5cb94eda0db53ec8c5ccc6afa0970b298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765c55d7-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996886, "uuid": "cf62cb50-411d-466d-8d96-f7200826e606", "comment": "Malware payload (GuLoader)", "value": "e8244f1a9d6969ab839317f3378a4013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996886, "uuid": "a9ee7660-989c-4a56-b9f5-259f021a6851", "comment": "Malware payload (GuLoader)", "value": "50a2e6d2c38a635def109be99dc5959ebb53db96b9f42c053b0bd3a253b1fa47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996886, "uuid": "dfc29558-0c2e-46e2-85dc-cf1f6677a791", "comment": "Malware payload (GuLoader)", "value": "c0b63de16a2839a2dc250fc4365779bd09b1885c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996886, "uuid": "bbf26227-8dc4-4f7d-979a-031d1ededc19", "comment": "Malware payload (GuLoader)", "value": "a5ddde6c6499eb9355b5aa8bd3edf18c2f18d04d1d5b47239971b70da714940cfe492bbdd6f9d64e57f3a1b6df235355", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996886, "uuid": "3d9cd9bd-2dcd-45fe-871c-884f210ced21", "value": "T16F65330402B9DC9BE52413B416E79E3FBC67FF619998225347F9BAD76C32502F814A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996886, "uuid": "a1658b66-4aad-445f-878e-dcfd165304ed", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996886, "uuid": "5ae40414-f96d-4b29-be4b-3de695136388", "value": "24576:bCds6OD0+oN7dweDnbdGNcvJWf2yKIkLin3fkm46kuwaZuvRAn0lVb:K7OMdweNhWf2/Lc3fk62miin0lN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996886, "uuid": "0ffdbc34-4187-45e1-a650-4865921ad4f2", "value": 1470983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996886, "uuid": "36d5f470-2b43-44c1-b3f8-32898e06f1f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996886, "uuid": "c0a88313-a713-4dd7-9eff-994fb71a91a4", "value": "Petunia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658a1575-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699028211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028211, "uuid": "fd094372-c250-4903-9e93-1c18691221eb", "comment": "Malware payload (AgentTesla)", "value": "4aa096efd6fa9664ac289466111192b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028211, "uuid": "3fadb9b8-6ebd-4dcf-a055-dd4e0bf4aa60", "comment": "Malware payload (AgentTesla)", "value": "50b88683802c5f014b997ad7f1599837263ca270afd5e5dafe84e3e96da289d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028211, "uuid": "7d823e60-3359-4081-973b-e52642a76d02", "comment": "Malware payload (AgentTesla)", "value": "866cf5f8b295778adaec033c05be5109f1ad842a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028211, "uuid": "9ad19437-ba49-4580-853f-f18b0fd1f32a", "comment": "Malware payload (AgentTesla)", "value": "7a17c11b6a3552863e307cfe5a64706e9474d329ca20ba10d7cd35248099f0b73916ebb963a819b33da1c9fc02e00f9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028211, "uuid": "82f92834-a1b5-4b3a-913a-954c12742d00", "value": "T123D42316367D4FAAD6BF13F80160B610077184362B12FBEC0FA9A0ED3D55B51AA01BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028211, "uuid": "64056bc0-d887-4b00-839b-3a642b9b4fcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028211, "uuid": "e6d4f3b7-c633-466d-a563-b1aa6e8456ab", "value": "12288:EZwXua0tatXnxyHHvOgyVUcn70H3ddagYJS++vw0JtYHx1yDDa6KD:LuFUtGWgyiu7StQg1rYHxYDadD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028211, "uuid": "513e899b-dbc2-487f-8743-df48f0e6af38", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028211, "uuid": "485bc16c-a683-4f21-8cd0-8ffee1249dcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028211, "uuid": "1035c736-6069-4242-b274-232586bc2616", "value": "DHL DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b4ce67-7a16-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698994581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698994581, "uuid": "cb47b2e3-2042-4431-a3b5-1b1f67cb6b7e", "comment": "Malware payload (Stealc)", "value": "4d54c935a22dd0a1d870fd7810160f17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698994581, "uuid": "6b845aa5-4a01-45dd-9d61-76a9850403b6", "comment": "Malware payload (Stealc)", "value": "5166d61c8b8b42bb7fc4c61847cac83c284031d523e8998633b01e0af6e02e8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698994581, "uuid": "9fbd2d65-2bf9-4804-b7f7-a8c7196207f7", "comment": "Malware payload (Stealc)", "value": "db75c603aed9f19130278072deb0e9671e93d761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698994581, "uuid": "f9cf5bad-cbdb-421d-844b-35068e5e3c79", "comment": "Malware payload (Stealc)", "value": "bf1c94eed57873ba3776e8ac0d18477a860188677bb6bec4a30220c074cba5ae36bd170110b459ca1a9014a2a236860d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698994581, "uuid": "5388d905-57c7-46c2-beba-415d3a46111f", "value": "T19F444C7352F16C62E526C7328E1EC7F83A1EB4608F5577AB12699E2F09B01F1C17271A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698994581, "uuid": "98b4b9c6-3332-4b4b-bb28-d4fc04ac2bd7", "value": "ee827750429cc6977e10fe712ee76a8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698994581, "uuid": "4b0812f8-5b8e-49ff-99ac-d32a30af8c54", "value": "3072:H+uFvqx+lSkeUI4B/Nc0C+j2rDRm5kTrKgf8RtulJsFxd:Pvqxdkef4EHUkTr/8saF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698994581, "uuid": "22070ac6-30f7-4928-a623-9a73fe48f2b5", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698994581, "uuid": "bf74086b-dfde-4f35-bcd1-a567860efd52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698994581, "uuid": "9f6242db-405b-4737-8c85-52017eed71e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1f5a52-7a19-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698996092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996092, "uuid": "2019d9f9-a42f-4eb2-bdba-de58e3eeef4a", "comment": "Malware payload (Smoke Loader)", "value": "0bddfbdc76418c7fc877a5a11013dfee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996092, "uuid": "5702fbd4-5544-4e95-845d-18feef24fa9a", "comment": "Malware payload (Smoke Loader)", "value": "54349953542084ceceb6de40c4edc6124bf69ccad39051a62d8e2be651acb9dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996092, "uuid": "acb7c8dd-286b-4e43-9c33-7ed6fc7450de", "comment": "Malware payload (Smoke Loader)", "value": "b9752934bfbd8101dcd94e3546d158bf538d1d02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996092, "uuid": "8ae5393b-fccf-4b8e-a067-564ebc7ebd2a", "comment": "Malware payload (Smoke Loader)", "value": "b1283e23819bb75d54572400d8ae6d16a8f19535ba1c720c6c77493d103a9803252fcc39bac3a3165ffaebe2c2a31a9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996092, "uuid": "15d531f8-8afb-478d-a0e5-f90cb7bb50bb", "value": "T196D6021B7388C406E2F2B0CB59E07366B4E7B8F38685B55B6C98997B443C5209FF28D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996092, "uuid": "b70f4be3-1228-445f-bdee-e332e79eb4c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996092, "uuid": "d883031a-321f-4b31-acc1-4ec6262865dd", "value": "393216:WNSzrdr/NAWCPVvZj7zQk/psYFHwlya3VQ:ISzrdZwVBjHQUHw53VQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996092, "uuid": "9c471e4b-c62c-4ec5-a6c7-6e547518d9e1", "value": 13144064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996092, "uuid": "b6f88d2a-b7a9-4a6d-89c1-787ed91c1718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996092, "uuid": "14677802-3b03-4b47-ad98-36b987ad0e83", "value": "0bddfbdc76418c7fc877a5a11013dfee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e33c065-7a9f-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1699053619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053619, "uuid": "26751dd5-8bbc-4325-8305-fed36ed8c954", "comment": "Malware payload (njrat)", "value": "9b84b8b187ddc558413f595cfad23f79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053619, "uuid": "2b9b168d-e4cd-4a0b-91da-6f95daa5c428", "comment": "Malware payload (njrat)", "value": "5451fbea496ff637af71f685ee82eea76c80625c1c2c1283a8d1ae7f60663307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053619, "uuid": "9e158cc5-03ed-48bf-950e-972e002fc74d", "comment": "Malware payload (njrat)", "value": "9ff412721f5276957eb338051a7036fa9fc0980b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053619, "uuid": "28ae53d1-a5be-407b-b052-2d915823256c", "comment": "Malware payload (njrat)", "value": "ff7dfd912d97bea4ac35ad20fd7bb882255c2aa64e73a8500d447fee110fd85a1caf79d1545604963dc754a44f0642f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053619, "uuid": "b9cfcd7d-d53c-4143-8d34-0e41018ee3eb", "value": "T16544793164E570EBE463BDB9D6E8E0D2AD1E7FE2FAC1B21C1440321A87768129EC7574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053619, "uuid": "11a590f1-ee21-4eb7-901d-98425c0b16d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053619, "uuid": "a80cf689-4262-4544-a91c-9a535b2e8b4f", "value": "3072:b76nq7sSLg2NgS+VAApGELM4dLqMtlxAq55VZ1otM:bunGDjd+RPJdRtrz/ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699053619, "uuid": "72cb369d-ff11-4d43-b924-d02325ea19a5", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699053619, "uuid": "309cb805-0269-4ab6-b6dc-d14757a4c582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053619, "uuid": "7b1d2e5b-0983-4f71-95c3-6148610f5923", "value": "9b84b8b187ddc558413f595cfad23f79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861ab4b0-7aa3-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699055324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055324, "uuid": "44bc5895-0ef1-436a-8018-c4911a71974f", "comment": "Malware payload (Mirai)", "value": "052e710aed70eeb088f6175da427e104", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055324, "uuid": "439a356e-702a-498b-8b84-7ddf6e3d5174", "comment": "Malware payload (Mirai)", "value": "54994ac3504bd3b3b89e5b5fa6f698d02157a6ceb2590e4e4c736e2809816255", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055324, "uuid": "f3266e9a-c82c-4ae8-a0ac-369b59105bf1", "comment": "Malware payload (Mirai)", "value": "033246d71bec329a62e68ba5467bec5da2aa0028", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055324, "uuid": "12d94141-1ccb-40e0-8033-46e489babc41", "comment": "Malware payload (Mirai)", "value": "1b67eb24107f98132102d5ea399befddc84f3ea2822e6ab71b3a05c8d3b63c896d020b62c29d713fdbe853620282046c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055324, "uuid": "1dee6d2f-d33f-4722-9eb8-bbc7a5efdcfa", "value": "T123A34A85BD409A21C6C516B7FE2F108D331657E9F2EE7263CD145F647B8A82F0E2B606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055324, "uuid": "1225de17-d58d-472a-a009-fb04f61acabc", "value": "1536:NtnvdeFmqzdjlGs30o+n/ZNkUvMnuGCc0qtd9OA5J7HcbIciWSnam6Dsa10dG:ndnidjl3/+n/ZNtKsqtjOS6Snam6DpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055324, "uuid": "78520e22-2349-47d8-a001-38e511700ba3", "value": 103728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055324, "uuid": "62f34387-69f2-4f1d-bd63-bc96b5d94454", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055324, "uuid": "2aaa1e8c-2434-4fe2-89fb-d0e53e433b3a", "value": "052e710aed70eeb088f6175da427e104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce90ca34-7a3e-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699012066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012066, "uuid": "95e4bcf7-fbb2-4152-aada-2886f483c2f1", "comment": "Malware payload (Smoke Loader)", "value": "d3bcc11e32d75fec333d1857c4e0a3da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012066, "uuid": "ad69b589-a8bf-4d71-ae5b-50e9dc5caaab", "comment": "Malware payload (Smoke Loader)", "value": "57dd76c7c512afbed21d7304a66fffd89cd904c39a47d459a49aec1f5f1d5235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012066, "uuid": "95ce00f7-a4a0-43ed-8e85-697421b787a7", "comment": "Malware payload (Smoke Loader)", "value": "bea8ba8c44766d446e264bb6d25c9f9b5158ff78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012066, "uuid": "b59b74c8-f6f1-46b5-9f6f-ec4ac1ffd95d", "comment": "Malware payload (Smoke Loader)", "value": "7892b710a7c9713f0a042e07c1eef427c91aac35e80a94fbe19acf06c628df4b4b5f87b997d6c31988ff5d40f0752090", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012066, "uuid": "3e9ddf1a-5d76-414e-a3fd-68e5c982a6de", "value": "T1EA65BDD1B0AF956AD4DDF03D89D8669760333EF21602F2778844BD9BF61CA8349C16B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012066, "uuid": "9d646d9d-851e-4545-904f-ad9a4ee72e02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012066, "uuid": "20db1d44-6a95-4508-97c5-068019152c5c", "value": "24576:nbm+AIHqd5yIfvDkTlAKot2+c3t7JVpfjfWZnHbyBrN1Rd9rmRve2GViRXUmFX:bm+Aoqd5yMvDkTlAKoty3t7/Fjs+BrvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699012066, "uuid": "9cd3f969-5db6-4299-95de-1d9458888811", "value": 1504256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699012066, "uuid": "0107f73c-3054-48cc-a0a2-2c50d6c192a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012066, "uuid": "b99f0d0c-ed60-4064-bb23-b10ebd081dd7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3fd6f8-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998295, "uuid": "ce9c92c1-21d8-4f11-a8e2-adc5fcaaa0a3", "comment": "Malware payload (Formbook)", "value": "e39a581f34adb8afd14499de50f4276e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998295, "uuid": "ed9cc02f-b7c3-4db0-9fde-347e844da626", "comment": "Malware payload (Formbook)", "value": "581c56d24fa3b9fa4d7e3d3e62b1b66206a8ec8b4ee35e11c6dda562f8e6e639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998295, "uuid": "f9e39376-cdb0-4c16-b694-f0936d5061b9", "comment": "Malware payload (Formbook)", "value": "ebdf51284e43e7a61cdb32491b9467110e68420c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998295, "uuid": "d89b528a-7c4e-4525-b850-2002b587d819", "comment": "Malware payload (Formbook)", "value": "337a3a46474a3464ec94da326e977291eeb88bb1b3fe2a365fba2a445c1f6b2b866616dc1b55c415be4f04de7ed473c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998295, "uuid": "e15dabb3-6419-403d-a58f-ead585619dc2", "value": "T1F6D4133226A92F2BD0BD8FFB4141691847B4352B90A4E31C2CD166D73C74B1A9B73797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998295, "uuid": "5a6b4796-48f8-490b-89b4-d8dfa36baebb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998295, "uuid": "fc6217f3-5bca-4496-973c-371c8628342d", "value": "12288:7DeC0h8ClfF6cbSwcq964DukVab3hHDJ:7D5S/2uHcqooukVab3hHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998295, "uuid": "e6782bf3-d8ec-4c61-808f-ff38a87bea08", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998295, "uuid": "9e35f2d9-a052-4bd9-bb2b-bb93867c0eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998295, "uuid": "ffd7b3ad-a95c-4cb0-af0e-735c8105b6c2", "value": "ESP2808Y6IN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14914f85-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981260, "uuid": "8db612f8-2aca-44aa-848f-503b57d6515c", "comment": "Malware payload", "value": "2b266796b23eeb41cc6e241457cbdb2b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981260, "uuid": "c6cf86a6-295d-4b94-8c8f-0a3671f767ea", "comment": "Malware payload", "value": "58d63ebe5455ed65f2e95c5bc0c9ed924f19bec1c152b0d2bc13704a4d636eb8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981260, "uuid": "b0dc705e-9e69-4cac-8a74-141be4ae6674", "comment": "Malware payload", "value": "228d5b97660bad76dd901cc6c20f32c9d07ce8a4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981260, "uuid": "0df14421-8eb8-456d-93a0-162452ac53b2", "comment": "Malware payload", "value": "0c50abbab686f60993b68fb0711b5701bb7a95013e5c2f4d86b5ba2c57c7cf6e66a15b6a5fe887576d09f02b5f947b22", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981260, "uuid": "95941369-2395-4893-a82b-33b85dfc61cd", "value": "T11E7285439F821121E004BD32A85FDF14126476F14DE1DE68BEEB220F1ED6FA54930A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981260, "uuid": "302ca63a-cc32-45a6-aafa-8345265b0ac5", "value": "48:gxKImURLUGEXTIrmWqXPc45DicR5CE8cnXz1nvkjHvDe3qRtPrPYoSSax1:Y39mDPc45DhPw4BnvEHvyaLP7sSK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981260, "uuid": "da4ae7c2-41a6-4fd1-9fd3-9623b44e9efd", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981260, "uuid": "5d6c53a4-2c88-4644-b462-63b11d259841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981260, "uuid": "006a3c17-4107-4b83-8824-daba51fc557e", "value": "SecuriteInfo.com.Trojan.Renos.Gen.1.17308.3389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453611cd-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698998092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998092, "uuid": "68b3e8a4-5a5c-4ca0-a5a9-831b9612dad3", "comment": "Malware payload (AgentTesla)", "value": "80fbcc33eca014d7ad93783d4af9bebc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998092, "uuid": "e80d0cda-3822-47be-b2fb-d32e68731498", "comment": "Malware payload (AgentTesla)", "value": "5a483a0ae514500aec546af831eab805ee650a2fbdc530edabee06b69e3cce76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998092, "uuid": "2e7582e2-3fc0-4df2-9b4b-cdeefd4c9acc", "comment": "Malware payload (AgentTesla)", "value": "ab9f5f2f4c0a5906e241f74d944cdcaf8392a21b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998092, "uuid": "c6221b3e-5ce1-4f70-99f6-94e1e9a8a54c", "comment": "Malware payload (AgentTesla)", "value": "fb7acdb1cc9552aca7cbee6986eb6f0a7cc7f4c6fe2c1a09e53c0599b7a13db40e9ea3b1744fdfe240a4ece42e1a40ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998092, "uuid": "c85b7fbe-572e-49c6-b71b-8308a22a6177", "value": "T134059C1675B28571DE45EB35C5E24A0083A7ED456BE2D629358E33ED0B333BE8F03682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998092, "uuid": "284384c7-7733-4ca3-978b-f846901c43dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998092, "uuid": "628177e3-97c3-4f46-9784-09b606c14d9a", "value": "12288:TtvNj+go0sBlfz+6UEdq/msqo022opvpLQ9vHHtYC:TlNHIlfz+rEd0msqo022ozQ9vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998092, "uuid": "35988211-4d75-4f87-ac95-be9b329b3115", "value": 842512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998092, "uuid": "e3c81849-7948-4db6-ac59-5868ce36d785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998092, "uuid": "c8b38a8c-0bd5-4c60-85a4-8856fe8c81da", "value": "ORDER LIST_NOVQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf3caeb-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698998316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998316, "uuid": "b7c99940-2103-4488-ad54-0b33e0792dfd", "comment": "Malware payload (PureCrypter)", "value": "a930bf6622687ae632e80e872807446d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998316, "uuid": "cf28e16e-35ac-4d3d-8e39-c615d8583a3a", "comment": "Malware payload (PureCrypter)", "value": "5a8be48c495657987146e363d264f68abe735e5477a7e05a32339c893678f843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998316, "uuid": "957cce91-a74d-40c9-b49f-dd14a28e5827", "comment": "Malware payload (PureCrypter)", "value": "32bde04ff7a6b24d27813ec755264cffc5566ec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998316, "uuid": "80cdda97-72f7-4d16-96a3-63c19bce5101", "comment": "Malware payload (PureCrypter)", "value": "9e6824c909adbc23fded32598d9b7f48e9a292d1e4676c11dce4dc90711d58e89b7b96c01c641d10a3a6201e74803f1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998316, "uuid": "39cc4c4b-9373-47d3-b87e-f33958976709", "value": "T106F3A952EBB6EF34CE24053FC284B7399F2E5E9181F27D8E314DB1652EB9D00C5446AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998316, "uuid": "3ab5fd2d-5194-44b9-aac4-55be6d8a7eda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998316, "uuid": "869f2636-597c-4b77-b8b3-6b65bbc809bf", "value": "384:kC/eEUOWmwww6BKpwWowwwlpESUJXtdhVm13jWtSHPWcAwaYe:ilRpESUJXtdhVm13jWtSHPWcFaYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998316, "uuid": "6682f16f-2ec5-49cc-b653-6c6f408497b6", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998316, "uuid": "53877d5c-091e-49a1-847e-6c857acfeb6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998316, "uuid": "7621dce2-bacf-4edf-a617-b512b11dbd9d", "value": "AQ-ZCVT-9363683NNYEEUYTSYU.SCR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1a3c39-7a47-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699015683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015683, "uuid": "90706efe-e165-480c-b35a-3ff84d7356cd", "comment": "Malware payload (AgentTesla)", "value": "c6a05186992276c5d043191dd5dbbda1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015683, "uuid": "f2b8bccd-f167-437c-8cc1-13300e5ca00b", "comment": "Malware payload (AgentTesla)", "value": "5ad4c423bab0c97fd3919958f2718b5f1ca9524c6389070b8803be6d5b2d19ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015683, "uuid": "887e5b04-7b82-4da0-bbb9-ca21ad082c84", "comment": "Malware payload (AgentTesla)", "value": "661ca3a3a378f116d5bed576ab60e068f46fdfa7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015683, "uuid": "ccafa3f2-7121-4a0d-a0bc-4b85bc208b5f", "comment": "Malware payload (AgentTesla)", "value": "93d1d47afc605419a8b71329bd48d93f3ba1a308da3320b9637ff888e3ad5c7388c9431786aabfd6a7896f167eb92451", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015683, "uuid": "688a0682-d51f-4d86-be93-731bcfe8ddaf", "value": "T196C25C2173D76224CA6E0F7388561A0C7235C789375BDE6B3888412EDF03BCF1B52A66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015683, "uuid": "c5daf332-a602-4760-ab22-1c99550199ad", "value": "384:08PAB/592BHr+jNLZHRvf9vwEG9/XwJwq6uJfq2GSLwqmWG3h8x+aAWsT+P3ZFpW:08PK/59usHRg2Gf3Klk+fZYFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699015683, "uuid": "43946894-14eb-4b79-bced-c64d0a7bb8ff", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699015683, "uuid": "e0e54929-9e92-4e2b-96ae-558387bc894b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015683, "uuid": "24217aa5-222a-44cb-86ed-b42cf7b56b57", "value": "5ad4c423bab0c97fd3919958f2718b5f1ca9524c6389070b8803be6d5b2d19ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fc06a1-7a26-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699001556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001556, "uuid": "fafe60be-1d1a-4d16-9447-59ed5e06e9ea", "comment": "Malware payload (Stealc)", "value": "c5413f26ad9d6a74ed7e649f8001da14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001556, "uuid": "1538cdd3-fdb4-48bd-86ad-86bc0fa89978", "comment": "Malware payload (Stealc)", "value": "5aeaa349b8e610123b2093436bbce6b76f4a6cef193c266dbbc6888fdcac5b5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001556, "uuid": "dfbf6e17-47e2-4c89-9b32-d99db29b4cc7", "comment": "Malware payload (Stealc)", "value": "c9a29a2ff83c8d0be0f84bb4d0843906e1574501", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001556, "uuid": "d2cd1ebe-2438-4a8c-9d3f-08fc8659e130", "comment": "Malware payload (Stealc)", "value": "a97738d13ee28a3a06e58697c17fd755e103618f055b383a98ce61a7b6b99ff765bc6cf68ceec92b92dd5f75a0f154b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001556, "uuid": "c64fecd9-8496-4920-90c3-d4aefd49c1cc", "value": "T108443B7352F17C62E526C7328E1EC7F83A1EB5608F5537EA12659E2F09701F2C26271A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001556, "uuid": "4a59cca0-265e-4807-b85c-170c561116ed", "value": "ee827750429cc6977e10fe712ee76a8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001556, "uuid": "e5685f66-1c25-43ed-8a1d-9d915d67924a", "value": "3072:c6AV1FzxlNgX9Vo1k5jFI0J2qVr7RMFC/Tfuzs6sWHxd:y1Fzx4X9m1k5BdwqVr7SuTfuAtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699001556, "uuid": "85f5fc66-08fe-4366-828e-b1cf66045fd4", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699001556, "uuid": "5549daae-e8be-46b4-b424-ef1f670626ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001556, "uuid": "d37f529b-33e2-4f96-85d0-b3f4d8e98a52", "value": "c5413f26ad9d6a74ed7e649f8001da14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2ee72b-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981251, "uuid": "f9c91407-f9e7-402d-8d2e-121f5779d2ee", "comment": "Malware payload", "value": "5b0938a02b26daeaf5bc2e32b4bf230a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981251, "uuid": "06021075-2282-42e5-b6af-2a2681592e04", "comment": "Malware payload", "value": "5bc87bb01f0ff1a140369b3bbd588bf1a63e45f03349d15e56f4bbf81dfa1d5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981251, "uuid": "56e30838-a8d5-4947-bcdf-abdaa5d5f4b9", "comment": "Malware payload", "value": "1c129ff4d884a860b5848eee718d9e2c4d87ab23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981251, "uuid": "a7061241-0379-4780-8014-bfbe6641fb91", "comment": "Malware payload", "value": "889219666a1b789ac6170d666a1a6e00a8fa535fba4cb13e2adec88742df08b58c94064e70001e3e75623aacbdf57a72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981251, "uuid": "b3ae6caf-ca62-4112-b8aa-e8f1b4cdb9ef", "value": "T1BC456D71F261D082D6560A3349D69332AF78ED894F34CADBAF56FD2D3D33092993A121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981251, "uuid": "e70a8a72-0b49-4cfd-88cc-e0fac8137cde", "value": "24576:BvgxenCojkph7XhULSGqQbRPcBdJFsd6GxtQF+:Bs8bREUxQF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981251, "uuid": "499b581c-4a4c-4051-9761-716ae3182091", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981251, "uuid": "1ddc9579-9286-4691-bef0-4288ac3a8e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981251, "uuid": "e1e67fba-2000-4d03-a2fc-c6a6b5e1e8fc", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.18499.20002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a56a0de-7aa3-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699055331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055331, "uuid": "f2f63ff6-dfc4-41d2-b54f-e8e6cb940858", "comment": "Malware payload (Mirai)", "value": "ebb26bc3af238aebc1fae50d134ccdf8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055331, "uuid": "51555881-a491-45fc-829d-ed3d3174319e", "comment": "Malware payload (Mirai)", "value": "5c45badcd5e0057ef7fdcbd5e4c0def3afac7be45402b68fc554b2a8bfd5a0e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055331, "uuid": "38d63169-fa68-40a8-82e8-cb6c98445f0b", "comment": "Malware payload (Mirai)", "value": "1823930380497ef3c435896586809ecdaf565fcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055331, "uuid": "da76ff0a-1f86-48f2-a571-7fe6541c3b40", "comment": "Malware payload (Mirai)", "value": "d7bfb255f9ebdaa402aa1228ea88b0b2a39221df20ae033c2139183c4dcf74809758e66b686722cbbb39963f8d820e14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055331, "uuid": "bb4bf0db-9cd7-4801-b820-c7c43fb193cf", "value": "T18C230261890E9EB124303C76DBD9D79376E11AB1C5673013DA280A3C6FB97131E5BF4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055331, "uuid": "246e3bf2-0a29-41ea-9848-9dec4bdf3f90", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3V9q3UELbUXfi6nVMQHI4vcGpvq:DECFd+A6YHAxoLRQZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055331, "uuid": "b76d5e15-987e-4f3e-bf6f-1856ed039316", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055331, "uuid": "9cc38a9e-9ebd-4b20-835f-bf38ffe6352a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055331, "uuid": "ff820311-9d5f-47e2-935a-ea5e108907bb", "value": "ebb26bc3af238aebc1fae50d134ccdf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89077e1f-7a9f-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1699053611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053611, "uuid": "d0dca3b6-9574-4a69-a719-05f20efdcdce", "comment": "Malware payload (CoinMiner)", "value": "5d26beb8eae1bcf1ba1fc82359f06df2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053611, "uuid": "04c72e9e-decc-4dd3-b721-536930df3a91", "comment": "Malware payload (CoinMiner)", "value": "5f0a841a24fe65880413ade13e1f90e07330640f5d0e8e06509a22201c4cb1b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053611, "uuid": "8ca901c3-5e87-400f-ab31-b40c415371be", "comment": "Malware payload (CoinMiner)", "value": "430ce67550b5e47fa486b16b54ff1f87ff87be28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053611, "uuid": "74b76323-54e7-4492-9e60-ad9645f3e24e", "comment": "Malware payload (CoinMiner)", "value": "17acf6914f7a804c6b8bd4d080b6ee35cdd37be4fa84490c919ea2dd01f480a2e9485a3ccd58e933a9c857c50b044039", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053611, "uuid": "bd988631-7f9d-4073-b55e-e9b4aad28b32", "value": "T17D05D0552603803DECC65DBADA70F3829B6A55F11D91B3DB7280BE14E6EF3912B3311A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053611, "uuid": "2c14ad9b-4ef1-4a5b-a5fe-642fb3e8a6ef", "value": "1c05bda56b45141cb2325783d2af620e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053611, "uuid": "57095527-392c-44ac-a797-66c23805ce63", "value": "12288:kPoLpN82bScWfTvDb1XY7L7ezvBq0mBb3EKR234sLw5P6fyxEEi9NgyUI0L:dN82Mi34HsbHL5P6BEi9MI0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699053611, "uuid": "f893366d-e584-4238-953e-73be88405f43", "value": 806712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699053611, "uuid": "16713556-bb40-4119-a623-f240f37268da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053611, "uuid": "7599eb25-4aad-47f0-9d19-702471ef4bc4", "value": "5d26beb8eae1bcf1ba1fc82359f06df2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40ae3ba-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998305, "uuid": "2c984470-de3d-4362-85cb-2d29d6e731ed", "comment": "Malware payload", "value": "b936237b430d3b38dd4990c307221fe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998305, "uuid": "78cefd03-bcbf-4f10-a5e0-a867ae82ad92", "comment": "Malware payload", "value": "5fdc4c3758b0a4dfb40a6a02b3a8d3dbdcc457287360fda01dc9f3fec62f532c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998305, "uuid": "1b723fa5-55d8-4eca-985f-126ba3fc4141", "comment": "Malware payload", "value": "ada8c53a8cc6a41d564f792f4536c9638224785c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998305, "uuid": "066a1f15-580d-4e7a-96ce-345a046befc4", "comment": "Malware payload", "value": "d8edf987141209bf08c25a32f122bf9be7a7eff60ecac8e66fccb3a946c1781c057864af41995278c24769ff6ed86684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998305, "uuid": "99ddba35-f060-472f-b4af-d57926ef0e4f", "value": "T112347215D7FADE39CF2C4D3B81447210BF7E8F4A42A6F74A2E48B4A46F77B848544292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998305, "uuid": "4e710e86-fca7-49ac-9276-301216e94b7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998305, "uuid": "2f537b6d-93fc-41ba-9e8a-9b3dc8a2cf1c", "value": "1536:3dgzAFX9XziLxjOEkKSrB9Xj7HofOAIJu8QRwd4iq/3we7SH:NGAFJwV4zz7HofOAJTqd4iAge7SH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998305, "uuid": "baa26dc6-a3ab-4816-8eba-3c10e9c47fb3", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998305, "uuid": "97076d08-4498-4762-b56d-b8009ba83b80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998305, "uuid": "42396227-2e07-4f43-9551-656e79b1d4b4", "value": "IMG_03987365367389KJHDGFGDHDD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181e5ccb-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998016, "uuid": "a631192d-75d3-42f4-ad00-893b796d5606", "comment": "Malware payload (Formbook)", "value": "708eca0b24560076eed0c186f76ab19b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998016, "uuid": "1e99c522-2ab9-425d-b64d-344879f6bd74", "comment": "Malware payload (Formbook)", "value": "5fdda4d6b9e259f64f6c95a8e623993315b0f3226a6f9be0124fb432e49ede65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998016, "uuid": "b5703314-236d-49b1-bce2-01c12bfc8b56", "comment": "Malware payload (Formbook)", "value": "7dadef1b3c3b5aa7b0f152a7ede766ffc4d15d8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998016, "uuid": "053bece9-dfcd-4067-9805-a1aab8ef9b34", "comment": "Malware payload (Formbook)", "value": "c11517d9fa11975db3f14a98a6d86ed2694592c11e364c3647ca23209543ec0c7325ece21f005b4a069e5d80fa7942c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998016, "uuid": "15d64efe-bf94-4873-9e06-f73ba311b045", "value": "T1CFD423553B2CCF26E46C6BF86598190143FDB80B7512EF781CE6B0C6EA63F110A66973", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998016, "uuid": "b2132984-1b99-4b7b-8b92-21aa9828d345", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998016, "uuid": "10a5bc6e-d664-4c55-9e6d-47ca35cf130d", "value": "12288:PIkk2bI5b8RQDVX3ZZa8UJC1FiucAhazUbyI4jbpHs7Owz8YZWp:PIkdbRSLZa853hazBfbNs7jz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998016, "uuid": "3b05dbd9-9796-41cd-975e-6624f04d7dbd", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998016, "uuid": "1b719eca-aad5-4bce-bf41-0faceca9d05a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998016, "uuid": "fc044a6a-b7a1-445f-9c37-72e0cfe24cb0", "value": "FedEx Express Shipment DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521f1407-7a55-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699021736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699021736, "uuid": "53ce0e4b-c704-4fb7-9b44-1984a718cefb", "comment": "Malware payload (AgentTesla)", "value": "a3f2c734bc39dbc4bb09273a3cd44f1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699021736, "uuid": "8f94fb4e-7733-4af5-ac8d-f8c21a0af081", "comment": "Malware payload (AgentTesla)", "value": "6289ccd8121caf8808c91f229e70b4275af6452ef74f507e9919e09c38b02e44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699021736, "uuid": "9c82055c-8655-4b03-bb76-3296867966c8", "comment": "Malware payload (AgentTesla)", "value": "0bb380d0505434901da5245e16d65b14ba7924be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699021736, "uuid": "59e87272-1af2-429b-8c2c-05e19649bb3d", "comment": "Malware payload (AgentTesla)", "value": "0f6ae800635879c0142cf3e562ca3db21cb71a753b55f629d986d09727d16918b265fbf9e49dd37bed34c86b5a938f06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699021736, "uuid": "7e3f1ba0-fcba-4897-abef-9719231173c3", "value": "T11D55234082F95124D6DB66F94FB092F681F66FC2AD22F223CD81A2E5743DDE756C090B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699021736, "uuid": "4fa0daf4-ee75-401b-ad83-118b4cb48a90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699021736, "uuid": "22a624b1-638b-4db3-a7e3-f83c7904efc7", "value": "24576:vQ/uT3kPjfaq9fB3BAuxL9Fkud3J4SaZmKThIQKTN4Lbnrdfhxt1g/:o/xjymfB3BAueAJ4Fg6iTNsnrdJxt1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699021736, "uuid": "1f497b20-d28a-4aa0-99b0-2ae60b581108", "value": 1388544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699021736, "uuid": "d9e8e2e5-273b-440b-a718-5d66a6a911e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699021736, "uuid": "a4e04e8b-5b50-4b74-b095-5256f0e72762", "value": "6289ccd8121caf8808c91f229e70b4275af6452ef74f507e9919e09c38b02e44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628e70c9-7a41-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699013174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013174, "uuid": "d67c2e84-4095-4127-bacb-aef94b39e674", "comment": "Malware payload (IRATA)", "value": "d0423ed4e6da61e96546866d14418167", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013174, "uuid": "8e555fb6-876c-4abd-bc51-f6199ad90444", "comment": "Malware payload (IRATA)", "value": "62a8bdafa94a0128b2db2f1099ea0a545b4777aa839d1a83a7d7a55403c05f3d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013174, "uuid": "6768f199-98f7-416c-8f06-cc886bf5a3f0", "comment": "Malware payload (IRATA)", "value": "87c81268d850f8644721871d79a4583ac21d649e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013174, "uuid": "8fc6e835-9aeb-4a3b-8ca6-d19a03209276", "comment": "Malware payload (IRATA)", "value": "01be591d566e1d713de49f41b59e12d85722af8d1d28edf192dfa4af7950acc194aa7b778564bdaea1309633eb1838a5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013174, "uuid": "cafaee70-953b-4095-a73e-5a908f9fb907", "value": "T1C5E5BECBF7E8692FC87750B2896E52B562574C028E879F476C44371C287B6D82F49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013174, "uuid": "366e3a84-80a6-4126-a4fc-6506ab00248c", "value": "49152:5nsB4Mvnb6Ilq8xDIg2Uzs4Qzu1D9MXssYp159p+UgLCr8SWdvGr:5sBLbrRkWzSG9ess+1FgLCr8Swe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699013174, "uuid": "76f0e247-1328-40ff-b676-82fa539c5f05", "value": 3313218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699013174, "uuid": "2f5ae37d-10cd-4cdc-8a2e-197cce4cfb02", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013174, "uuid": "b3746567-a5d1-46ca-b0dd-0510cf9b52f2", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51269331-7a45-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699014862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014862, "uuid": "013ce07c-0400-4973-ac3c-3d3330f15d3b", "comment": "Malware payload", "value": "e1ed545778252382032d463be70e23f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014862, "uuid": "e899c0c3-2315-4c3d-8831-0a5734272ff0", "comment": "Malware payload", "value": "62f276a99cf0b293a48bdaabf921a83622ceedc925f8def2dfc7195dde33891f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014862, "uuid": "6142d470-e31a-4759-ae41-dc6b426ec587", "comment": "Malware payload", "value": "3eede0ca26bf8774abfcd4b822a02d8ccffea9fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014862, "uuid": "1b8ba354-b47a-489c-87a8-a8d8edad80c5", "comment": "Malware payload", "value": "7a176544bf1de0687155b6acf56080f8519721ed4be304b3bd216c94c6daca5149ad1907b74d5575f0733fa88a5d8166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014862, "uuid": "396ec6c2-94e7-452d-bf2e-4b8cde2bbb63", "value": "T17C64B703BA9BC5B1D2951B3AC9EB300007B5EA8576A3D70E75CE23D51B437AA9FD0607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014862, "uuid": "2cdcf124-25f2-4dbc-8008-81857964d4a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014862, "uuid": "978df517-1e1f-4e8c-97b7-224cf959bfe7", "value": "6144:ajHo67VhJo20EobZWLfeUAMk7P2g5xhwRRK0huY4Z0uXbOtlVxXFlIJ+rIWN:8HoK3GhEDfeULkqg5zwRRK0huY4euXbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699014862, "uuid": "48a2c659-dac3-429c-93ec-7c32dce9962b", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699014862, "uuid": "92ee9a4b-6bd8-4ebb-96f8-6004362d3df7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014862, "uuid": "8ec15fdc-e60d-4bbc-9429-3e51b716651c", "value": "62f276a99cf0b293a48bdaabf921a83622ceedc925f8def2dfc7195dde33891f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4641c4e-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698997070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997070, "uuid": "fea7a4ee-7dcb-463d-b1d3-de8deddb0645", "comment": "Malware payload (AgentTesla)", "value": "390ac019b9dc594fa1afdbb72bf81072", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997070, "uuid": "f4711683-814f-4423-b2ee-d86f25ff7cc3", "comment": "Malware payload (AgentTesla)", "value": "66272ae90001d1e0cfb2fd69147fce4a8b3cc1a5d411535effc649c8324eee62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997070, "uuid": "2cb4411c-ea77-4307-8707-4f99cc373cc9", "comment": "Malware payload (AgentTesla)", "value": "e058bec0f73b3e46cc106bcbc789527941ab6dd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997070, "uuid": "b404981f-13cb-4abf-aae1-3067d226b5c8", "comment": "Malware payload (AgentTesla)", "value": "77c638c18b95daeb7762f40bfe79986b8aa52a5462097d77abbe6a2c39c996aea986b143205180570e8fbc696d64a9e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997070, "uuid": "4dd5b711-bfb4-4f05-928d-a42b334fa61f", "value": "T1FC25F101FA818616E84847754DF38A9A1366FC50AF9B460F324DF71F3EF4AA06D23A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997070, "uuid": "959fdbf3-cb9d-4a21-945c-3011006d3be3", "value": "24576:12Biw6/J3bVSw6/V3bVujmCJfugYUynW6LBIdhwSc:U6/J3bVV6/V3bVuCgfug4W6dq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997070, "uuid": "f1f81730-8f77-4c26-9053-bbab88e4d011", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997070, "uuid": "90bcc11d-ebb3-4d21-8ae9-931cd2735434", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997070, "uuid": "f10b61c4-b6ef-4d37-9ec5-164f6ed597ff", "value": "REQ-101.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf565ab6-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699054990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054990, "uuid": "01319231-e47b-40dd-8125-e2d4a543b66e", "comment": "Malware payload (Mirai)", "value": "1192b58f18aaf6712338311fa1435763", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054990, "uuid": "8cf8c5e2-295a-4ae7-8869-6bf1edc6d6a7", "comment": "Malware payload (Mirai)", "value": "68306e95dced9335d4ef34052b615648129f771740ae7f104531c39fb4bba239", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054990, "uuid": "96238d37-c2f4-4818-a0ca-9fc07dd65a81", "comment": "Malware payload (Mirai)", "value": "514323af931fede772da745079309dcd168899d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054990, "uuid": "1e438474-ac90-4bf4-a8c9-be468aa900f6", "comment": "Malware payload (Mirai)", "value": "a6ce46d6dc989c6fcc3db23f51cec4b7b9ed745f60b37f0debd6dfc14a91de33fcea0e8429983be896a0ce96ba891eca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054990, "uuid": "1f7e97a5-e850-4a68-a0ae-93a60e8d1e96", "value": "T139C2D120451BAE12D2307836E57C426B1F6956ECE1F7B17217295F14AEC2002A9FDEC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054990, "uuid": "d915c811-5432-4a25-b07c-d0dbb3508e2a", "value": "768:HZ5DJvjb5M8CqaV9Yr67ie+8KEnpgwkChgJo2159q3UEL7:5NJvpvCqu9YrTePCChTL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054990, "uuid": "a3b938d1-edf4-4f7c-b522-f3e413d44f5c", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054990, "uuid": "84232ee5-1458-46e8-8360-a9f08961af22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054990, "uuid": "8aa80809-43a0-4e2a-962b-6bff6bf16e0e", "value": "1192b58f18aaf6712338311fa1435763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0bcb3c-7a6e-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699032441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032441, "uuid": "8431b28a-2f14-4345-85d9-98f583973b6e", "comment": "Malware payload (Smoke Loader)", "value": "6e1dae122aee6095a3c0fb3b06b588ec", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032441, "uuid": "a8fb23d2-1c11-417f-a22e-22fd67be2897", "comment": "Malware payload (Smoke Loader)", "value": "68f5eee3b2a9ece7df774de37fe6108d6417aa4d5f1b83fee96d69e3336bdf09", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032441, "uuid": "5cc70ec3-d379-42b8-a478-511fef5b6318", "comment": "Malware payload (Smoke Loader)", "value": "9f888334ee16faa3b14790aab044baa46b02d09a", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032441, "uuid": "17e43cbd-14df-438a-8a7f-7680b6312ca9", "comment": "Malware payload (Smoke Loader)", "value": "73f5c51573448e607469a57fdb8f4de8ed853e80a0f2aad0326140ba7ce4d86b4878883b57403e27f7f0a71e46040089", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032441, "uuid": "79ffa75d-756c-4ae7-9c55-54bf1ac2b348", "value": "T1A0A26C6D034FA8F89773ECC88AD5AC53FB74862A4A6CDAC49F30FEEA241117490E551D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032441, "uuid": "18f37aa7-f025-4096-bf50-b22646c660d8", "value": "384:1Y3OEHzRQ0hnqjE+fhcwrglllTqp/IHJ7cvGQePDIVuEaEt2pOBID:FWRH9TrmaxpsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032441, "uuid": "bb9d1c9c-07c4-4d54-a62b-acf62c8c05c2", "value": 23365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032441, "uuid": "8bd61f3e-318b-4afa-aae5-5aba9d740957", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032441, "uuid": "ac4fb068-5276-4e72-b792-e9ad2b865558", "value": "\u0420\u0430\u0445\u0443\u043d\u043e\u043a_2084121_\u0432i\u0434_02_11_2023\u0440.XLS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a536478-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981270, "uuid": "39a71e6d-e46a-4575-af65-3e6ef3363c3d", "comment": "Malware payload", "value": "cc0e1fd0ef84a21c7fab685b7e900012", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981270, "uuid": "5203fc89-e2b7-48e0-a4b0-b80b71f012e8", "comment": "Malware payload", "value": "68fdbed8f469e6ede759a29decf7e75b5b5f470d8e243cabda0476f5bc49b3aa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981270, "uuid": "a13ef119-93c0-482d-9e11-f8c25e6de35a", "comment": "Malware payload", "value": "69c84de70b42e7e0d928d988ef16952d48c22715", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981270, "uuid": "e183ed2f-08f7-41cf-a4ed-c2d86a2b147c", "comment": "Malware payload", "value": "50cb8d16dd2ce9a9ea3a0532d7ca1cdc1fc79a1713abf2a1c27ebf6c34e2699ee99b87199dc06b3174b73c116e45af2e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981270, "uuid": "c0b9f6d5-ce39-4364-8e29-a9007b110982", "value": "T15835CE9877B3FAD9D53A05F4C4A1C268E8564D707C64C1479E38ABDC27320682AFE4B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981270, "uuid": "2b449c32-7914-459a-8e22-75b5620c43e6", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981270, "uuid": "5acd8b4b-9986-4e69-a257-0dabe70647c8", "value": "12288:+R5nWFpPoS/wirbukTkHQ24JyWomcpKVQrjH7meGdho:VbVwdkT/tyWomcpKyird", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981270, "uuid": "d41117b4-b7a9-418e-a898-7343fcceee05", "value": 1122688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981270, "uuid": "87653e53-b32b-4f41-95e1-1e1814e1c439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981270, "uuid": "6321468d-07b7-4ef0-9ad3-8232949202e5", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.26018.5193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a501c1-7a51-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699020098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020098, "uuid": "c122d27b-9de0-4db8-9732-56b128a81983", "comment": "Malware payload", "value": "c2099f26093aaa7a9feeed419f20d672", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020098, "uuid": "b4be2160-ca8e-489b-ae02-ec4868a33091", "comment": "Malware payload", "value": "6a0b1eb4ab800a30064227310edb5aec07360a47673460a8de060995e8ecf429", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020098, "uuid": "fd6ef8d2-d6ca-4d47-a3ac-1ccbaa4183de", "comment": "Malware payload", "value": "08043f3d8c9558ad17669460f5d2ce6339569bef", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020098, "uuid": "5bccf0d9-e437-4ead-b6e9-e5a7ab99e248", "comment": "Malware payload", "value": "d52fa3723de4e2e4c28cbdbc76077ee8b09bf062cd3a1314ae40f0abccba9812222d9fe448cdb15e30c41fd4927d36ec", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020098, "uuid": "8fead49d-5870-40eb-a6d6-5260c51bb425", "value": "T1339612496F5AEA12CD040230D097C1F72B45EE9AA623D3335BDDBEF331833855B99299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020098, "uuid": "f1e46d4b-d194-4b29-9b43-d6fb850907d8", "value": "196608:GYG8SIwhSKe2v0Dk8+MQubojfmBM7i/r/YzF97BQJZQtzv444O0o8fyR9eNNddTJ:GYG8SIwhSKe2v0Dk8+MQubojfmBM7i/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699020098, "uuid": "e0a64d1c-97d1-4641-9dcb-aaa5ef2f0d16", "value": 8711544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699020098, "uuid": "09fd97b6-e5a3-4d84-8e30-d990309029b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020098, "uuid": "93b9e80a-8f4e-4fc3-819e-ed16fd4a6f73", "value": "Chr\u043em\u0435S\u0435tu\u0440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7ef37d-7a1d-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698997918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997918, "uuid": "48f4fa61-a3b4-491e-8ead-9760b0c5a0bd", "comment": "Malware payload (MarsStealer)", "value": "1270a54cd698df5f7420ee5ab890383c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997918, "uuid": "688b3d71-05e9-40a5-8803-88b7572cc7fb", "comment": "Malware payload (MarsStealer)", "value": "6a8d89dce793fe2b3dece3e933914a579153c8b26761c128d3b550d6a5e48995", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997918, "uuid": "c7dcdead-5f37-4ef5-9620-ee8677ab0a25", "comment": "Malware payload (MarsStealer)", "value": "efefa87b3b780242b97768b3e11ad4644c421882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997918, "uuid": "0d878c81-df10-4580-8d9d-28111819cabe", "comment": "Malware payload (MarsStealer)", "value": "b312d1274b919f485b430989e42ddc838cd119e008fc753896acf9fe8bb77c3e98df544b08ff535ff371d4adfa659f28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997918, "uuid": "777ff823-4189-48f8-a0ff-af60118f1157", "value": "T1AF444C7392B16C62E526C7328E2EC7F83A1DB4608F5537AB12659E2F09711F1C27371A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997918, "uuid": "25223d2e-d9fa-428d-8a37-3e9fce873bae", "value": "ee827750429cc6977e10fe712ee76a8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997918, "uuid": "6d3df3ab-671d-45ab-b89e-dc3629a15cbb", "value": "3072:bPKVoZexdi6X4V/1oVBnFP4+2qqR7ZWawlsW449:eoZextX4V16BFUqqR7ZW9uW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997918, "uuid": "13cef651-986a-471e-8ea7-07c88de0bf16", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997918, "uuid": "aef1b849-b068-4141-9599-6f1da13fc111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997918, "uuid": "0162fb28-35be-4799-9cda-93d9c4c46e94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f49a2a-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699032939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032939, "uuid": "57610483-4475-47bc-8f3a-293d2754c905", "comment": "Malware payload (RedLineStealer)", "value": "bf85e5d13200077c89650c3c2fb48a84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032939, "uuid": "f4f9bbc5-755e-48b8-ac20-08bd7dce5dd8", "comment": "Malware payload (RedLineStealer)", "value": "6ac39889666cc354bfebf0a08e1c458ce3323464550929b32ec2071c493bbaa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032939, "uuid": "abd3080d-c426-4dea-99ae-8c6dc123f0fe", "comment": "Malware payload (RedLineStealer)", "value": "deb844cc32376b1bcfd676adad862c943fa938ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032939, "uuid": "3ee82b5c-7eca-413c-bf64-18ce4f874f5d", "comment": "Malware payload (RedLineStealer)", "value": "c36285f5ca6048e093fd5c8b6b7a979a177d612485c19c1329fbe54ef56dfa6608ec5d96efb323b7e945d4c5e3dcb057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032939, "uuid": "6235fb35-e35e-424e-8178-3d1009cda06b", "value": "T13CF629C7F85511E4C1ADE37486668262BA703C895B2023E72B60FEB52F33BD46E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032939, "uuid": "7a58bd8b-62c1-4fca-9707-3b70be35ab34", "value": "85cddd6092e65c1a58dd1e6e9ab9fc63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032939, "uuid": "ee5f3ebf-7318-4b79-8fcc-c9d96ef7b862", "value": "98304:zssv7Ac/2O/MwBrFUGzudVZsEqOcOrOdzcKCVgXFHTYlrnhONkgP44iB:ww1M3dVfqOcOrOdzc9VQzghOeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032939, "uuid": "1cc6a587-ee45-4206-80e9-40916039f111", "value": 16065537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032939, "uuid": "3a7d43ea-85b1-40c4-ae46-4eca30b21d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032939, "uuid": "3723912e-3fd3-41fe-83ba-04df9a8f7fda", "value": "6ac39889666cc354bfebf0a08e1c458ce332346455092.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200cddb5-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981279, "uuid": "9dadeb6f-dd08-42e3-9b12-799c90affab3", "comment": "Malware payload", "value": "e64e7f97e9efc38453d60451db5ada3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981279, "uuid": "1ece22cd-b66f-4f7e-9bac-78472c94c82c", "comment": "Malware payload", "value": "6b80cdf715e4a596e4b83a157a78aef69c8f900bd1f39554dc378a6ba007b752", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981279, "uuid": "f0833f58-8996-4fdc-a07d-a346fca24fa4", "comment": "Malware payload", "value": "3b74bc0c9afadbf8325c7fa2f51b80d2fc1165b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981279, "uuid": "a3177216-89a8-404c-b395-c6071dd9ac37", "comment": "Malware payload", "value": "101f5b377833738af2fb6885aaedcc0c3732f25932c77e1b1f34c3abaea3a24b5999a6a17f811f86fd2dc44e4ccf80be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981279, "uuid": "f6f1b094-31b7-4208-9be2-4ef151e648af", "value": "T1E6E4AE6B10070790E7795370CE19346785E83419BC97DABBFDE92AC205F96F9E06EA30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981279, "uuid": "3df68975-7873-4def-a44c-7d5319e389cd", "value": "50610e34092d6ce13e51e7c9d5197081", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981279, "uuid": "1aae7376-133d-43d2-944f-f4f3d5816bcb", "value": "12288:ZUWA3Aheuswym85pRbib/w7z5VPWR6J1yTSQtf8Ul5RmogA2wfYC6CN:ZUWqistm85pRb0O+R64tf8Sdhfj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981279, "uuid": "853038c0-089b-4d8a-963c-48599ba35b55", "value": 659284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981279, "uuid": "04aa1ba4-ee9c-47da-a509-af0bbcd53973", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981279, "uuid": "ae04903b-dc06-4f8a-ac20-282da4190456", "value": "SecuriteInfo.com.Win32.Trojan.Dropper.Heur.30301.16221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244b6f51-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981286, "uuid": "5523fffe-5be2-41e1-ae0f-c47445340837", "comment": "Malware payload", "value": "73da08f36d3390cd37c0ff9babdef941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981286, "uuid": "7d0e58dc-d197-45be-9a79-9a1fec9be514", "comment": "Malware payload", "value": "6cd533175c97fffb2440537118e4708fa74ac6d52d70d0977cbc92cbcc566315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981286, "uuid": "0628b26d-0c04-447a-a839-8fcfa0fda69e", "comment": "Malware payload", "value": "1abedcb9b4b5397c29283de9b9774e509a7d3ddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981286, "uuid": "ef66c0d1-2acc-4e1e-b9f5-a7c9297dd393", "comment": "Malware payload", "value": "e6945103e50774afc6d575f6b07d7213be81789b6362833c748df97df503ffff68f1ba14baa9da56235b533100475a60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981286, "uuid": "79e6ef38-0736-45fb-acd5-664b5fdd9a85", "value": "T1C7A49D11B7E1D076D55201320E97C765A6B1BC809F2942C73BD83F2E6F70AE19E3A762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981286, "uuid": "57726410-1aa6-488a-82a9-110838142bcd", "value": "12bc5915185725663f799f98ecf13c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981286, "uuid": "013a334e-f934-4873-b210-8275cf93d55f", "value": "12288:fE+r0MkW9B8joYvwJoF8B26PwbX3W4eLAjbhw6h:cjhvwJ9I8mW8bhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981286, "uuid": "4de03c10-3201-48d6-8014-7e69949ef268", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981286, "uuid": "6d6efd90-46dd-4ce9-9f1b-c769839cc7e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981286, "uuid": "0668a06d-368d-4e84-a946-b28b776784e7", "value": "SecuriteInfo.com.Trojan.Win32.C2Lop.5289.9398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83df378-7a58-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1699023303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023303, "uuid": "269fd94b-38bb-4142-bf63-50a1455f8b91", "comment": "Malware payload (RemcosRAT)", "value": "c510482b6e33eb51c5104546f057087b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023303, "uuid": "11c79247-0596-4fed-b2fe-ae283b3b56e9", "comment": "Malware payload (RemcosRAT)", "value": "6cdd7bda126433118105c02651645c57bd7d360eddfb7bd98e7f0d12a7de3d9c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023303, "uuid": "785de0a8-5ba0-4df8-a8fd-97d2d64e614a", "comment": "Malware payload (RemcosRAT)", "value": "0bef49a7790f31f5c3f7316b206276b8038b3bed", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023303, "uuid": "802f12fe-f121-435d-a533-11180fa589b4", "comment": "Malware payload (RemcosRAT)", "value": "abc6beda864dc43ae25647909b4da7b283333ae84c9d3f7f92597eee437eb13c2aa449b0e52c927016756935b9749cc2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023303, "uuid": "fa3ddac5-6d34-42fb-a935-29893ec5b367", "value": "T1670633668C38D5F4ABB92133D951B0BF1291327F7E3713A8843886F162ED2857F095E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023303, "uuid": "b55483b3-b2ab-4fd2-8943-408165d21b7e", "value": "49152:ZVD0C+3aSxXus8ui9qe7fBZrXWJVvHVh11fMxv/DnT4xku1XI2sOzF1ZIuuph:EtqS7BOL7PXWJVvENDxuNvsO51yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699023303, "uuid": "286f8fab-857a-44dd-a6c2-4e30e9fec89a", "value": 3693774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699023303, "uuid": "50530bc4-96c7-4358-afd6-7dbecf2fbe90", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023303, "uuid": "56999442-c8a5-4687-8bbf-a6cadf0ec5c2", "value": "OverdriveNTool 0.2.9 (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89fbebe-7a1a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698996594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996594, "uuid": "12eba9f4-f841-4cc0-ad90-8f1c298c98fe", "comment": "Malware payload", "value": "fb4a27b681adba4a5f44b4cb1a785339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996594, "uuid": "3d29db7e-9b65-4bb3-88ad-3ed681ff652e", "comment": "Malware payload", "value": "6eb1d4d070fca2edbf04af47700701204797f086387889e21fa44d0cb7856ab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996594, "uuid": "1b936483-9e9b-427b-97ac-ff77a4435ea4", "comment": "Malware payload", "value": "3dfd3f7a7ac88bad14c13a14eb6c5684a8e87540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996594, "uuid": "8dc290a7-25a7-4fd3-95a7-4fa50bad60f3", "comment": "Malware payload", "value": "6ff96c2eee05dc96ce106a3777b5869d09e0f97a9880d501e62129a8349aca399a067053b1a6eff7073229b96a83201d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996594, "uuid": "af5ee1b6-396b-4a1f-a9dd-78d8e1bbaa01", "value": "T10DC4290833AC972ADDAE42B8D045960CEFF0D125D2DEBB6F6641F7F8A802BD71A41457", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996594, "uuid": "89511c58-7f2b-43ed-a652-97d06b4b479f", "value": "12288:fhosubnkM03KOWoj0V9+Gl8fRPPHrYy9xzo:Dyk65YGq5bYeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996594, "uuid": "e47df92c-c1c6-4c20-9d85-829874001280", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996594, "uuid": "03158999-4008-41c2-9302-4860ef4d57e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996594, "uuid": "4eacfd4d-fce7-48d6-ba5a-d0a8f1e1f4ef", "value": "New contract pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86bfffbd-7a47-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699015811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015811, "uuid": "326150cc-a53d-4300-8928-ad1ec61b7ac3", "comment": "Malware payload", "value": "4579bf6be3911b41c0e022babe583afd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015811, "uuid": "1c0a47dd-b22b-428d-986c-f2af68ae0c4c", "comment": "Malware payload", "value": "6f32f4570da0fba5e060c5cf687e829603a5d1ff10194dff3f486f8190667899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015811, "uuid": "6fe3d04a-0687-46e9-a4a1-cb9fd291c856", "comment": "Malware payload", "value": "82ca4138818805f043ef2d676e52009280faf050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015811, "uuid": "fcbf34bc-9556-4712-a8bf-644e4ec773e8", "comment": "Malware payload", "value": "cbcc3a22eafe33f984bc423f11cc1261fffaa929c24cc3ff037b93ee8029650d780a9ac1bc4e1ed7311b16d1ed87f548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015811, "uuid": "db0cc9df-dd83-4bcc-9202-0fd40ba2d69c", "value": "T19B740807E35801ECD8BBA27C565B5952F77A78160362CBCF039081263F572D5AF7ABA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015811, "uuid": "85402edb-c151-4a18-839f-b23600de8535", "value": "a75d7669db6b2e107a44c4057ff7f7d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015811, "uuid": "5d700f15-dc95-4daa-a356-b637d2f44cec", "value": "6144:fCDsdJDSCnnC7vDtqh983KghUBeowoFbqMK7mUqO:0s0vD0X8Ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699015811, "uuid": "c18a2148-5322-4006-8097-4ab483bfc5e6", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699015811, "uuid": "654f1061-3b8b-4f2c-885b-d9353e63b72d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015811, "uuid": "7f130263-c93d-4682-90db-c11ad8240411", "value": "6f32f4570da0fba5e060c5cf687e829603a5d1ff10194dff3f486f8190667899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5395b22d-7a93-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699048367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699048367, "uuid": "c3a8f34b-da92-4207-aced-075f1707ad73", "comment": "Malware payload", "value": "ab5f5f16b9a70d7fb7a27e7d51ba9af7", "object_relation": "md5", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699048367, "uuid": "20739f04-a583-4800-9c76-2581314d230b", "comment": "Malware payload", "value": "70b1ee87212dc097204885688f48fc5cdd1ade64bea44ddaa15e6c57f8439ece", "object_relation": "sha256", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699048367, "uuid": "7088b0b5-8266-44f0-acad-06b8285bad5d", "comment": "Malware payload", "value": "dd929f586d113842dd8bad8e9113fcda915db8a5", "object_relation": "sha1", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699048367, "uuid": "81c2a2bf-2c2a-41ba-87e3-41114931fdbe", "comment": "Malware payload", "value": "4f84d0721d0a9ed5b76bfb08c5b4807d9b085d1a8be46c9d0af560e2eaaffa2e436c3b5f19a58d13a7349b8b7e0b742d", "object_relation": "sha3-384", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699048367, "uuid": "b5ad1017-d730-499c-8221-b9c6ccb4198c", "value": "T11636BF237681B53AC05B0B395537A671893EBF91BA12CD57A7F4384C9F31680793938B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699048367, "uuid": "53d5399d-c4fd-4246-a951-fd86233f0486", "value": "49152:W8rXNzObQRQQ66a6isfnzE2NCnMCb918EzI+n+RcwPIW5+S6SWvONKVwbcst:ZJzDRQN+nJNoMCb91LBn+RceYmbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699048367, "uuid": "e4b21719-0bfe-426c-b90f-29faa1180270", "value": 4996764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699048367, "uuid": "278b0a8a-43d7-47dc-9830-2c902fc392a6", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699048367, "uuid": "dbc12316-2548-42f4-88dd-df24d70b4254", "value": "EB54.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c91f860-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698997997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997997, "uuid": "e529a9db-723e-4915-9e29-5bd5b4cfa69a", "comment": "Malware payload (Formbook)", "value": "9a5253500678bad41e86aa3681b98f56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997997, "uuid": "44ce3f65-ed14-495a-a6f1-b284a2bc770b", "comment": "Malware payload (Formbook)", "value": "70fa700776b64d7b7dfb85fd54aeec26e65b9d62ec1e8ef417675a395f5ee6fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997997, "uuid": "aeb37f40-3c0f-435e-b8e9-1c920e51e40f", "comment": "Malware payload (Formbook)", "value": "15bab3b0f7f9acfb06c1fb1368121dd465a718b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997997, "uuid": "5efd2da0-6dd0-42e7-b9a7-40bbdeb1565e", "comment": "Malware payload (Formbook)", "value": "705bc78cc6c42fccda3e7207ade854ff0e0e8cd037607cc4c8a81b38f6a2a397179e7e90c8ca147ff94fb54d6ad1b370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997997, "uuid": "b2249fa3-d68a-48d5-9583-73d062c1d555", "value": "T1FF94232251734DDFF0DBC0BAE936A7A8D4BE42546220789B0FA02F7D0EA60577D293C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997997, "uuid": "8d98d828-41ee-4d50-9500-e3cfd9023cc8", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997997, "uuid": "b700f7f1-4be2-4756-9843-a69df03f8d65", "value": "6144:F8LxBsmdQOQFDlKMaSwFYTfsJdeAY6DyhTa959tqvmSaZB4T8Rnw9EHL2Lvx0aCy:/md5UpwQsJwA9J5Yaf4T8OuHLKDwrA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997997, "uuid": "7bf48056-93f2-4f9e-84ba-84e29e0a8f87", "value": 435596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997997, "uuid": "972e7083-bbaf-4a9c-b13a-8dadf5b33965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997997, "uuid": "24d76f8a-1bca-4d12-9e41-6140367db896", "value": "SWIFT COPY HSBC BANK-97475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22180149-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981283, "uuid": "7337893b-cf14-42cf-8f87-481ebbe58efb", "comment": "Malware payload", "value": "c542f5420cb6cfd8ab591b326413d7c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981283, "uuid": "b3f48184-6bdb-4019-93c1-5276361a9e5e", "comment": "Malware payload", "value": "7109a5b8bf10a3de0123ff205938cbffee986b57647950b2ed9ed060858380c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981283, "uuid": "a7ad5d72-b9bb-4ced-9be1-7a0f3d197416", "comment": "Malware payload", "value": "160ad332e0a2505306932a1d96b0dd12feb55a54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981283, "uuid": "9bf441d1-dfcf-4dae-8384-6b3b450af106", "comment": "Malware payload", "value": "83ad7559cd719671a80b88d9457e3b59bcc4ed2ab1b7f17dcec4b812869425090b73a15aff8e89b85dc1e7f76922e0b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981283, "uuid": "fb93d032-fdfa-454d-a42c-782992fcbffa", "value": "T16AA5CFC7F7C2C5E5E723A470446A6B3A9AABFD820B3586937278FF4D4D336B06925101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981283, "uuid": "6121188c-098d-4547-a536-7286c1675502", "value": "24576:1UFGekmuuHiuDn0ZnFMUm6f2FfWl8KuqGavkg3NyNIbbbIoIBAUZLY2:1or9Dng7d+s8KuqGaX0ToIBAUZLY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981283, "uuid": "d328fb9d-2282-4c8a-8e16-4c39bf6aa42f", "value": 2072576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981283, "uuid": "de5426a2-de28-44d8-8f49-d4b6ffa0ad20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981283, "uuid": "47429150-8148-4307-8ea8-ecf99c15e041", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1FX883P.15804.20198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3d162c-7a46-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699015257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015257, "uuid": "8e7c9994-4228-4f82-9c0f-aed5af538325", "comment": "Malware payload (IRATA)", "value": "e273346a71ad974e1744c2b4c56acc9f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015257, "uuid": "62cc7866-eab6-4c20-ba8f-cb14094e6ea4", "comment": "Malware payload (IRATA)", "value": "710fd2e38d4a483f40862ade03ca0df5c478f775dc04723e52f953d3f3eef7d9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015257, "uuid": "c07b9a54-7a6c-42c1-a0d0-aaffff819198", "comment": "Malware payload (IRATA)", "value": "57d43a0110abe9e05461f7557536c97b0da07333", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015257, "uuid": "f7502fac-80e3-480f-b611-704115b9d785", "comment": "Malware payload (IRATA)", "value": "129d6a206a2d4ad8072f81b15acd842dd5c1b4015f25eb29fdc9368b6d348c870e129953a5fd9363d8f7dcf9f9d5ccd8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015257, "uuid": "6c6b9d6a-5920-4af8-a7f7-af3831a69adf", "value": "T101851283F3BAA957C831C0322086273915574E25CA46FB86358877BB74BBDD84BC1BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015257, "uuid": "9814863e-f174-4d26-9b2c-20c65f09cc33", "value": "49152:SswbSZkk6EXLhzJU2dh6Nw7uByPT/OAATc0qnC+1xLdaazC:s2ZkkBXjUC6S7uBaT/rp0qnC+1xRzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699015257, "uuid": "a654cc82-a524-484f-ab87-6fe96ae82218", "value": 1813496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699015257, "uuid": "fa8b9ac3-1bdd-4cb4-9023-971e2d9ecb83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015257, "uuid": "bd2ef2a4-ae23-46f9-ad89-78d499ef0651", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b9b1da-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998338, "uuid": "b4b4ab65-ccaf-4fcb-b78f-fb4277104628", "comment": "Malware payload", "value": "1c3e9634143898928fc50dbf93976643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998338, "uuid": "cb36df32-e345-4a7c-859e-4ff7ede92000", "comment": "Malware payload", "value": "72fcfdf21b74506412942c7aba61985a4745ba014b52b1106f9ffe7d8083ec91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998338, "uuid": "da1ac2d0-c274-49b7-9387-ca53a8e41c53", "comment": "Malware payload", "value": "eca9b73d54b8d632c0b06f41389383784ceb34b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998338, "uuid": "e54ed09d-5a8f-42f2-b446-af8f6d9b33c4", "comment": "Malware payload", "value": "53492c486ae3b9002416785566ff676b54013a8de5b959aa32ecf8b1ab6290d0c71d16c77b37c6e2ddc83946c32a8e20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998338, "uuid": "854575d8-0250-4203-a605-5f05a49a314e", "value": "T12E143E06EBFAEF30CB34157F828173345F7E5ED151A2B98E7988B1642EBAE40D440696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998338, "uuid": "5afdbdc3-d7a8-4641-961e-89cda2d6ea21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998338, "uuid": "214a71a4-27ef-4335-a496-d2e0115f179f", "value": "768:3CAj9vHvBkaqoDimEpsLO1cbSL2v5EiHOIXqemajKUWRpESUJXtAhVm13jWtSHPy:3d9vHvBkaDFEpsLO6K2vPUaOUWoSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998338, "uuid": "18322d2b-3a55-4297-b68e-cc8c11c292e6", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998338, "uuid": "bcb282b6-cf91-4674-ba66-4e29e398b012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998338, "uuid": "8b963308-05bb-4f84-b594-9b123a45cdaa", "value": "S24-JDG-TE C992-03987365367.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f5b5ee-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981256, "uuid": "4105022f-51a5-449b-ab33-fcc1cd241025", "comment": "Malware payload", "value": "9f98ba49260d5618eceac315989ebf57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981256, "uuid": "a126438c-c5aa-4803-a77c-b17e7225847b", "comment": "Malware payload", "value": "7433af130569dbb75773e19706055f866fe10a326b9f278fb1eb372701083b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981256, "uuid": "dbf954b2-8225-4b11-b2af-e4ba3b98f59e", "comment": "Malware payload", "value": "16153aad818e8a3f95157b98a963c190f6b4824b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981256, "uuid": "b92c0468-c3e9-445a-9236-7ffb1033ee1c", "comment": "Malware payload", "value": "35d48f17f1e375560512b0b25af347df67392986f5dc2b778cd0ab24dec5a403932b3d7046aab6fa8c288a6aae6decd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981256, "uuid": "83d3d715-e3dd-4bac-9352-10833ef0ad49", "value": "T123158D26B2F250B8CBA6143138FB5F35DF76A9414F2686CF865DDA2C09370A16F36172", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981256, "uuid": "3dcc3e4b-cb21-41fd-8e5b-08bee60365b3", "value": "12288:+GwOYXnrala+z2f1NB3gznv4Zh6jtJox+zXSHPPmKT0/djXElwe7gi1I:xwOY7ak+z2fl/y7Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981256, "uuid": "1a31494d-fe2b-49f4-8b82-867d773d543e", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981256, "uuid": "ef88f4b9-51b5-497c-9b0e-38c4857f26e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981256, "uuid": "4c71cf73-0020-4ca0-a7d1-ab7f39e1bd10", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.5782.26453", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8423f864-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698998197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998197, "uuid": "b30dfe07-2d38-4d86-9063-25090eb5ca7c", "comment": "Malware payload (PureCrypter)", "value": "03889110fc01d485a9d373b06ba469b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998197, "uuid": "b992138b-a1ad-47d8-bf8f-72e79126cf87", "comment": "Malware payload (PureCrypter)", "value": "743d4039d80b40928f29c99c40a6f746a1fa3670bd074b56a0b676edc4c9429c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998197, "uuid": "945aa799-eea3-4d9c-b691-a291bf5e34e7", "comment": "Malware payload (PureCrypter)", "value": "254fae59f3a463a587c3a555979604ac5fa073ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998197, "uuid": "2dbdd541-6d27-4bc5-80af-073226a67f19", "comment": "Malware payload (PureCrypter)", "value": "ac3c376065aa0749dd56bd020a4af08cdf8f6fbcf778f10f04697e0c298b13f309c180d00d4750a3b1067ad47c689d7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998197, "uuid": "192420b6-3ada-425c-b137-e90880e6e184", "value": "T17EE26C5727803527D5300B71E8E793B026BDED857C5887EB08D0BA0F3EBA467A8316A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998197, "uuid": "7f5b441c-3622-4711-9891-b42fb2288348", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998197, "uuid": "45d8e48d-24c2-4eb8-85ce-6277772c88f3", "value": "384:vaLih+lUWrOWpfNBgC0tvGBloaeK/+9Zkm1BkPxlRdHj7YpNo:v0oWK+LotviFD+9BvudD7YpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998197, "uuid": "f9b5f7fd-9e16-4e72-b701-f45f45473700", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998197, "uuid": "ab4c29c6-e0b9-4541-b62a-8b4089935dcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998197, "uuid": "96120d66-6ff2-4ade-9d1c-f2cfa78ef90b", "value": "231005-001-ba.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2138c3-7a7d-11ee-8907-42010a9c0042", "comment": "Malware payload (Glupteba)", "timestamp": 1699039015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699039015, "uuid": "24557492-98f7-43db-81ff-68b6d94caf2b", "comment": "Malware payload (Glupteba)", "value": "fb33348f7c8e30dcf800a62f85aab253", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699039015, "uuid": "6262377d-c4cd-4fed-ba81-99fc8cf748fb", "comment": "Malware payload (Glupteba)", "value": "746b5874dbdfcd6168d395a2da5cd43dabadad8ec4a38c1c87d8c3779d41f5f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699039015, "uuid": "a35dd96b-fbc8-4a99-9708-b0d9c9c461dc", "comment": "Malware payload (Glupteba)", "value": "8efa69bb15ab195726425e9501f57d68376928f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699039015, "uuid": "76ef8d0b-cd26-46a9-a2bc-86930af47c37", "comment": "Malware payload (Glupteba)", "value": "6c467967294c5960ab6ad40813c2a6156e7c07d2926912763e933b558d9d3ba448b8e078e04bf2b70828410a7fe58665", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699039015, "uuid": "a8b2ac85-86ff-4734-aaa3-ac371fefbada", "value": "T18216331353913C61F6261B378EEA85D8EA2DF2A18F153BEF16945A3F08711A5C9B3703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699039015, "uuid": "98fe7f0f-d828-4dc6-8519-f547d89f4621", "value": "ce8b02cf0e0e47bfce02667d7460664f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699039015, "uuid": "f576b23f-eada-42ab-8fc7-66f3a9ddd0f9", "value": "98304:xu1WsneYuyTFgSQBx15gJ5c2poEACN2h4tBbPvFoR0/GL+b8p:xu1WsnFvTFh6kJ5NsCICbPvFo2/GL+bI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699039015, "uuid": "f8e63ed4-d97f-457a-abc6-847b617f7984", "value": 4344208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699039015, "uuid": "c060191d-d951-432b-a95b-2fa0a27f1f83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699039015, "uuid": "cbdbd0d2-edbf-4050-bac1-af346746de2f", "value": "fb33348f7c8e30dcf800a62f85aab253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd71efd-7a26-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699001566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001566, "uuid": "ee13806b-d836-4ca1-aa06-2e381a746c2e", "comment": "Malware payload (RedLineStealer)", "value": "2259aa28e233a4cd0b49013e48182f46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001566, "uuid": "37e51b19-6533-4454-b9e6-98a0babb450f", "comment": "Malware payload (RedLineStealer)", "value": "74a92e04a358cea2a4a8fab561e947a93f3e8c66212f75b9d9d4b6e3afb6b7ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001566, "uuid": "b1f7160a-7036-4863-a84c-4fbe1c83e9b5", "comment": "Malware payload (RedLineStealer)", "value": "8a23a8bd8c5bca500792ad8b50f1a79ec8f96890", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001566, "uuid": "986bbeb9-2eb5-4f7c-bef3-8c80fff3aabb", "comment": "Malware payload (RedLineStealer)", "value": "dfc58597120017759673f17ab05052f8009761e315dfff2bc0b68fade7ee501bb3a87da503d077141e493685b7ba917e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001566, "uuid": "db6a2f1a-dc11-4be7-99d9-8fea234ab6b3", "value": "T103752307BAD850A3CAB067F446BB13970B77BDA2DE3013671342896D8E71AC15532B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001566, "uuid": "7b9b23d0-06e4-4bd2-8493-c9ea54682a78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001566, "uuid": "b7ff54ff-437a-45c2-8783-aba22dca511d", "value": "24576:JydwXgoXZj3AemWZ3LeHbfIwvWwLhbK74vDCxX6Y7POyTibSE/:8YlRAexVLeHTJjO8CxqIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699001566, "uuid": "dbaf6546-2564-4369-a368-4cf8fc66d604", "value": 1601536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699001566, "uuid": "bc800bc4-6afb-4f2b-bc5e-c8016b3b0e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001566, "uuid": "5f025ac6-a7f4-4d5a-a8a1-752cb3338342", "value": "2259aa28e233a4cd0b49013e48182f46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbac927d-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699055011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055011, "uuid": "9b36bcc7-0631-41e9-9d23-e41f1b02fd35", "comment": "Malware payload (Mirai)", "value": "56b3ece7bac27d8792c036c91e577c7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055011, "uuid": "0a2ae6ae-9a9a-45a2-9873-0b68e316c424", "comment": "Malware payload (Mirai)", "value": "750e266ba0052b3dca602f62b8530e5a886917770fef4bae840218802f647e1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055011, "uuid": "9d104805-e385-4951-878f-8c4a683102a5", "comment": "Malware payload (Mirai)", "value": "5157ce9a079c95d5343611e129d73eec97b0f615", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055011, "uuid": "e0390548-25fe-4748-b1cf-2777b447b609", "comment": "Malware payload (Mirai)", "value": "0d2c3450ef74b10bf1290f279bf6ebe0ebda962707fe1a31dcfc27cd2fd8a0c688ac076e0ee008ac5ff78cb2d950a926", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055011, "uuid": "3f29f58c-5b00-4297-9ab4-4aa970502c4e", "value": "T140437C3AF0151DB0C95211B8F66CCE344F12ADE492A12CB27FDD49E548B7A2DB44DFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055011, "uuid": "fce4ac73-36ad-4c68-8af2-2f74cf5f1959", "value": "768:M/17lLEFQu4ovw4tiOdb9mNGGaNa0z9aeZVc2Y/P6NHAV5LVJg/A3sAQ+w:SRlLEfhXiOua3Vi6NHiJ8P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055011, "uuid": "9d2f7549-9895-4c7f-b851-cae24f80883a", "value": 57972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055011, "uuid": "cf5cb874-5b1e-483b-a64b-51264a64667c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055011, "uuid": "45c5c532-77db-41b0-b1a4-b10498bafd3c", "value": "56b3ece7bac27d8792c036c91e577c7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b93d0d1-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996814, "uuid": "8d894fb2-5aad-4919-b5a2-7c772f286f04", "comment": "Malware payload (GuLoader)", "value": "11d449cbdbf543044e9e0ddf27621c00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996814, "uuid": "05204679-5e04-44c2-b771-5ead1c2c6b1a", "comment": "Malware payload (GuLoader)", "value": "760b245f37fd6768a1a419ddb2783b2778d1ac4503ecf06c9eb9edf94faf8fd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996814, "uuid": "4aa8b98c-e46c-497a-820d-f6b59b7d2432", "comment": "Malware payload (GuLoader)", "value": "45dbfc45f60b81ddf1b6988164bcfd9e76ee7abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996814, "uuid": "a7c80cf4-167c-49eb-b921-8e9acc8695ac", "comment": "Malware payload (GuLoader)", "value": "962689739587dd7a03a158dee5ffa4541f0d7faecc4e76d7f5ca5fb56d81596febe6336d202cd3d7b2cbc8414f02b027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996814, "uuid": "5dab8c0b-528b-4852-961e-73b47ab098bb", "value": "T18B441245137AD8ABE95823F008BB6B2ABD76E62191D5476B03E873473C327C5D81A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996814, "uuid": "dae55bb8-5a6a-4154-9842-cfeec8a4378f", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996814, "uuid": "89ac5e60-be3c-4496-8976-f4b63271821a", "value": "6144:TvR+Xer4rvuR9BCcfbMZ4Rnw/SXum0kRRr3vhaJL0dQ+XH6iTTI:MeCu/ss64lwKSkj3wcQ+3XE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996814, "uuid": "6ba2fa70-6f77-49ae-a17a-5294742d16c7", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996814, "uuid": "8809d1a8-4b80-4a97-b7da-562ae8df98dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996814, "uuid": "94055247-0dda-4638-9c9f-074f549ec835", "value": "11d449cbdbf543044e9e0ddf27621c00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a459ed9-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1698996731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996731, "uuid": "99f59012-24fd-4113-9dce-6fcedfe7e879", "comment": "Malware payload (DBatLoader)", "value": "050ad2e2def0fbbe8c8fa1e2c360ad94", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996731, "uuid": "27ba13e2-f187-482e-9c53-92b5c73aab4a", "comment": "Malware payload (DBatLoader)", "value": "771af3e897f1d32625cdc3cf41d76dcfd21ae27994b721ae6c7cb82bcb284789", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996731, "uuid": "0f1e9629-f94d-44d4-b7fe-974acc77c4a8", "comment": "Malware payload (DBatLoader)", "value": "64e4762511c106e52005ab55de9070c299684d81", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996731, "uuid": "cb0a0aae-d725-499e-99b3-00ef3c70552a", "comment": "Malware payload (DBatLoader)", "value": "5c81b4cce096f1e517483abe688dce12c7b3468012b2d7f261c23c4f6864c61e93c476c30db6bef750acbdeae92c524c", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996731, "uuid": "b7079047-05d5-481c-9f8d-952d389dd105", "value": "T13FC5E0E1A3C84CB2E06B3A78FC9639C135E4B9F1AD0B54CA459C6D860EB4B747D2245F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996731, "uuid": "b1a91594-dd91-429a-9e4c-3e61ae95fc0b", "value": "833a48f3eed13b70c2227728181305d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996731, "uuid": "724dd313-d13a-4a87-9dd5-e07350d8a54d", "value": "49152:Udbe6JPqJvGkpy2glNjQyewXk/gClQyu:UdbnkA2gnrewXl2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996731, "uuid": "af5fde5a-0b25-4d8f-bdc9-e02018e9955d", "value": 2569728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996731, "uuid": "fd2cb8e0-7da5-4993-9818-19a2d763578e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996731, "uuid": "ccbfeb5f-c4b6-4b59-8786-a69b7aff3b1e", "value": "SARS NOTIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7fdd025-7aa1-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699054656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054656, "uuid": "0aa5f041-34e8-4420-8fd3-2a59e98c6df7", "comment": "Malware payload (Mirai)", "value": "4dc4e628cc557be8d88dadff18bae567", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054656, "uuid": "4b0a0f6f-8df7-467d-a6a0-0f71278763c4", "comment": "Malware payload (Mirai)", "value": "786c9d01b9364307f786b722fac447c9388581933d2383726b96a2fdda188b5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054656, "uuid": "d070a0e3-c2ce-430d-a3e9-fbfa873033e9", "comment": "Malware payload (Mirai)", "value": "92dc7241c3b57092905326d48ed8270c28ff2999", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054656, "uuid": "7c45704a-cc17-49e0-ad3a-ef046aa84d88", "comment": "Malware payload (Mirai)", "value": "216cbbac249a6cb963e13deac9bb6ed5b19f7dbd75616142744fb7199fdc0ecf567b89472f3e5ef56db15d871083e8d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054656, "uuid": "98044655-8a51-4de5-a9ee-5a6834a0be5f", "value": "T10972D046930BDC91C3227C3AED2E56437B9817B494F53023B249465C9AC988B6FFE9D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054656, "uuid": "4d9a4aad-61b9-447a-a3c1-19d3d2a16108", "value": "384:oALoRBrZGswHUuHxqooKbCIsLLiKWWh7qmdGUEpiaZ:rKSjRqcbCnyKWW9q3UELZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054656, "uuid": "6dfca058-ece4-4504-81eb-8f1d8ba8b291", "value": 17428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054656, "uuid": "893b32be-9516-4712-9a78-693b5d0e7f6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054656, "uuid": "b31cdae5-9a20-45e4-afdb-97884c69092c", "value": "4dc4e628cc557be8d88dadff18bae567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a25251-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981285, "uuid": "82e1e17a-0335-4921-bcfa-a8f494176249", "comment": "Malware payload", "value": "80c71be0505fb06932ceab8e5b5957c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981285, "uuid": "b50f9888-bdce-40f6-bd8f-f09090f67715", "comment": "Malware payload", "value": "7920628c1c347517cda5170a0e77bda14a39350b149e1862450a2cca6d27b6f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981285, "uuid": "0a7feb6d-4d99-46b9-b92f-b1df1408e222", "comment": "Malware payload", "value": "b3e8e437e91c020de48b1350de0bc8a0565c48c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981285, "uuid": "9635a91d-ee90-48f5-a7ee-00df89967647", "comment": "Malware payload", "value": "16dac44f855187f62dbbe4633c2d4cc9196d89c7efcefdf7f6644f72ac931dedb9367003922d9b24414d4167947b3f4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981285, "uuid": "98ac8b09-3f4f-4621-97da-f8ab6f0b1d3e", "value": "T132B52302F3C38579FA94467C8C5AD4882D33BA6904F1602A5DBDDA0F1A7D7C25C7BAE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981285, "uuid": "fb670d55-977d-4fea-a2d7-eb4b27cdc3b4", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981285, "uuid": "6026d93d-32b0-4164-9a77-0cd635270f1d", "value": "49152:PVOJW0Vw3ty08frdLNtweanvvvmXq5qnsVYqns8BuVRQtY1TGa5KH:PcJWl3+rdB3anv3wq5ksVYqnNuLQtc6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981285, "uuid": "660b881b-ba27-498e-88c1-5aa3e0d697aa", "value": 2354485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981285, "uuid": "7ca5d683-d793-4ee1-bb5e-74cf93134c67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981285, "uuid": "55d3ee08-94ac-4478-8049-38a48d339a19", "value": "SecuriteInfo.com.FileRepMalware.7260.11525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc93f60-7aa1-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699054662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054662, "uuid": "e4ec8c84-61f7-4f07-afa8-2ea7a8f1f2a8", "comment": "Malware payload (Mirai)", "value": "1adc1f28b4139d322cb14538e49a4839", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054662, "uuid": "4c040291-5903-4400-ae1b-09f04c53a967", "comment": "Malware payload (Mirai)", "value": "7927f93c302c12d245dcdbb0115e3f4381921a931bba33b2a3d358ae90f8f595", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054662, "uuid": "8c7c809b-71cd-4673-b024-e55eb2fd9533", "comment": "Malware payload (Mirai)", "value": "398733f01ce4f2ecc41cc830db2a80e41e18ea20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054662, "uuid": "b2b79831-d1c3-46ea-bcb0-45130095f849", "comment": "Malware payload (Mirai)", "value": "3e66959035a3498303ce8eb1acc79bf7a24262b633a7af5a37687165aec11624d01b7b3f031150569adc2d244c48a17c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054662, "uuid": "80f5050d-ab89-4a70-8ec5-e12d1eca849b", "value": "T1B4834B86EACBF9F0D9410978116BEB39D936A8323124DFF7E7C9BA175D57242900321E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054662, "uuid": "0ce32e14-4cb1-4480-8ba1-11fbcb1c51c5", "value": "1536:VaN3fciQ8evfOH7sT+Esk+cFLcvJKWlPqCePd54dD3MRSdtk2JLjK:Va1cRlOHlEskvF4vtmovb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054662, "uuid": "eac86ecd-2c4f-4c88-b0ee-db173345713d", "value": 87292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054662, "uuid": "f9ed0f52-7e0e-4af6-9267-96dbf81e96a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054662, "uuid": "2d410985-481d-4229-a431-575e9837f60b", "value": "1adc1f28b4139d322cb14538e49a4839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b2e61d-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996997, "uuid": "177249bb-a9c3-4e86-8172-dcea9f76eb9f", "comment": "Malware payload (GuLoader)", "value": "a549fae6a6da1deaf1d3511e17e4a266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996997, "uuid": "c488de51-6f90-4a28-93d0-ebfd525c4390", "comment": "Malware payload (GuLoader)", "value": "794687137393fa3452031ea7f651ffcb7de52b46ee4cdd72388d19c333b14a60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996997, "uuid": "0ac18dce-94ae-4576-bad2-7deacc211ec9", "comment": "Malware payload (GuLoader)", "value": "67cc2777dff05b8ce4687b20f944355c7c4e793f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996997, "uuid": "5de51e6e-b23a-4b4c-a493-a5340246cec1", "comment": "Malware payload (GuLoader)", "value": "e21fa09ede97ae904491097810cbef01f252c26d16f37c4ac531eba3e33dadc9e7cfa5450a3494b1c35f102aeb9323a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996997, "uuid": "8de3662a-9d3e-4fe8-acf2-2cdd0b2f5535", "value": "T1EE0523E136E0C5F7D66B51B481A2961DFFF4EE309257CB67CB027818BC3B6C28A65604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996997, "uuid": "992c455d-e5b8-4908-8614-7a41fae011aa", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996997, "uuid": "ba69ed80-689b-4c01-aacb-8bf77b5d5ba2", "value": "24576:INPx3TpQMyVRWL1FSXL8OGngz6uc1L9J8xVCT5ATqY2BXY6+g7:mBT4VRAAXGgz6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996997, "uuid": "182a3da6-8043-489b-841a-b65bcc73d81a", "value": 864327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996997, "uuid": "4d1cd35a-1156-4ef8-94d5-682e98c66d14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996997, "uuid": "30ed1b51-29d1-4770-99db-f4cda1ad3303", "value": "Outdid.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3332ba98-7a46-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1699015242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015242, "uuid": "073ff32b-f402-4ba8-96cf-04360310e689", "comment": "Malware payload (GuLoader)", "value": "73fa1629c89c908f963507859345fc97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015242, "uuid": "4594d549-c072-4c7f-b21f-01af1327c7d3", "comment": "Malware payload (GuLoader)", "value": "79c447a36372e33fee48fb97a6cec62855e9c1b944a17a24779d585668a15955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015242, "uuid": "bc24cb08-a939-4048-a867-dbd35be3388f", "comment": "Malware payload (GuLoader)", "value": "2de7c05b335fac829798a53df058895a9bfd8a95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015242, "uuid": "8683f6da-12fc-43d3-8bdd-7bbd15eb9d35", "comment": "Malware payload (GuLoader)", "value": "8f3f93f7c757ea5c1f736976dce62eb63ae1ddf4d146ecff266f7ffed1bfe32addfef19f166e0aae7b06dee9a79559eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015242, "uuid": "7b7e3b54-0994-4409-9a41-c08f74453d8c", "value": "T1EA5523145D40DE61DBD005338AAC4FFE66726C1E965C7C63138E3E997279283B62E3CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015242, "uuid": "8c86efc8-8f8c-410d-be01-6a8ae092ac5a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015242, "uuid": "2b1c0302-a4ea-49dc-ab98-1a68c47786c2", "value": "24576:7+DHqgxZ+lrpWnLwegibLL9WKgILf+wNE1r1tdRadUfuEYpqpB99fv0Ooc:SL1Z+lCMedbLLbb+wNMtzadSudpqTbUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699015242, "uuid": "e8023961-3fa3-4ccb-9723-b80fe7af7472", "value": 1304016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699015242, "uuid": "52010300-c673-4f7b-bdc4-f11d104e54f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015242, "uuid": "4d62c6b2-9b21-426d-bea6-c703daacfb60", "value": "79c447a36372e33fee48fb97a6cec62855e9c1b944a17a24779d585668a15955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f83cd4-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981287, "uuid": "0d087d38-f96d-4221-a6bb-770657bb0be6", "comment": "Malware payload", "value": "6f0849a04e827905f1746240fb297749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981287, "uuid": "f42b2193-11e7-4206-b9b4-843b98ee6322", "comment": "Malware payload", "value": "7a2bbf05871a86afb8e6e59f925e35201eb7659d31cd8609f445fe585bc9df36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981287, "uuid": "853d614a-419c-4302-8a1e-e61067663dec", "comment": "Malware payload", "value": "251dbdcdfb0c6022bd290711aa7af8de8e5ebc1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981287, "uuid": "ba30532b-7e7f-44df-9a20-7435837f3f7f", "comment": "Malware payload", "value": "09a94bef70668e10704a34284de2dcde2e7f90d090683e49409e798e084e73806aa2ced7505d164ddafe00b5c52eac24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981287, "uuid": "fb7bf0ac-8317-4518-9289-5a72dc65a0a0", "value": "T16DD48E23BAA3D0F5C72466B00CAA6736BD75AEC20B15CFE3A315DD9C1D325809A371B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981287, "uuid": "a5fd76e6-8172-484b-bf27-19b29f005797", "value": "d4ce78d1842f127aabc23e61d07affec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981287, "uuid": "4333e940-079e-46d9-b21c-0bde4c767920", "value": "12288:5mv3Kk+i7GUlXmjzDbTCEQVNCilrFFFFE57ZG:5I3y4GiXmjnbTCHVNPlrFFFFu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981287, "uuid": "05b3903b-0211-42f2-b7f3-59aea77133e0", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981287, "uuid": "7ada3663-112d-4d75-83be-bd9dfb857380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981287, "uuid": "b18086b8-28f4-4ab6-b29b-541592ece324", "value": "SecuriteInfo.com.FileRepMetagen.6201.21404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07052308-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698997988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997988, "uuid": "ea5321c4-d74d-43f3-b4af-535239b289a1", "comment": "Malware payload (Formbook)", "value": "bb2f6f761601354804f42e55b2b8594a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997988, "uuid": "960acd61-360d-4d11-8ed9-494b158d7d91", "comment": "Malware payload (Formbook)", "value": "7adbcdba6b07a49776e4a3b41d67f8f93a400ae6151f7f729ee20bef0eaed9d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997988, "uuid": "6a45c213-1a2c-4992-8198-ba92fff54044", "comment": "Malware payload (Formbook)", "value": "70c089ad407452f5f8f781d0ccab08e17293e3f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997988, "uuid": "72575c71-2696-4c2e-8afd-57adb2350d44", "comment": "Malware payload (Formbook)", "value": "ad03db2d9c7924095e61e902484ed8a837ab329a4fa26d1696d98a473fc922f2a00f1064c7e0a93bffd2ab4e624fb28d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997988, "uuid": "583ac40a-533c-4c26-903b-7d45b478291f", "value": "T1B594234672E2DCBBC06546F14A39733BE27EC71BA412961E0FD42D7F2A5168B8E0D0D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997988, "uuid": "c7e90a46-96a0-4f33-a648-a4959c6e9ada", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997988, "uuid": "e7a12e83-b000-4bfd-bacc-ca7120ebeadb", "value": "12288:/mA3ilmS253dMSoqerY6v1GrXvz3eBFLQ:/265tMSoh/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997988, "uuid": "f041f7fc-772a-43e8-a874-2db8e4163def", "value": 434790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997988, "uuid": "45d6bffd-1615-4ded-9d92-1a9e548367b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997988, "uuid": "879714f8-8854-41c8-be42-cb1b8d953c94", "value": "SWIFT COPY HSBC BANK-97472.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ffc7e5-7a1a-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698996583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996583, "uuid": "72589b7d-3cef-4f67-909b-b3e302b99f9e", "comment": "Malware payload (SnakeKeylogger)", "value": "db37fbffacc10cdcb13d1d29625d1016", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996583, "uuid": "05d23ee8-9b2a-4ae5-9ad6-6a51e14caecb", "comment": "Malware payload (SnakeKeylogger)", "value": "7b80af0eb67ef03700b1aa95e8e25ec0b9f4debd4dc0f9276eac46f9120c6e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996583, "uuid": "9078a3e9-c782-45f6-88ee-34be13de53d2", "comment": "Malware payload (SnakeKeylogger)", "value": "f8dc77a852edd28dce27bd7f9fae80abde1e67fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996583, "uuid": "e329096a-1dbf-4526-a94c-4f7a30dcf7ff", "comment": "Malware payload (SnakeKeylogger)", "value": "fdf52a62f981e1c0d27a61e5fff67de473d8dc2fab7c30230d8546d2a1b6bd5ec1b2fa454dd039643fe6155a38b4a2c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996583, "uuid": "2f2107a7-3114-488c-a0ca-4dfc1ec5befe", "value": "T125D4F15273760512C47A5BF79992C23827B25E29D9B6E31D24DA7EEB31B37C72002E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996583, "uuid": "b7e8f822-5439-40c7-bf0c-b43ddd9c2626", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996583, "uuid": "2da48db7-c138-4dd6-9bd6-3783d6d188eb", "value": "12288:q8z69yqLlg14DV+G4Q7gaTcWsWpLokQjc7VfE5udp:L6XiyV+G4tEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996583, "uuid": "9537abee-122d-4ce1-a973-6816790228e5", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996583, "uuid": "1b52fc00-b6d8-455f-a486-4999607556fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996583, "uuid": "8eb9b0b6-c9ea-4bca-9905-d5e2f909395a", "value": "db37fbffacc10cdcb13d1d29625d1016.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7688cfba-79fb-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698983142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983142, "uuid": "da53d606-ce05-495a-b723-fe0d153dacee", "comment": "Malware payload (Mirai)", "value": "c63a337e0da89ef0a9cc6f7b098df1c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983142, "uuid": "316fb09a-66bb-44af-94cb-773b39ea3107", "comment": "Malware payload (Mirai)", "value": "7c899953bee8ed739a1199c9b2da12fd13d3798d2b3b469da3624d971c0af503", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983142, "uuid": "d8f4d1ab-4e9f-44a4-b775-17c5d1a66c64", "comment": "Malware payload (Mirai)", "value": "f935159f1025087f68ce3058f6732849a01d8d4b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983142, "uuid": "69550af4-db65-49c4-a3f4-cc6eefce906c", "comment": "Malware payload (Mirai)", "value": "d942fcac66b4db5990524363635d395c32031aa5b72aba628cba75a6dcb58c1e16873f43a6059c3bb870643e0f147cad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983142, "uuid": "f123fa99-21b0-4b16-91fa-72e419096b26", "value": "T1D9433BC4E943DCF9ED04493115B7EB728A72F03E2125EA83DB95DE26BC41E12B90728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983142, "uuid": "cde550ad-a08b-4b82-a8ce-9a09156f5aff", "value": "1536:fLGYKYNDs9klcNLWKiuYakJRAawNzhyO1bCeUtStcB2PeR:fLfbNDs9scJirakJaawNzh7FCrtUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698983142, "uuid": "cc200b23-65db-4097-bfe3-52419d965f65", "value": 57988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698983142, "uuid": "dab6a654-39cb-483e-b208-467d36ec2138", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983142, "uuid": "c297ce11-98cb-433b-a2a5-d7232adbd313", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41a1f72-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Arechclient2)", "timestamp": 1698998278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998278, "uuid": "299164a7-57d4-4b2d-9daf-55793b8079e0", "comment": "Malware payload (Arechclient2)", "value": "3a8a1ba2ecb9115d3a3b5eb85f8ae345", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998278, "uuid": "30e532c9-d216-4eeb-b894-08d24a95eac1", "comment": "Malware payload (Arechclient2)", "value": "7cc6f5fac525f930d766d45243a78de9d5367ed20beb1503695f790fef72c118", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998278, "uuid": "d729f4eb-5773-4f2c-8748-963965fbaae8", "comment": "Malware payload (Arechclient2)", "value": "69b73dfb5a862ee362c55e426462e1974cf7882b", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998278, "uuid": "e784df31-1ee2-4253-ad3d-1d65c2cc2e30", "comment": "Malware payload (Arechclient2)", "value": "7ac31152068db9f46a75f91805d6849e4b750d7e8e800de962ca3496e11d051cb95d15d709997ebbf9e40a4a5ff74b64", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998278, "uuid": "76624e13-30e3-46ef-b5a5-0eaee6c61563", "value": "T149049D9171E0D8F2D5768A325860BAE0AE6EFD329B177EDBDB41343D0E316C10136A5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998278, "uuid": "3c703988-4a27-4c3f-88ac-d74f5321683c", "value": "82c7cc00390cbd2e9edea8a134be6bcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998278, "uuid": "b92e7c0e-ac64-4a9f-bb4d-52669eac87de", "value": "3072:ppo9pRCZC4uXxON7/IK6zvutuxmZ7TJkF651yPLqQr0v6l6p9kpGqQhSm7kQ2hc1:rlD/Autu4X16rIAC9kpv87vUkgI1gaMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998278, "uuid": "97819dcf-73dc-4fec-b137-635b09d02928", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998278, "uuid": "e47aeddb-79f3-4152-91be-79177eebf48f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998278, "uuid": "d55e701d-925f-42db-8fb6-4051f65021bd", "value": "3a8a1ba2ecb9115d3a3b5eb85f8ae345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12996412-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981257, "uuid": "d691d85c-9f91-4a7e-be42-d1b9a0e71a00", "comment": "Malware payload", "value": "bc0a943d7217647903a4cec032ddc8a7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981257, "uuid": "4f9d7d4f-5a5c-40f2-b3fc-3edcc64d355c", "comment": "Malware payload", "value": "7d081207984254fc8ccdc3a282f3b22c20f5076ef4958b92159d4ac3799ef622", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981257, "uuid": "66d7b13a-df36-4838-b9df-b2292829ed3c", "comment": "Malware payload", "value": "cc4ab9025c23f6ca7a35ed361d02d6cec6b408ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981257, "uuid": "b2272fee-6302-4df8-abca-d47dd97996e9", "comment": "Malware payload", "value": "f1462667d3c5eb5ea00c1a81bf8c21d9583d855df10ed62fe2b301975dcb3454225df5099624fb2d00931c4e737dddea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981257, "uuid": "6f19dd9d-fbb6-492a-abfc-2021c8485c8c", "value": "T1F9B4AE167B084CABC45D0FBF4CE74674A9B164404D65C7832BC896DD9CAB3C49A7F3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981257, "uuid": "42a6dc58-4a41-4f6f-ad02-1c7ae3dbc474", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981257, "uuid": "afa7fdd3-31a2-4d58-95e5-6ba447c8b9b1", "value": "6144:+RR5rhZFQGrsUwF7vlPoSw80gzAkMyLh/Zd2Ea2ZybQeM5TXc9xSkdxNBqbIjQ4B:+R5nWFpPoS10Qw01GExOQB5A5Vy4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981257, "uuid": "bf5e65d4-12c0-4350-a677-3cce2b41527a", "value": 497308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981257, "uuid": "0a2edefa-ea98-4dec-9977-66775e240e1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981257, "uuid": "43a67b3f-4be3-4c1a-bcba-c146e8eed3b0", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.7948.9657", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125d2c6a-7a1f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998436, "uuid": "86aafa33-e424-40f6-b0cd-9b748e620e86", "comment": "Malware payload (Formbook)", "value": "f0c3a6d217751e74de77ad5fd7e87b04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998436, "uuid": "363e0cd0-61a5-437c-bf73-070f7441dfe9", "comment": "Malware payload (Formbook)", "value": "7d7af49eae5e4d1d32af7575a6ecd2a2c9e6b6be95edf5026e3eebde23e44038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998436, "uuid": "0aaa58a7-d334-4a2e-97c3-aafdbcfb90f9", "comment": "Malware payload (Formbook)", "value": "1c4c26b160a42653792d77cf6831a8f64e04977a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998436, "uuid": "0db87819-e3d0-40f3-bf41-9c2f31f1fabe", "comment": "Malware payload (Formbook)", "value": "dc9744cc296218f24499fda772519308133888ab9eac78a6024966242d5841094caf29808784be281aad0dbf7c09a3a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998436, "uuid": "4305681b-42f2-420a-adb4-2b94ff5be098", "value": "T126C4231667605B36D5BAEBF14265C48127FD352B10B2D2EA0EE030CA959BF2385B5B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998436, "uuid": "50c3bea9-1ad7-4618-82e2-dd57f364e0dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998436, "uuid": "3cc17150-82d6-411c-9c9a-50d2a4a94bf0", "value": "12288:HIkkgWHWlRv6V3jLzvLfP+/ltdOMLhOLzV+Du:HIkkHHCRCVznL4tdOwkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998436, "uuid": "d24f6593-2a5f-4e17-81ba-a869c309f16c", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998436, "uuid": "d4f4eddf-5886-439c-a662-25d886c2153f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998436, "uuid": "2ff0e6ae-74e0-462b-a7a1-e63acb6e0468", "value": "SKM_CN09102023 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295abcfb-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981295, "uuid": "56346bcc-3647-42ad-9d64-19b190d5bb75", "comment": "Malware payload", "value": "093f13749cd926f55b69f6a76708ed61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981295, "uuid": "e57bb39e-e88a-43c1-9f40-3ff3f8558a34", "comment": "Malware payload", "value": "7dc0cdfe1b2214176ac641c4e9e8872c692e195410f4cfef6bb856f968daf8d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981295, "uuid": "3ea93de2-9338-4bad-a5b1-dd63a38552b8", "comment": "Malware payload", "value": "24643dfd607846f0640bcabd1a634e89319d0185", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981295, "uuid": "2ede8c7e-4166-4488-87c7-5de6b9b71eec", "comment": "Malware payload", "value": "cb22f8b8121104f6ea85d463e66b8473932b797a39431a6770aaed824e92b36ab3687eaba57575ab67b5322aa20c1ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981295, "uuid": "927fcb34-6e4c-45d9-a2c1-90d273e9eb51", "value": "T199F4AE12BDE280F5C61615B008BA273AEA75EA560B11CFC793ACDE5C3D371B1AD36135", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981295, "uuid": "76dc77a8-f6ee-4c2e-bd4d-f52d68dab601", "value": "3b99b93ed94625251e1dbccb3dd6c1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981295, "uuid": "07ccdb2b-bf0c-4c57-8454-5a25d5ab0003", "value": "12288:nKQZGF8LIC1y0plweRfX5GCTHZKeeiixJe:noF8MCU0Xw4fpGCTHZKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981295, "uuid": "983950bd-5226-47f1-a9e9-fa393b22fe23", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981295, "uuid": "a7bb583d-65d9-482f-9631-5895b036ebe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981295, "uuid": "88f9c081-8069-4728-9ec3-2fcb3ddfc308", "value": "SecuriteInfo.com.Win32.Evo-gen.15216.31171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4c2edb-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699028197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028197, "uuid": "c799400a-918f-49b3-9528-b2a183f16ee8", "comment": "Malware payload (AgentTesla)", "value": "4649725851eadc797260015dc48b4b24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028197, "uuid": "64ec018a-5916-432d-8ac3-3a385624e9ca", "comment": "Malware payload (AgentTesla)", "value": "7e1956202b29fa1f4b2069bfca66729c92f55a8597f2915713f525d10daee463", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028197, "uuid": "fcc323fe-8702-4fcd-a6e6-137fc817d8f6", "comment": "Malware payload (AgentTesla)", "value": "13fa2badaa2927414c9ab7bb14e31c70c6e4bc82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028197, "uuid": "afd72b90-36fe-4e7b-bc82-88152747185c", "comment": "Malware payload (AgentTesla)", "value": "5c9ebd1316724413965ad044f31b236dba9d6fe58086b5a370f2348f5e2fccdf9468de878ca37dc03b87a01e27b577b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028197, "uuid": "0c2f3c79-61ed-49e9-8305-eb86379fac2f", "value": "T1E7D4234663244736D6784FF1A0619D9403FBDE0A2D7EF5158CC8B0E66AB7F624A20B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028197, "uuid": "1251f201-897e-4243-8ed7-e30e46088a90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028197, "uuid": "3162edb0-7347-4aa7-ba0f-83337dddc0a9", "value": "12288:zIk4ZYX+BYDO0obSi1SLrahlHr6WoyN76h4A6yw:zIkZ+Bl0o/10rclH2WoywcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028197, "uuid": "b46c0725-42fe-4a70-9b72-d8cea147533e", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028197, "uuid": "a41cb159-7cfd-4b25-8010-1c0b89ff1561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028197, "uuid": "5163c533-ca65-4152-b070-73cd15d2dfc4", "value": "30.10.2023 - 02.11.2023 Hesap Ekstresi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194ef493-7a45-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699014769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014769, "uuid": "745849b7-3774-462d-931d-7a4c34c4f9db", "comment": "Malware payload (IRATA)", "value": "ed2ae88614f73d5ae50eed0ceacf0fa7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014769, "uuid": "6904bb99-20f5-4c45-ae8d-6cf442a4c085", "comment": "Malware payload (IRATA)", "value": "7f739339ba59c729bbbd6bd47489a01aa2032a16b50fa55ceafc7812dd130be3", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014769, "uuid": "0220f2fc-fec0-46c1-8176-72778e3f61b4", "comment": "Malware payload (IRATA)", "value": "cca6bd05f06702f6522282a254ff2df6279bbb28", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014769, "uuid": "71b4eb5d-3c17-4c13-8a44-7bcc85c32bc3", "comment": "Malware payload (IRATA)", "value": "1de2b9a292da058ae8aa55e6ff43f64d5c81953c0a3336d827721f79537af27bc12e647ae9a3fe936d99194acd4193bd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014769, "uuid": "daf70030-767b-4948-a227-22f996138966", "value": "T173F5AD97F395686BC4F79372817523A5424B4C228F83EBC76D24763C29BB5C42E49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014769, "uuid": "602dda58-ffb4-416f-befc-7c06c6218cd8", "value": "49152:xO3zHnRM11HxgDgLCr8M/oaQMs/gO6Y7irzTRHEsHRtQROi6T:xO3zhgLCr8M//s/962irz5/RuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699014769, "uuid": "82aad836-ff51-4c20-9019-ba5c0d06f67c", "value": 3518845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699014769, "uuid": "56c000d9-96b6-4c69-8bbc-a4afb227b273", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014769, "uuid": "053c72df-50a9-4efe-bff4-8989a1f5f4fa", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8aa08c-7a1d-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698997945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997945, "uuid": "ed26e745-453f-4270-84f0-543afcb93308", "comment": "Malware payload (GuLoader)", "value": "8a1cf5da4c0990fdb8e60bcbc67998f1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997945, "uuid": "1833967e-0078-4dba-b41b-2df6e2065461", "comment": "Malware payload (GuLoader)", "value": "7f9ade1d26e84ba33c15ed29c1f7944ba0a3aea42a83b5df0c51817217e21b0f", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997945, "uuid": "b845b77a-10e5-408d-9711-a05c3e952e95", "comment": "Malware payload (GuLoader)", "value": "1d1e151f3d11e61b290b7d18f4b98f8bf09e017f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997945, "uuid": "3446cc34-16c3-4031-81a2-f134f78d27e3", "comment": "Malware payload (GuLoader)", "value": "6122b912c6cbd89303c82fd0ea259e85668fae0cc37392fc13fbae878b33f53e95c12cbe0a0b4d62768e967feeb8a7f4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997945, "uuid": "1733c7cc-f831-4f43-a8f3-cd6231b0b620", "value": "T13D935CE2DB94151D494B27AFDC424972CD78812D7623063AFFED078DA20788C93BEB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997945, "uuid": "2a04f3fe-1010-4f88-b4f4-9eca938557ae", "value": "1536:wtWVAKDVxE9cPljwPBxrbTZOcIv+oWqwnQMsXiqXOvqU1Miw1OFeBjjpy4:KOhVxCc9jwPBRTcv+JfQMsXiyeqUSiw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997945, "uuid": "59651478-4afc-4aa6-ba13-981ac19089b6", "value": 90471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997945, "uuid": "92f756ec-5636-4b97-af69-9285d8dc0fd1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997945, "uuid": "1e2ee129-0762-42d8-b6e4-2e8646459330", "value": "\uc8fc\uc18c\ubcc0\uacbd\uc694\uccad\uc11c\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384e1a72-7a20-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998929, "uuid": "c3865ecd-8dc6-4a38-a33f-1778dfa516c3", "comment": "Malware payload (Formbook)", "value": "d6c5df23371399eb60055b93d7b80ea7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998929, "uuid": "5a21b9b0-ad95-4ec6-95b3-ce71486f7dda", "comment": "Malware payload (Formbook)", "value": "7fb8142113f69c8ad84a242ce0c6f17125baa756a6a43549d466ea26dbed7709", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998929, "uuid": "338fb8af-f703-4b1b-8688-e4648e75226e", "comment": "Malware payload (Formbook)", "value": "8d089755db0d73db0cec6e8db288392a6be7fb70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998929, "uuid": "77f33012-81de-4755-82cd-df3d6cda03fd", "comment": "Malware payload (Formbook)", "value": "d652aad37fccfb8235eb7bd2715b7b3bc591dcc173f3622456f2d60f6f74c9c20625ef42f280af75240b13bb877f75e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998929, "uuid": "b93a8dfe-5b7a-42b3-8404-6deb2175e221", "value": "T1CF94232651C080F3C2A552F11476AB2DE2BBCD3AD7D479830BD87F3B2F6068399456E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998929, "uuid": "38520cca-5c6d-46d7-874f-a280209ca3ab", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998929, "uuid": "ee56b2f4-b0dc-4da5-9af2-8a2c36c0d2f6", "value": "12288:urCWDLCC6zQAnzN49TOD5iITFCsQv1dmm5oOcHZx:UCeLp2nzNg61iLP5lYZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998929, "uuid": "3bfc4ba8-1059-4e9a-a9e8-f8ca70a9e32b", "value": 421809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998929, "uuid": "d0004039-20c4-4448-91d3-8f5761702009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998929, "uuid": "3428be83-6cac-49d7-bab0-8215a38e67db", "value": "d6c5df23371399eb60055b93d7b80ea7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5cad6e-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698998319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998319, "uuid": "a0eccd42-53c8-4e54-b6b0-7b6e8e54531f", "comment": "Malware payload (PureCrypter)", "value": "ea2cebaf9a247341dcae8c7b9e4ccdff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998319, "uuid": "f6c75e34-64ee-4cdb-abe7-c0976480fb68", "comment": "Malware payload (PureCrypter)", "value": "7feef3cc8cc352d6517afbc1ad65470ab8133993dc521ae0da16bce6d7f4ac5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998319, "uuid": "c1fbe37b-fbac-4969-83e2-1c416ec886a5", "comment": "Malware payload (PureCrypter)", "value": "e76090b0745bbca520ad524a94792738a85bfd96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998319, "uuid": "d06f9052-9a29-4b66-9b25-22d2962eb801", "comment": "Malware payload (PureCrypter)", "value": "a9ab1d2ce99f2b774ae9b14fface1129cde3d34d20c26218436c55d4f2a01e68673a2cb952b60295d0d0270f86626671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998319, "uuid": "4baf633d-1ba0-44b7-88b6-89a03c2f9b35", "value": "T1EBF3B792EBB6EF35CE24093FC245B7295F2E5ED181F27D8E304CB1652EB9D00C5446AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998319, "uuid": "7cb5e459-58de-4749-bfcf-526e3809a1dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998319, "uuid": "dafec3d1-b640-43b7-85c7-7e39dcae6ab2", "value": "384:KN8FK5eUmwww6BKpwWowwwlpESUJXtdhVm13jWtSHPWcAwaYI:KnpRpESUJXtdhVm13jWtSHPWcFaYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998319, "uuid": "693a691a-15b8-4483-a8f4-07b2b9a6c5a2", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998319, "uuid": "6740e4ab-c63a-4407-8e63-1de2743e5729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998319, "uuid": "08a2e98c-8349-4ccb-b556-ad561adb90ba", "value": "EVBD-3987365435673-387DDNBN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087735e9-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699054684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054684, "uuid": "4239f973-09e6-4b60-a8eb-3577d08467df", "comment": "Malware payload (Mirai)", "value": "8713aa52df1b865613a43464a72375ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054684, "uuid": "2db08dbc-db95-4eb3-9663-4a1843526ec1", "comment": "Malware payload (Mirai)", "value": "7ffdfc4c8f5de462b22116b129f00c96062e5266b5bff71809195420d5833608", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054684, "uuid": "327e5e6a-43e8-4fe4-9464-cca4915e2d1c", "comment": "Malware payload (Mirai)", "value": "10a7dd78fcd15e12eb29c7b77d4a2265310276ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054684, "uuid": "19856c5f-6f56-410a-9805-5ccab5d065ed", "comment": "Malware payload (Mirai)", "value": "3d1877668784ac9d97e5521c4494a571969059197f08546c7b5fc99678a0268524864eb93735f30644d4e906546028d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054684, "uuid": "bd100d9a-9b49-4989-96e7-c6ab18432c15", "value": "T1C1930985F5C740F6C807493450A7F23FDA32E8AA517157ADEF8DAF22DE77A01911218E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054684, "uuid": "dccbf1ad-045f-4593-ad1d-6f167aa848ce", "value": "1536:iajg0dJ/INFgkBQaAdGabvdzZlZF9AWNxbTeYlDN8S8uL6s:ia9JgNFggQndGMZlZF9Ake2DN8dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054684, "uuid": "1951329b-c158-44be-847a-8be25869dd33", "value": 91216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054684, "uuid": "422160b4-e6ce-455e-966b-aa4dae7b1623", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054684, "uuid": "2874a31e-e580-4d7a-97cd-b7b053611a4c", "value": "8713aa52df1b865613a43464a72375ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523134d8-7a43-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1699014005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014005, "uuid": "596ecaf6-80aa-4124-8ddf-bd07bad0cb37", "comment": "Malware payload (Pikabot)", "value": "4be68658cd0aca177e44e81bdc89d765", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-P189", "colour": "#3A8F02", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014005, "uuid": "d556922b-51cf-4f9d-856f-1b7620faa36a", "comment": "Malware payload (Pikabot)", "value": "802030a2333b91485bb2d1d78b2f9d8347c5dee8db669ff27c4be6782c88f0a0", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-P189", "colour": "#3A8F02", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014005, "uuid": "ee238afb-8e6b-47ee-a278-36a3d139d013", "comment": "Malware payload (Pikabot)", "value": "86c6b6da5dbd96d5e41f68941e881313090bf4f6", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-P189", "colour": "#3A8F02", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014005, "uuid": "f3edf138-3e54-4c90-afc9-5f125241db89", "comment": "Malware payload (Pikabot)", "value": "9813e4a25373f0935e8e385b99955298922aea33435e17f1f8d6ce428222c900258b04c29bf78ab9f8f01bcaedccba5b", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-P189", "colour": "#3A8F02", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014005, "uuid": "4008e542-7252-4a72-bdcf-4c686924e7e7", "value": "T17473123C8E5BE7925022F2976767C2886A529CDE5B0C94193F613B0D1B1E5E8CD7A3C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014005, "uuid": "29b2e0b3-765b-4aef-9964-a11061c684df", "value": "1536:aMcI2st0ra3EhcqmGo14ody1wbaQitSwc6OLP+CqAd2yoks4xMjALVpF:4IltaatkE4cAwbaDJFo+CqflNjMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699014005, "uuid": "92bc2571-2c9c-4dfb-a836-bf234a3cef7c", "value": 78855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699014005, "uuid": "123c7411-8beb-4dff-a734-2f4a81d24d6f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014005, "uuid": "242c4628-c251-45ab-9fb8-a05ebd040bc9", "value": "MMFI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afa4dc6-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981271, "uuid": "7fd5d6f9-5c73-495a-8c9d-11e8814fb0fa", "comment": "Malware payload", "value": "515d9691cc5c643d536b1f66de0fe5be", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981271, "uuid": "57666d7f-1530-412a-9b36-b16971e46ab2", "comment": "Malware payload", "value": "817519fba14a6a10d38e8e87081324bae93ec0213d00c7d4e50df439f51ab4fd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981271, "uuid": "09995b38-5b92-4d1b-9f7d-74fd686367cc", "comment": "Malware payload", "value": "aa06c47ff948e3c4192d821c157a54ac1e33cf76", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981271, "uuid": "f901291c-9530-49a0-973a-75f6106d8381", "comment": "Malware payload", "value": "ef8351cebb54d1d32e61aec2fd90640e39527b9425eb81d6c1644de3e38ee58f481fa7cdfe254b72c70db15851d4ed88", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981271, "uuid": "70034725-ece3-40b0-a06e-c316b75cf431", "value": "T130A45B7EB5C684B2C03D5A3458832BB8EA29B9D34F73864F6A74FF8D3C351605A6B150", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981271, "uuid": "fdfce428-d8e5-4843-91de-594f44117e35", "value": "d384bd976ca952add3e058d10c3d24ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981271, "uuid": "9fe69691-a16b-4225-bbd3-9b3d2ca91740", "value": "6144:XqMmee6ICfPQAX5/6HVtDA6ZZ61S5ukxL4zOSSWRiR3Qy9APoE:6MSbCfIHkUs1SFxL6OROSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981271, "uuid": "45a59bb0-a79d-4e88-8632-b7c51cfabad5", "value": 450362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981271, "uuid": "0e60d507-3015-44ad-a5d2-aa039283b1a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981271, "uuid": "0faaf029-53ab-4786-9e49-4f53a1975a9f", "value": "SecuriteInfo.com.not-a-virus.RiskTool.Win32.ProcPatcher.23472.19054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22f354a-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998382, "uuid": "583ad243-048e-48aa-b767-c7c3c3840d92", "comment": "Malware payload", "value": "50bd6bea90ec50408ada97418a8a5656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998382, "uuid": "551e0746-041b-416b-b061-72589e6e042e", "comment": "Malware payload", "value": "82188fb69fb8920675d6c185560385c2526219f9fdfd0220490cd7ebb2c57697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998382, "uuid": "fadec474-9a89-43d8-9548-d539f6b97231", "comment": "Malware payload", "value": "4d32553b4f9fda2bc979d925b49c5fdc324c223e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998382, "uuid": "fa553722-b9fa-4a6b-aca2-8a95b8f3e3de", "comment": "Malware payload", "value": "8fa588e1a24144b4cab9b5f37e20d394ee78bf5125e33f75a22d32a192a18b510dbb72cb80b4cee88d0a80d103bd26fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998382, "uuid": "f23d7498-d0d1-44fa-a942-7fbc89e4eefb", "value": "T1DA144D06EBFAEF30CB34553FC28576280F7E5EE151A2BA4E7448B1642EBAE51C104797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998382, "uuid": "0f710b8f-9d60-440c-817d-4e2055e418e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998382, "uuid": "ab8c2dd0-c737-48e6-8166-3ccb8758014a", "value": "768:WbsV+4FwTBpqoOkAIP8co9kWFpCGUobAAHCOofRpESUJXtAhVm13jWtSHPWcVaYb:0E+4wTBpqINGdFhU6AACOofoS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998382, "uuid": "76361063-d5d8-47f7-a5fd-ab53230373c6", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998382, "uuid": "6931bcee-7454-42dc-a1bd-85e46c944b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998382, "uuid": "8015a203-9d4a-4b18-9ba8-8295daeb50f1", "value": "PI-20230724113328527-BKD 3827660 PI.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777c0e53-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996888, "uuid": "7f65b8b0-a890-4c4e-b994-f24234ac3381", "comment": "Malware payload (GuLoader)", "value": "5d485369d6acc83542b08175a810d609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996888, "uuid": "6de17837-f590-4adf-9202-fd692bc879e8", "comment": "Malware payload (GuLoader)", "value": "823b3f494013b6a01cb143ac8ce010325499c2c48772bc0aa1882c22f7ebe618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996888, "uuid": "79895271-4328-4989-bc23-bcfb6b960a22", "comment": "Malware payload (GuLoader)", "value": "c4398f4841aee509733cd2d6d840da74aaadf5b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996888, "uuid": "e1215c34-3531-4a63-99a7-fb39f27e6b44", "comment": "Malware payload (GuLoader)", "value": "f1dfc909a2b55523c0181c739bb248c7561cdec0ec937889c3a8a0287f9b780599e9bab818db848de72c694bff8fac2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996888, "uuid": "c30b4ad9-ee1d-4912-bc75-e03c7e2af173", "value": "T15C15239123E0D8F3C277527842964B1EEBF8EE3464A7938B5B023D4CAD366C35725758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996888, "uuid": "af0fa14d-b3c3-4ca2-9731-803bc3546a9e", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996888, "uuid": "71a8aa6a-3e41-4061-8ea3-310cc8b48700", "value": "24576:INPx3TpLxGIFA9roz6uc1L9J8xVCT5ATqY2BXY6+g7:mBTJs+0roz6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996888, "uuid": "7dc468c0-523b-4f5b-bead-d0f6c0b70fc5", "value": 880680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996888, "uuid": "652669db-b095-4f6d-a8e8-591ef160093e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996888, "uuid": "3fdd1758-170a-408b-a167-5d43f78cabe5", "value": "Klammest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43462dbe-7a0f-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1698991646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698991646, "uuid": "0b958fcf-cc78-4750-9386-7cb0fc81a279", "comment": "Malware payload (AsyncRAT)", "value": "844919b7bfb6d46a03f571f69f84bf46", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698991646, "uuid": "2e9fc104-9fad-419c-8e95-2ffe6fe0f190", "comment": "Malware payload (AsyncRAT)", "value": "825025c1f8e21a4bc56ed6366742ba9b8434358baa68c9d3af73736a9ef3b520", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698991646, "uuid": "7df07f65-1001-4bb5-84c6-f2c4965a7476", "comment": "Malware payload (AsyncRAT)", "value": "dd0b4e92f8f068c1f8ce9aa3b41278dd83a602a8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698991646, "uuid": "5fc09921-519f-4a37-9b56-658ad3da1269", "comment": "Malware payload (AsyncRAT)", "value": "14b19554a411ba8fc1963ad17ec9f06d554dc417c127cd051fb90eeddbb15fca5dbab96e51aa585943417ab2c8983504", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698991646, "uuid": "936460cd-1c73-483b-b53a-e6bce73c1a76", "value": "T14B235D003798C13AE2FD47B5ADF3A2458679C6672903CB5D6CC860EA2B13BC556136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698991646, "uuid": "04bd1865-f2cf-4e5f-9a20-d913cc4b69c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698991646, "uuid": "96f90f43-0350-4aa4-a8f0-ac43c49a62fb", "value": "768:V96mxUTILWCaS+Dih0Riob8Yb+geCmvEgK/JzZVc6KN:V96AKWKTzbBDmnkJzZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698991646, "uuid": "c2514669-e0b0-4788-81b7-b84b1250dbc1", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698991646, "uuid": "7a35ace8-7c8a-4c01-8cf3-4d65b131635c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698991646, "uuid": "2cd3fea1-2a12-411b-bada-bce5e1e5449d", "value": "bRio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cea4494-7a3f-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1699012386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012386, "uuid": "fe637401-a624-4a8f-b493-ccfedae5b59b", "comment": "Malware payload (Adware.Neoreklami)", "value": "8e03fddc51dbea3d46962e2b27810f3d", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012386, "uuid": "945d7e1d-55ac-4ce5-81d6-3ecfbc91b44d", "comment": "Malware payload (Adware.Neoreklami)", "value": "83cf1a0e95e1ea5a5780f49aab15c1aba377d4d280aa8fc3a7f8cc9a0b4f3e22", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012386, "uuid": "388c5bd0-23c5-41dd-8322-56f161825201", "comment": "Malware payload (Adware.Neoreklami)", "value": "90ccd0faef0ab7225a1f879fd818d7659b79826c", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012386, "uuid": "4904e11d-c3a8-4d27-8b22-82b0c000fc51", "comment": "Malware payload (Adware.Neoreklami)", "value": "626172f32e0aa43175579114e6ff7d9409cabacd89fb0d28de745c37d1a4ace83dc94c55eeb50a7b119ac6c58c9748d4", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012386, "uuid": "28be10ae-91f2-49f3-9766-5553950d52e5", "value": "T1B776333034DF8E77C54B06315BA81EC2C6FABE861F2B4477A751E7181D8A479932272E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012386, "uuid": "69feba91-c2c5-490b-8674-b7e787ade0af", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012386, "uuid": "1492f1ca-ee41-4f76-84dd-781f7feaf439", "value": "196608:91OHECEyCZ9QSPUFKngcMbezZctfsggmeW0Eso:3OHEykfPUFKgLCz6KYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699012386, "uuid": "dc8a1a7f-4bd8-4d19-b802-3f9840b64db2", "value": 7522327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699012386, "uuid": "f4e82524-204b-4b55-a9d1-21c5775df523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012386, "uuid": "901cef2a-e613-407e-8678-1474b4407968", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f5e3a0-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996877, "uuid": "558682e6-299c-4aa1-af02-a3a9f7010976", "comment": "Malware payload (GuLoader)", "value": "3d1fa3388213b87d07d4200d6ea4e4e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996877, "uuid": "6aec0ef4-6dd4-40b1-87a1-e8a7168636b9", "comment": "Malware payload (GuLoader)", "value": "8462e1e459cb9ff898d4ed958214a0a6f413706531df172370206af82dd5f362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996877, "uuid": "8a730622-c6dd-4d79-9744-4f3da6f0dfe5", "comment": "Malware payload (GuLoader)", "value": "3b961b92aa0b4b5b34bc3697637bb4687eb84fb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996877, "uuid": "fa27f899-6db6-4ee5-9e0d-3146d1558860", "comment": "Malware payload (GuLoader)", "value": "43a688bb6a8427aca6a68cec2e5516e5e3bb84aacc588dc42f58f9f56eab88bc2a5e5b9a9c274ed81fb301d5ca7153e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996877, "uuid": "b77607c3-6821-46f6-b98a-bc5ad144503f", "value": "T1B165334445B5DCD3D12002B855F39F3FBD5BBE63EC6825821AA5BEABF826402F418E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996877, "uuid": "381d34f9-dbe6-48f4-81a9-a5541cad3ccf", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996877, "uuid": "0f87f5a0-80ff-458a-8a7c-417c8467982e", "value": "24576:b7iQ3JdYazafQx41NYccdweDnbdGNcvJWf2yKIkLin3fkm46kuwaZuvRAn0lVbq:KQ3JlzaQ4QdweNhWf2/Lc3fk62miin0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996877, "uuid": "edd065da-b26d-4dc7-a590-d982677f56d0", "value": 1470340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996877, "uuid": "ef73ddab-88f2-4184-b8ec-dfea3dbca5e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996877, "uuid": "faedb776-af52-4d3a-96cd-87e3c50cd76a", "value": "986890--0987654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4216ac6-7a63-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1699028021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028021, "uuid": "b974f2f0-a283-4d61-ab11-24cd733492f0", "comment": "Malware payload (SnakeKeylogger)", "value": "9f061ed14a6be403487e1d5d9f57c1c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028021, "uuid": "2ea9ac54-6af0-452a-838e-2a42995a9519", "comment": "Malware payload (SnakeKeylogger)", "value": "8518ccc749c3934b1ce840e708d97659b02f1ba717205789d869dbb49103f5ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028021, "uuid": "2474a10a-4f90-42cd-a864-f27c1650c336", "comment": "Malware payload (SnakeKeylogger)", "value": "14b8bb53f104da83ac047a2133b3c16b1c417ae6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028021, "uuid": "220d5c61-e141-4881-8802-67e48f3d83b2", "comment": "Malware payload (SnakeKeylogger)", "value": "f567bc53e74f7a45a5d44d736220303b3c5418d059508a5d066c7968ea7cf5a897833093ad3c162d51b74c08291abab4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028021, "uuid": "bfb243ec-4f42-4197-af0c-3e6a1af99a68", "value": "T157353A0C77A4E858E17E47BD50926154A2796309BE42F74E77D058EC0E7EF238E1A2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028021, "uuid": "3ac312d5-f4b8-4396-8b27-2fc498bcdc62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028021, "uuid": "28f2bdea-835d-40b8-ac84-282a36426b48", "value": "24576:ktfo6PTetbba1C/Ll3HoyhLLGmkB/YAuseX7KvO1YAuJMi+sPV3GykDfMNVzCOgk:Uo0etbba1C/Ll3HxHRpAuserKvpAuJMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028021, "uuid": "f49fc684-2ecd-43be-9422-2f37e0c39d26", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028021, "uuid": "5c06ee70-9d63-414b-9afb-595682efd189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028021, "uuid": "828198eb-3d8f-4cfc-949d-8ab74440311c", "value": "3302-9333-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3178510-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699054997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054997, "uuid": "3f405936-bb39-4ea1-a993-888670fae8d9", "comment": "Malware payload (Mirai)", "value": "c9d8b92425e2191d770b9f02c104d301", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054997, "uuid": "7aea244a-df34-424b-a67f-342483d1f9b1", "comment": "Malware payload (Mirai)", "value": "852a44aaa436ff8cc36fa61e269b696bb2d67bec968261d5c478a8a9069cc586", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054997, "uuid": "69846e58-02bc-421f-8a81-4b7fc5fd7dd9", "comment": "Malware payload (Mirai)", "value": "f414b8e1af4f3011ba81b6a65369e7fa4f634c71", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054997, "uuid": "5bec870d-2932-41ee-8066-f060133f0f38", "comment": "Malware payload (Mirai)", "value": "4ee013605124cc2a85207f83385878a0af18c18ecd0db6e7253028a3088945febb23c5d0e4f0be6bdd87ce66f4b6892e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054997, "uuid": "b2a0b3cc-75ca-46ba-81ca-4b0e0003c0de", "value": "T1C1835C4279C088FCC088E13846BF757AC515F17D3235B6DB27C5BF1A2C09EA16A5E86B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054997, "uuid": "8f509e32-5489-4cac-98bf-27b6189a4fbc", "value": "1536:8NBvpArPV2NcKz5IAZ0LSXq9JIs4WrJcW/BMMxmb9dFLJt:MA92NHz5IAZ0+eTrJRBRs9dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054997, "uuid": "8a667d17-a387-4d0a-8b03-38d98ee16f23", "value": 87296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054997, "uuid": "b1a55e38-4000-44bc-8fe3-873dcbc1b727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054997, "uuid": "0708cbe6-4300-42fc-933c-12c2ed5901b9", "value": "c9d8b92425e2191d770b9f02c104d301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9ab08e-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699055038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055038, "uuid": "69c66c0a-7f57-484c-9f74-8631db315a87", "comment": "Malware payload (Mirai)", "value": "8ddf380e28a89f8fb458546105d46671", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055038, "uuid": "fa7fdb73-9f6b-46b0-903f-d0fab577607b", "comment": "Malware payload (Mirai)", "value": "853492945d116a1d839281d658cb33695dfce9d8f61f35c369c7c0377173dea8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055038, "uuid": "c3216e40-222a-49fc-a87a-0c676bf9dc26", "comment": "Malware payload (Mirai)", "value": "815f16e071abbb1743d7f04993cc24ec7b4f5d10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055038, "uuid": "ed166b29-a8dc-474b-807e-d14dddce694c", "comment": "Malware payload (Mirai)", "value": "88c63baeffafdb708a38ab184c35cc8515c007d9ca97c3b0ddfb492a3253abda89e485444f4a0e2c5f1f1be1aacbec15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055038, "uuid": "52e4b680-37f6-491a-93b7-dc1a59256679", "value": "T1CE834B8AB4019FBCFC9B99FA51154E0DF82162015F530F2BA7A7FD933DA20A1DE07946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055038, "uuid": "0b23fa7a-3211-4202-a3b0-1bfedc8b5e71", "value": "1536:vIRZtZ1xk8OhkJF9aJGbQVVW+PXbumOVOzBMwka0sJpKgQn08PLcZT:V8OAfaJGbQVVW+P6jVSOwBeg09M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055038, "uuid": "a6aeb9ef-cac7-4353-9db6-0fbe0192a5aa", "value": 85008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055038, "uuid": "dac27edd-8467-447a-93f3-e97f6e37beb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055038, "uuid": "e7e6c74c-ac03-4a81-9d1f-56a62a116d4a", "value": "8ddf380e28a89f8fb458546105d46671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a24614-7a47-11ee-8907-42010a9c0042", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1699015675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015675, "uuid": "43af82b6-0369-4fe7-bc9e-e574780a8c17", "comment": "Malware payload (YellowCockatoo)", "value": "c3589122260cbac4080ce3b7d0b698a2", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015675, "uuid": "26ab65a2-2548-4039-8526-97a400256206", "comment": "Malware payload (YellowCockatoo)", "value": "8644d2766bba6fd0c5f9b614db6e091a17d00585d259e37fc8466e0a53287083", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015675, "uuid": "0111a36d-55ee-4335-ae38-0ad1a5312dfd", "comment": "Malware payload (YellowCockatoo)", "value": "2f4ea0a5f208db3b8773faa4b0970749a394fa29", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015675, "uuid": "64b033a9-3af2-4ed0-9c3b-8e1cb70f56de", "comment": "Malware payload (YellowCockatoo)", "value": "5a0a7dd3ce0c3ebdcfd7ca10c4fe9c1afda5c636b7bd16fea5ced6808ded45d86580d52e761011049855735c1431548b", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015675, "uuid": "9a9ff394-7f35-4927-adf3-4261c5e8db8b", "value": "T1ED17997FCBEA6DA34C852EA76565E8C07122EB0E8F717B6D681005DBCC08385D95E38D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015675, "uuid": "bc07bf84-1be9-4ca8-9f3b-b3c14f2cee20", "value": "393216:zRs2qGmkIi2NyKyQyxYoLlCVvHt88Z12bRUO6G0ZFomDp6:Kumk2NyKbG8NVZ1uB6G0nFD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699015675, "uuid": "13751399-0fef-4ee0-baee-a304b5e3dc89", "value": 19750553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699015675, "uuid": "339e4d82-cb0e-4769-b088-2e04a789d319", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015675, "uuid": "b10f79d8-0afa-41ee-a3c1-7fcebddab70f", "value": "installer-bundle 2.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17df0e28-7a7d-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699038818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699038818, "uuid": "c443ce7f-aebd-4a25-a499-513f1505c50b", "comment": "Malware payload (Formbook)", "value": "280b7fc7691f4ef2ab7e4fd6a0ed9c62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699038818, "uuid": "88696f81-46bf-48d1-ac31-107014040b27", "comment": "Malware payload (Formbook)", "value": "866793fb3e5da0b352d26f37db6deaa73b598019a29c0434da5a805c12fda095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699038818, "uuid": "46329b83-37dd-46c7-a13a-45ee604f9d91", "comment": "Malware payload (Formbook)", "value": "d34061308542ffd1a0940dcbdca8fdf54aaa3b85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699038818, "uuid": "cce7a1ff-f91c-4e93-aa73-fbf5da6d1c91", "comment": "Malware payload (Formbook)", "value": "6277eafbd474a2b6e04260f702bbf1ccef592e5505c344c10dbde687b59f8c73864dd1ef459fb1c818c76e6763814add", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699038818, "uuid": "0092cd5d-07dc-4449-b6f0-7e5133beadcd", "value": "T10AD4122877B95B11DAFF87F618A02444077670EF7566F78C0D9061DB2261B80AFA1F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699038818, "uuid": "b2fcf5ac-8462-43cd-8961-b7a056f7f3f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699038818, "uuid": "55b99437-11ba-4250-927b-833a2a50bdd1", "value": "12288:dALLsbJC65ntJmIoOoXpaxl7DAdMpMAwDADqS:dALLsb77oa8SHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699038818, "uuid": "6e8b4c14-cf7f-4f31-95d9-28d153fa4ef8", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699038818, "uuid": "48b5b90a-cf2d-4815-b214-48a4c56d9da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699038818, "uuid": "4fe99b05-9c89-4644-8496-1a3d75e16505", "value": "SecuriteInfo.com.Win32.PWSX-gen.9403.13485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd66398-7a48-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699016118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016118, "uuid": "aaa21255-78cb-4e0b-9dca-9cc47e416e53", "comment": "Malware payload (Formbook)", "value": "c48b9c850349fc52638fbbc3d8b53b82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016118, "uuid": "979f09be-9194-4174-91d0-a7d0b75cae7b", "comment": "Malware payload (Formbook)", "value": "876fbd2b5fb59bfdb8b09e09a99d3ff92428eddbbfd096af61364af56de20f0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016118, "uuid": "82290eff-8b66-4d8e-945f-1b7430c1e100", "comment": "Malware payload (Formbook)", "value": "6ba84b40b2e045d5f24526e19232f90eaffb6a6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016118, "uuid": "5ef2d9f3-f898-41eb-ae19-7a824b16958b", "comment": "Malware payload (Formbook)", "value": "14c084d27c9c89dbb28b4f0082057c73eb202f2ace9950b428d96942bc53f4b49a27962455b3198d5ada8dd0b7b2ead6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016118, "uuid": "dbb1144e-0257-4fb3-94f5-9cd098e5cb9e", "value": "T191856B8DBE0BD922CB500230D496C6F6361B9F4BD603D2236ADDBDB370BA7455278297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016118, "uuid": "1a565cb1-58a4-4dde-bdb2-a5b150da3deb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016118, "uuid": "4013c7ea-330e-4e32-adaa-5279ce33175a", "value": "24576:czL9Mn2HfaP6waDllLopDAOmHg9e5024n0wjn6PPtY:l2/aPkhlLopBmd024n0Yn6PPtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699016118, "uuid": "986ccfdd-5dc2-4aa0-bd0d-df398553647a", "value": 1779200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699016118, "uuid": "1e2d50f3-4734-4322-8850-fdb32af2f05a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016118, "uuid": "363e38c4-8607-4ad2-9d14-c11e51c41543", "value": "876fbd2b5fb59bfdb8b09e09a99d3ff92428eddbbfd096af61364af56de20f0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfd0c5a-7a32-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699006616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699006616, "uuid": "bdd27855-acbb-4988-a953-985a8c3212d1", "comment": "Malware payload (Formbook)", "value": "0c57a7aae080fd2eac42a31fa5b7f051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699006616, "uuid": "739967d9-3df6-421d-bca5-ca0393fe204b", "comment": "Malware payload (Formbook)", "value": "87770248637ba53e2fd2c65ec24b95659d9b1f2d3af87234601fd720f81d6fd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699006616, "uuid": "369fde0a-7142-448f-94ef-4ad6a251315e", "comment": "Malware payload (Formbook)", "value": "2e181788e6dec9e170556e2daa39a61dc2bf8b89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699006616, "uuid": "b60fa4be-3050-4774-86e1-4ac0d73e59c7", "comment": "Malware payload (Formbook)", "value": "df015f9c34500ed415dbc77b7dbb2766ed6dc9df0f2fe5b46020f237a1bf548dd00d94189bbc118362880919c474cb37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699006616, "uuid": "f32deac1-6113-4e8a-97f6-d5e97f94324f", "value": "T14394231F5AC0C877C19207F50DB6EA76A7798D05A5D06A87CBEC3F73B821786C2062E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699006616, "uuid": "c2534ff2-b85e-42a9-adc7-9d7c386e50d6", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699006616, "uuid": "0f798530-d84b-400d-8886-1ecb347e8111", "value": "12288:urCOfcbuDZzf0/vJomoJNmBPQBZo+j34j:UCociJwB7AKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699006616, "uuid": "8d993eed-b4d8-40df-ae3e-6c58ed0b8880", "value": 420368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699006616, "uuid": "9f5a34e4-de12-4bd4-91c4-9a0c93305456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699006616, "uuid": "e60e9eb3-053e-46b0-82cb-b8e6fa75ec42", "value": "SecuriteInfo.com.FileRepMalware.16340.31219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6013dbdb-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (LimeRAT)", "timestamp": 1699032926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032926, "uuid": "0c5e9e37-4135-4ba1-846d-11aecfe15df7", "comment": "Malware payload (LimeRAT)", "value": "0991038c39a133e2f2e5c56161d3a254", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032926, "uuid": "4bf31558-fb58-4621-a382-5c7b151cdc10", "comment": "Malware payload (LimeRAT)", "value": "878555f3bd2bfb91306e56e152a5f890af878cd583c7e79a0bd7d9821c6240d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032926, "uuid": "c71364a3-9873-4882-9e18-6406a2a65d21", "comment": "Malware payload (LimeRAT)", "value": "d045811cacd96cc682db94ed6f6f1243ad935693", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032926, "uuid": "482835d5-da38-47dc-8628-0c45b5dae14f", "comment": "Malware payload (LimeRAT)", "value": "51445488947322cbfbb2dc06250f1d4b5495e0d280714481fdba8af3a888224637e9e19a9324e45c095f68c136dc69d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032926, "uuid": "8792dc3c-120a-49c3-b5c9-c29140675346", "value": "T18B053B27BE8A9D11D18A5F72C2D7462447A1D9C62327D60B3DC523B20E433EE6A4F5CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032926, "uuid": "deb92ecf-a431-478b-bd00-f87fdfc70924", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032926, "uuid": "fae9fcfc-35a9-464b-8480-e9794262e426", "value": "12288:WO2mJ4YeBcY62egCRuwRchzRWJtMHYtdA4AgFsg/4E4gG7eeIuXIkFfH:JZJHkeWzoyHYtd5AgFqE4b6eIuhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032926, "uuid": "2b343cbc-1cff-4684-ad6c-8dad834ac5a7", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032926, "uuid": "4f8a4ba9-6271-4615-9dc5-57e8833c36ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032926, "uuid": "364f7439-28a0-4792-a4ff-88d917f98fe1", "value": "HEUR-Backdoor.MSIL.Androm.gen-878555f3bd2bfb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad4229b-7a1f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698998423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998423, "uuid": "1a3583d8-b68e-4959-ad1d-220c357cc110", "comment": "Malware payload (AgentTesla)", "value": "5bc9789cce7b56a6163fad765618a6f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998423, "uuid": "ad03a4eb-656d-4988-8dcf-8abf2dd6809b", "comment": "Malware payload (AgentTesla)", "value": "87fdfcffeee16c0392a4ef6eac8d0fbf1124dff9e64bc6cf8f7cf36af40e6d93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998423, "uuid": "f6e845cd-3dd9-4d79-8b7c-1ce898d954a0", "comment": "Malware payload (AgentTesla)", "value": "93aef3423823406b07eb018dc90b0cdc75154317", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998423, "uuid": "f00cbbca-a732-4172-bc3d-dfa9d4890d14", "comment": "Malware payload (AgentTesla)", "value": "e1d1bb8e42adc0d9927e7a73004d3eeebbfa2f6075ae74d45dea6bb4ff63c87ceaf6023e9781a72270629bd799f679ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998423, "uuid": "e5b7aa58-6eff-41f6-b215-7300242707a5", "value": "T1A4D423A2627A6F39DC7AD7F27055DB001F7E90AB558AFBB90CC801CF8C57B024658A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998423, "uuid": "4426bebe-e126-41fe-9350-d14605225bc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998423, "uuid": "db7c86a0-358a-47f1-bcf4-7a164d32a2aa", "value": "12288:2IkwCdhitn+f/7cjRO4PG6fglDqJQMSHFIo/dl5fXx/rDfViwXFxc97L6QX3:2IkOtnwzcjo4+60yUHFv/VPxT7V33c9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998423, "uuid": "b3628aab-1039-428b-a46e-5ed83f18799f", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998423, "uuid": "faee821a-156a-47fe-a38d-41430255c450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998423, "uuid": "ef088b3a-a30a-4dca-a0de-7d094f46fb55", "value": "hYy7YaQTubQ7az8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f91fde-7a18-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698995588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995588, "uuid": "e0543c3e-a6d4-4778-af27-8e734efe494f", "comment": "Malware payload (AgentTesla)", "value": "5f4cc48f54076151ba2d2cd30d0f53f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995588, "uuid": "87e186ec-52e9-41fe-9103-37918efc63f8", "comment": "Malware payload (AgentTesla)", "value": "880b355f4d076ee0088a17ca0b32c4b3771aae3587c49c60d853c31f129b18ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995588, "uuid": "2557c762-9415-487b-a4fd-9002cef49793", "comment": "Malware payload (AgentTesla)", "value": "5bed0e55f1982b472a57d082b3e3227ef30086ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995588, "uuid": "c666d9f8-56e8-46df-a54f-aee08a89bd8c", "comment": "Malware payload (AgentTesla)", "value": "30630846d56f36ca1936740628e98887e43af6fa1efd0a72b530b8f609e76d863293cde2d37f8f424920812430ddd0e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995588, "uuid": "90489010-9bad-423c-a49c-55a20eeb6251", "value": "T18CD42393337B4B23D42F4BF5406566506FFE534B2A23DB580C9620CE5D8AB948AD1FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995588, "uuid": "0478da9f-7a54-4528-81f7-0a84c49dc1a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995588, "uuid": "ac9ee2ef-7795-4ab5-a742-bdbf8c40feee", "value": "12288:iIkX6hQ/tYQpRIlSlvHuTk1kAB/bsqgt/KY++aFVCqnQr73ZBk2Uph/9:iIkX6hYiQfIlSl33/wr/V++4Vc7s2gh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698995588, "uuid": "36f48a2a-44f3-4684-a260-97f993aa71b1", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698995588, "uuid": "9ff4d725-0a2b-4700-b03e-97f2bddcc192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995588, "uuid": "f8455857-7e83-42ac-8fec-536f0e340483", "value": "PO 2300982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c8beb6-7a21-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698999433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999433, "uuid": "bfed6a72-a1d6-484e-8961-51d40f5fe70d", "comment": "Malware payload (MarsStealer)", "value": "62682dd05ce9c8d39825c021ed80bbbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999433, "uuid": "9fce31a4-62e4-4b9b-90a0-cb80319e8b5b", "comment": "Malware payload (MarsStealer)", "value": "88b485b2505fa50a505d0cddb6f7ea10a60d137e008a0e29a04e18efc63a1cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999433, "uuid": "2fff74d3-bff2-4f28-833c-f8f770452092", "comment": "Malware payload (MarsStealer)", "value": "a4d81f0d71f6e26ac4673db25aa312407221c707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999433, "uuid": "6a0c609c-fac7-4f4f-8696-129965f98d05", "comment": "Malware payload (MarsStealer)", "value": "500ecf25f50d4e5768fa7a130b81cd4760d12c5369044fd02f3f7f10f20f190673644159b60fb4695ddb049946d5dec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999433, "uuid": "7bedda7f-cfde-47dc-8451-af25bd8d740a", "value": "T1EE444B7352B17C62E526C7328E1EC7F87A1EB9608F4537EA12659E2F09701F1C27271A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999433, "uuid": "4292b797-60a2-42b0-b5cf-ebd8a86453aa", "value": "ee827750429cc6977e10fe712ee76a8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999433, "uuid": "65e5363c-07b5-4a85-8c9d-0c698db43cc4", "value": "3072:/DuFuMxDFtkZAUo4iOYxRW5kYXLgQ/ws1/wNb8Tobsyxd:KuMxjkZA/4TYmtXEQpwlIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698999433, "uuid": "2c039a00-5644-4af8-919b-776747f4601f", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698999433, "uuid": "da1ca870-b2da-405f-acf9-95a12b50f70b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999433, "uuid": "1c47f69a-dab5-47f8-b898-1f446f19169c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8e038c-7a48-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699016198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016198, "uuid": "425beb52-22f2-4472-9e3f-2715b57c3a53", "comment": "Malware payload", "value": "49825b4b8d782f21bcfc5b6af88c95dd", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016198, "uuid": "ec532141-49b2-481d-a9ae-d14996e54c94", "comment": "Malware payload", "value": "88f92888726751503142c340bf692e2c955327d3270cf663939fb6903bf2132b", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016198, "uuid": "6dee934c-c582-4eba-80f4-ce248e2116cc", "comment": "Malware payload", "value": "6aeecb9c123282e17fc00910c3eed5785c5885d7", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016198, "uuid": "1c261640-db5e-47e3-ab4f-66356a7327bf", "comment": "Malware payload", "value": "5a81d4f29b521425883cc610ba64c789dd500a3a0bbdaf8c672330609dcb3e1996923e953c9426c18f74752d28313580", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016198, "uuid": "023b3028-95ab-4d3d-8bcb-56b36d624e55", "value": "T1514412083059F04AC15292BD4EE6D0DB510EFC36BEC9B28B35B0FB2D7AB8E525645B4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016198, "uuid": "872bd998-7f36-4613-91eb-2ee2dee3e71b", "value": "6144:A0cBC6QREciOTNkqck8J4e4LGrukACXi02JNaw8X1i3GcGg:ArBC6uEHOTNkqC4enruAXdia5k2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699016198, "uuid": "bc318e2a-c63e-47bb-b77a-704f4ccdf939", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699016198, "uuid": "499df4c7-3730-4764-a79c-d3911cd54a11", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016198, "uuid": "54b4fc20-a073-4433-b001-ac252fd4c51c", "value": "documente solicitate-110223.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3508f6ff-7a42-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1699013527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013527, "uuid": "2b5f5d76-c82f-4161-9030-27afd25735ca", "comment": "Malware payload (RemcosRAT)", "value": "e63ae94c81052d9961b82292221e23d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013527, "uuid": "c8bc7213-2014-41aa-8bb4-256229da5cd0", "comment": "Malware payload (RemcosRAT)", "value": "89ada7dacfa99c7de980e591438b5637a479fdf005df524b28c41088b5aec32e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013527, "uuid": "386ecb45-b3d1-4b78-9e24-b56d9c848ee5", "comment": "Malware payload (RemcosRAT)", "value": "c8f3e78a2fbf2364226a8c4a2834aa1bdfda7b07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013527, "uuid": "9c3c6e19-fc22-4194-a98c-d581b09b3354", "comment": "Malware payload (RemcosRAT)", "value": "15f774ca6d2250db82eb33a4aadb9b45201572535e122d5d4f7e871baca66b578ba75d12495f31ff7890f184d6172469", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013527, "uuid": "d5150839-2976-4b90-ac59-12fc8b5d0ddc", "value": "T10BD4F195B950C9C2CA289430D8BB41690B76DC2898851FD7EF5BFB2E3C32994B50F67C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013527, "uuid": "8e774441-5f1c-41a3-9995-946875a83cb4", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013527, "uuid": "7ce9e5e1-4d59-4db0-88e3-ed17f942b4d3", "value": "6144:o48T4kdmSlLDllqQD2ZJnGwvieTDaF3uO3HGFkgBR+G5VV4IEb6dDrgJeKWnuJKI:obMLSlllqQDSzSfXGFkdGV4bUUTWuR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699013527, "uuid": "d4cff56b-85aa-4b09-b082-8877e203604a", "value": 655869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699013527, "uuid": "4f9d0df8-ca80-4674-9bba-2bec951fce22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013527, "uuid": "ee22fbfd-f7be-438e-872d-3a02dfd1ceee", "value": "89ada7dacfa99c7de980e591438b5637a479fdf005df524b28c41088b5aec32e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b1be07-7a59-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1699023487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023487, "uuid": "6fa3f299-6b97-40b1-89cb-63f3e30dc872", "comment": "Malware payload (Healer)", "value": "dcee3487134de31384cc480650d0b872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023487, "uuid": "cdc0fd4b-5f8d-4cdc-a138-1d5d42d6b41a", "comment": "Malware payload (Healer)", "value": "8abe67f3fa19414604fbb2a1510012895dbf0e89c55c9ff8d1a156b868ee9bf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023487, "uuid": "fa2f1da7-6fe3-4fcf-a88b-f2c717267fb3", "comment": "Malware payload (Healer)", "value": "728aac232b591c08d2a0a727a5024afdb17f3b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023487, "uuid": "b910197e-2e0f-4645-a0da-4cdeaa78106f", "comment": "Malware payload (Healer)", "value": "07f6bc620dd48a601d3b08472b29013ea6d5987e3e100dbf18bb0a9e6b018f0af943de7ecab95e2de87e0f9c5d90c921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023487, "uuid": "f29b1450-6f99-4a20-9618-31c49c481df8", "value": "T10EB41227E6DD4032D8B527B018FB07C31F36BCB16D34936B5649782A1CB2A84A57277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023487, "uuid": "121a73ce-008f-49ad-a562-cc7ae0c73a7d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023487, "uuid": "30ef6e90-d863-4831-a4df-f60e59691d3a", "value": "12288:4Mr8y900yOk63JeBswLMA9Kyzr7Hx/XupZF7:UyMx0eB0Ryzr7Hx/XupZF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699023487, "uuid": "9238f95b-9b66-4bbb-b3b9-24da48b98fe0", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699023487, "uuid": "96010642-d952-43b8-b83e-b1bd69db8271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023487, "uuid": "6ee81f6d-ab4c-40e6-a8a1-a9be8f67f399", "value": "8abe67f3fa19414604fbb2a1510012895dbf0e89c55c9ff8d1a156b868ee9bf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785cfaa4-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1699028242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028242, "uuid": "f9d7f45b-53a1-4c4d-bcc6-9ad23f8c61e7", "comment": "Malware payload (SnakeKeylogger)", "value": "cf89a03d499a9da3518a943bdaaf3f9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028242, "uuid": "19772592-9cdd-4385-8bcc-9d8d3951c83d", "comment": "Malware payload (SnakeKeylogger)", "value": "8c366bddcc19d07924b953259274f43f30c9a70f726c70420f8a01e07a209734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028242, "uuid": "41bb042f-14cf-46e4-a0ce-8ad67cbe2608", "comment": "Malware payload (SnakeKeylogger)", "value": "f6e1db56f0a6a88a787920a56acbb2406b5fca2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028242, "uuid": "290b7f61-cbfd-4adf-8d8a-9ce21bc9479e", "comment": "Malware payload (SnakeKeylogger)", "value": "18482719884ca438deff4419554f441aa02ee5aa7f988b5d75dbada9909cedbbb89ccf53387c1dac5c549ed4d2f26be6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028242, "uuid": "64f51f48-a72d-446b-b542-310c902781ad", "value": "T1B0353B0C77A4E818E27E47BD54926154A2796309BF42F74E67D058EC0E7EF238E162CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028242, "uuid": "23d8aa73-0fb9-424d-ae45-2e1f22b181b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028242, "uuid": "05b36b55-8dfd-46a3-8818-88fb1113a67c", "value": "24576:UfjHsVx69As4hkB/YAuseX7KvO1YAuJMi+sPV3GykDfMNVzCOgKIQtKoColK5dwL:CjHZ9AsQpAuserKvpAuJMi+sPV3GykDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028242, "uuid": "2c387983-4716-4ebc-b717-c9cc0287aa34", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028242, "uuid": "981e1498-2cbf-4872-9f37-13433d4969d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028242, "uuid": "3eca112d-1fca-4c8d-9133-abc589cdd6df", "value": "\u05ea\u05e9\u05dc\u05d5\u05dd \u05d1\u05e1\u05d5\u05d5\u05d9\u05e4\u05d8 110468 3.11.2023.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24dfb45-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998355, "uuid": "ed9483aa-d27c-4fd5-a209-79f4178fcd49", "comment": "Malware payload", "value": "69e81358330328c0177ee619ae1610c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998355, "uuid": "dd416f5c-c359-4686-933a-24ae59bb61ea", "comment": "Malware payload", "value": "8d96f63485f595f40c4dd5da445740e0a6d053b0715373381429ed9291e8b886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998355, "uuid": "19abdc24-adda-4451-9423-06f7430947bb", "comment": "Malware payload", "value": "122f9b5c4b111bfa7d072f7bc0fcfd646c104eed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998355, "uuid": "f49a2344-84d9-4e4c-aa2d-db64277116f6", "comment": "Malware payload", "value": "78a66f43cdf65fd69065a791efc049670dec679b19d1517927303d9a40a5c5e67104459165042406e13987d766c5ce5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998355, "uuid": "f4214425-1595-492a-a96a-4e253b59582a", "value": "T186047642EBB6EE35CE34053F824173395F3E5E9181F2BA8E754CB1642EB9E4084446EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998355, "uuid": "d9db004d-53a5-40a9-92b9-0b5fcce85939", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998355, "uuid": "58d1527c-a872-445c-99d3-a8078c2d8061", "value": "768:RAzkeGM7JwTW9pRRR6ES0JXtZhVm13j2tSHPWcSaYB:R8k7M7Qk7R7S8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998355, "uuid": "2679bfee-8360-4c71-81e1-4a7f1ee754a1", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998355, "uuid": "72e54980-abb1-4056-bd64-77019821a769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998355, "uuid": "3ab2197e-92d5-40f9-a155-096dcd624bcc", "value": "CFH-039873653678-3093876536738903.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da045924-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998342, "uuid": "953aaca3-ec6c-4cd5-91df-5bf1ee6de8c3", "comment": "Malware payload", "value": "4b191959ccaf53301bbf8355804ac148", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998342, "uuid": "1aceb667-3248-4cab-bd71-11b41e9f0bd2", "comment": "Malware payload", "value": "8e0214fdf6713bc7c8a1b8c81bdeb96166b48375ba998cb8bad913333099a191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998342, "uuid": "f9c6264f-cfab-43f6-b595-9cea88bc6f46", "comment": "Malware payload", "value": "f8bd1cf357373fbcaa636bfdea2a1712c533c670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998342, "uuid": "52be3e87-f559-4ce1-85d5-c69607bb8728", "comment": "Malware payload", "value": "b3ed78f5fad3b023044836b5790ce19ca6894fb484597c8bf36d5f5891852f6d8c778265417d9be74174df1face48f44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998342, "uuid": "8fc7c340-ac67-45be-8b59-246d7282ac77", "value": "T140758603B976CDA1C9451737C5E73A340F6CED8062ABF62A366A33550C737666B4CA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998342, "uuid": "c7edf096-5c55-4e88-99f8-2028c042ac87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998342, "uuid": "4ed8e6d1-55fd-4c6c-8578-04085b305890", "value": "24576:E4fpo+ONHZttQZQBn3U9E2jpABpZQI7lQzuWB:NmjlK0x7lQzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998342, "uuid": "123f7096-5e71-4e70-bbe2-e97330ecb474", "value": 1659392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998342, "uuid": "c30338de-e252-4f96-9d11-318b25d5bcdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998342, "uuid": "8d47f6ee-82f8-40a6-9cb3-97c696e7a6b8", "value": "MKN~03987653674-40984747NJHFGF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d091e6-7a4a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699016992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016992, "uuid": "d545d0bc-40c4-44a7-b362-1b4951336808", "comment": "Malware payload (AgentTesla)", "value": "d128d572768992731e70de3ac91b5d4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016992, "uuid": "4bd57689-cab3-4dd7-ae10-8566603750fb", "comment": "Malware payload (AgentTesla)", "value": "8e8634064bf0a00aa6e156e7e5fc15a4e8521c9654eac9395c7df919ff22df33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016992, "uuid": "f5574611-fba8-44b4-a239-1b1c58a708e0", "comment": "Malware payload (AgentTesla)", "value": "a6550f83c8eff165679e6c4010676d5dc398e42c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016992, "uuid": "fea045b9-5873-4d18-a06e-1dc9370d7df1", "comment": "Malware payload (AgentTesla)", "value": "03a75989b1c01ceba80cceb2130a518097f9b8bbf3fd3e356778b077028bf84de7786e73d162335914c2d27e181d5c01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016992, "uuid": "23b062a0-7ca7-48f5-af22-c6ba45a13948", "value": "T1F1D4230127AC5F35C86E83F98201AB028BF9AD231915ED7C4DC6A0DF8D5B750977EA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016992, "uuid": "dadc842f-55cb-4942-b348-8a63f98a9863", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016992, "uuid": "07ebc472-17fe-49be-819f-43edeb893cc6", "value": "12288:WIkReTU8iYRXpQegU+5J3WLUOOdyJTy1ivhYN4/P9q:WIkReY87XpQegU+5Jm2y5y4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699016992, "uuid": "17e93208-d29c-4370-a668-cf80e8c525ab", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699016992, "uuid": "619b0a7a-e0a1-4b01-97a7-b1c902f32ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016992, "uuid": "9dc53885-7e60-47b8-bad0-aaa6e3317661", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2385efc-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698998302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998302, "uuid": "1b8fe6c0-a19b-4666-b642-90e389ea83e2", "comment": "Malware payload (PureCrypter)", "value": "836010dbc8f20f92cdcc7cdf4f064564", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998302, "uuid": "9a157312-3b3a-4917-8022-641ff9489407", "comment": "Malware payload (PureCrypter)", "value": "8eaa864df45064794eaf9a42f6436678f8ab128b3e0eb37035a56c69f8ed0abd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998302, "uuid": "1e66ad98-a961-4386-8144-aa232bba589a", "comment": "Malware payload (PureCrypter)", "value": "af3187d7bbc9e5ef9ec2123f01ad53c8a15e859d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998302, "uuid": "4d4d04e9-d639-4a1c-96ff-25b64cfa88e6", "comment": "Malware payload (PureCrypter)", "value": "f5057b2c471f4a7005e57a8b101dc78e70bc42503274e5cdcf208e9222d921ae2797d8c8d00fcff7ddf6432fdb453264", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998302, "uuid": "afe4cb4a-fabf-4ef2-ad39-350da61a603e", "value": "T1C1F3B852EBF6EF34CE24063F8645B7299F2E5ED181F27D8E304CB1652EB9D00D4446AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998302, "uuid": "481531f2-577a-453f-8011-ac151c731066", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998302, "uuid": "a7abc676-2a39-4481-8c07-70a03b0044dc", "value": "384:RfTJZgO4tmwww6BKpwWowwwlpESUJXtdhVm13jWtSHPWcAwaYW:1jgxtRpESUJXtdhVm13jWtSHPWcFaYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998302, "uuid": "f57641ab-0834-4a24-8e43-98bf0e585ca1", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998302, "uuid": "c8d841bf-b2a2-4234-8238-e32fd4d8a824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998302, "uuid": "fc49871f-8405-4c9d-85dd-c240d8456fce", "value": "REMINDER-PURCHSE _\ub124\ud30cFW23-\uc5442023.8\uc6d4 \uc120\uc801\ubd84-\uc11c\uc6b8\uccad\uad6c\ubd84 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1146448c-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981254, "uuid": "7dba9623-61a4-4bf7-b7ee-5ce64808840b", "comment": "Malware payload", "value": "0d187f3d6d91ad926d2c8d3edb3bc4cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981254, "uuid": "a4316268-8fa4-4d6d-974a-72034fed043f", "comment": "Malware payload", "value": "8fbdb64bc4ebe0fe9911171255be12cff7e522a78a1e80e7166b5f3e7a7e523a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981254, "uuid": "62821209-c592-498f-8cc7-bc82611998cf", "comment": "Malware payload", "value": "75b10b39fc2c6ec29536ff537ff3c09533013681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981254, "uuid": "751ec822-b75a-47d2-9c25-b5a11b163f3f", "comment": "Malware payload", "value": "e0fe294d673c32becefbd857a22137f193b5082c8bcf5581a1a2b9bd3880a210e6c127d6e9a03618563a123d256bf80f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981254, "uuid": "e6a686de-2d42-4cdd-a178-bf578bcc4996", "value": "T1ACB30703F4E4D019C65586F05879C968382A3E320194EE4736C47E9A36BE953B9FBB1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981254, "uuid": "11bebeba-c641-45a0-b48b-888905aed528", "value": "1536:KxIssfaL9XtDpfm/omCaRfoFA8WgsERGGbJ:lssSdtacJUCGGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981254, "uuid": "87a2c3d3-8f2f-46b6-8b46-ba77787eb348", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981254, "uuid": "437ae1f2-45a1-43ee-b9d9-98d2ce0e358c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981254, "uuid": "33830f6a-0ac5-4ce7-ae8f-0b1f4c347d2b", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.892.19192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bc22f4-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698997076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997076, "uuid": "bbaa4bd8-69d4-4fbc-9dbf-914fa7b9fe90", "comment": "Malware payload (Formbook)", "value": "92b736a88accca357f968824f1bcaa3d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997076, "uuid": "2b2afe1f-1cef-47e8-b10f-3abce272d16d", "comment": "Malware payload (Formbook)", "value": "8fbf18c6b0792a4c200d2f2a99ed5efbf20131441ecd0ae548c0225ced8fe0d2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997076, "uuid": "cff53371-8f68-4fba-839b-d903cf4c191c", "comment": "Malware payload (Formbook)", "value": "eeeea3230ca7dea9a4adb11d460f374b70d166ed", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997076, "uuid": "9edf3db3-ee69-4390-a183-2172dbf46a5b", "comment": "Malware payload (Formbook)", "value": "53cc74f94cb2134827b487154ad4b0203518e8ab86d1ebdf92e058abe206b10d8122a5d0d4f7dea7d875f10f5906346c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997076, "uuid": "8aba2a49-84e0-45ab-8a56-ebfe857f6c13", "value": "T1FE34346CD38B0269CF66133A9B271E4482BDBB2EF34451B5346C837533EAC2D91265BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997076, "uuid": "1939899b-8968-408c-bc1e-c38f8ddf91b8", "value": "768:+wAbZSibMX9gRWje388n09sD8Vqvq5Yd7siTtq6l7j:+wAlRXM2ND8Vqi6Nskq6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997076, "uuid": "3e1a23be-548a-4733-bff5-845232ceabdf", "value": 231001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997076, "uuid": "b2b2b49a-34a7-4200-b06a-74beb22764f5", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997076, "uuid": "783f380a-359b-40f5-85c3-f79324208640", "value": "PO No 6900063461.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e55379-79fb-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698983140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983140, "uuid": "f3b1abc2-5fe5-4347-9435-5819100e661b", "comment": "Malware payload (Mirai)", "value": "f5727685f7d0a4728f94b8f47d11a90a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983140, "uuid": "90b2ed24-c5df-413d-8fc3-344839ed116e", "comment": "Malware payload (Mirai)", "value": "8fc5cfebdb403ad78b79b0e0805f3ca36394ea8bc23190722b4382f713f4c819", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983140, "uuid": "f5f63551-42b0-4d5e-8e8e-7f90397506ed", "comment": "Malware payload (Mirai)", "value": "b648cdaa4d91b4a9db83f697a613086eaac8e4f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983140, "uuid": "4d805f87-1eba-4d07-8f12-08feec8c3280", "comment": "Malware payload (Mirai)", "value": "b6e87a21466a197436bf5f8793558ee6584c2bd242a47ab5731cdc505ce473d5760d32115f3020c628b8e29dffba75b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983140, "uuid": "f140e184-0e7c-41a0-af56-234bf86262f6", "value": "T12FD33C46FA418A13C4D5177ABADF42893323A764D3EB3306D9185FB43F86A6F0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983140, "uuid": "32bc84ef-895d-4d9f-97ec-e64f2b3b2552", "value": "3072:eF6lvxDDVOyTrrOiC/qlQBcq3DZYcyWEwUnB7TxM/92:tlvxvVOyXrGilQBcq3DScinBRM/92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698983140, "uuid": "3c76ff6c-5ca9-4b1d-ab95-9d43a47b45cc", "value": 137241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698983140, "uuid": "09a7635e-f7b7-458e-ad34-71b90e136f6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983140, "uuid": "5f9e4520-8dce-4ad9-b390-9620789273e0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c11d27c-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998023, "uuid": "02a21d54-d282-4747-8319-6abf4a888247", "comment": "Malware payload (Formbook)", "value": "293083bbad8bf472653b7cd3845555cc", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998023, "uuid": "f302d833-fa0f-463a-95d4-031889f83074", "comment": "Malware payload (Formbook)", "value": "900d518389fffe99ee1fd546a9af47aeb109b0d8500139fdb3155d6916afd810", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998023, "uuid": "854c6032-f324-4156-b781-4b258827b1a0", "comment": "Malware payload (Formbook)", "value": "d1f456384b890c7412c0a1bf7bbc9d9c8cf19e21", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998023, "uuid": "022d8e90-3ca2-4169-a889-599c330fee94", "comment": "Malware payload (Formbook)", "value": "3d4862d09e0328181ed636d5a6bb2cfe103a02528e4f3246a18ca745637063d1886408a57919db44c471af5a35121892", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998023, "uuid": "67f06552-2ba8-4630-b9da-8e65f6e5312b", "value": "T19AB4DFCEE31198E4EC266271687EDE77576B5C6E2844698A26C77E333C31193303689F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998023, "uuid": "757d017b-fec1-4146-9eba-701b218c5988", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998023, "uuid": "4cc69021-1bc4-4e14-a5e1-8e6e78ffa29a", "value": "12288:PrcoMcj0XtakKbz5Jochi9FpBqC2EJ65t3NNOuUqJZt6:aD9BKH5JocmHcC2EQ5t3a7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998023, "uuid": "8a99eaaf-6b70-4a8a-9839-e42cd2538ba6", "value": 508215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998023, "uuid": "2fbcfe05-e474-4c2e-b8ef-54d6c0595b5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998023, "uuid": "14300816-7327-457f-ba83-bab6380c7114", "value": "DHL_Original_Shipping_Documents_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e529de-7a1f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998439, "uuid": "c32e60f3-f116-4553-80e7-70577cf8d8df", "comment": "Malware payload (Formbook)", "value": "dbf6290a68a1a95743d3b86fd2365e58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998439, "uuid": "4ce8a7cb-8413-4776-af39-aa1fd99522a1", "comment": "Malware payload (Formbook)", "value": "9068c088065cbfd77cba76db460b52833c7ffb261e7da8ac9de4269cad2d81b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998439, "uuid": "fd315443-d0be-4379-b3d1-b693655f7171", "comment": "Malware payload (Formbook)", "value": "851a76fa59610ea8c5d93eb76954499f0a9c2c22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998439, "uuid": "3060320f-5ff4-476c-af00-d5b788f6d75f", "comment": "Malware payload (Formbook)", "value": "2e52cfa8d65ce1374b993f720c9e835a436af2b7e9f2e133db8d69ef1e288b68f9fc8641b1e9f926dc248b5210c60682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998439, "uuid": "114064e3-9b77-4c3e-82a5-b2069b368110", "value": "T103D4239876B8CE5BC7BA06FC943136401BF126533811E6CA0DF679E86CEEFC51A90587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998439, "uuid": "6b4e1d34-6ed7-452f-a8c6-2be84ab03ef0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998439, "uuid": "fa60bd03-6117-45f5-a00d-361ef1f9368d", "value": "12288:SlIkm5eVmQeLbQae/bmWC2dJIEafx99nRbh7iep8/F4W2FLyyD:aIkm5mu2nXcE2x7BhHpF9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998439, "uuid": "28e490f9-70d3-4832-a72d-72566f092a5e", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998439, "uuid": "48308a9d-778e-4b31-a69b-f207dce6f016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998439, "uuid": "b21c2fb6-ce84-4c22-8f5a-0399046dd6fd", "value": "PO confirmed Zenith Marinetech - KRITI CORAL-CRL5133- CRL5133-Z01-23102605-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ed3b0f-7a9f-11ee-8907-42010a9c0042", "comment": "Malware payload (Nitol)", "timestamp": 1699053604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053604, "uuid": "2fbc2880-d69c-4cb7-b81d-2d6ece128e2b", "comment": "Malware payload (Nitol)", "value": "82eae0084a91983e3730b537982b0d82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053604, "uuid": "c6e5c228-e438-46e5-a61f-e3591e9894f1", "comment": "Malware payload (Nitol)", "value": "9080cc2e284d68e776957ad12e86455458ead9ba34d8afebe7ee2cc5a7514c05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053604, "uuid": "6e0e23bc-b1c6-4901-a7c9-969ce04785a1", "comment": "Malware payload (Nitol)", "value": "8dc1e8c5957bd1089036b5c0f5b6ba7ebe227354", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053604, "uuid": "b9ccdd85-d623-4011-9066-bbd3c48f1fd2", "comment": "Malware payload (Nitol)", "value": "86fd249658a1bdacfd1814acf42833a20dd1784b1830c2bfbabed1a7e2df862ef163f810d942f7eb7d52d78dd3111f32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053604, "uuid": "4c803625-44f4-4afe-aa87-8bafe755d79f", "value": "T18F736C217691C1B6C44964319816D7B25B7E79305BF8D9C3BF590B7E4F223C0AA3A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053604, "uuid": "64e91c51-3b98-4e51-b90a-8a523d101a28", "value": "f61b3498a024e1606e5633ff05e57b42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053604, "uuid": "e95ebec3-a261-40a6-84c4-d95f70a63fcf", "value": "1536:awsdCFnE4Nz1/SXPtpoprAeDYxUfGYhK5O:awsAik1a4pGYhK5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699053604, "uuid": "b14501ed-5026-41a2-975f-8010259430de", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699053604, "uuid": "5191db8e-8b2f-49fc-a440-47a088029de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053604, "uuid": "e746ddd7-2912-45d9-b454-13d9d1822d5e", "value": "82eae0084a91983e3730b537982b0d82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad22755d-7a18-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698995689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995689, "uuid": "9125812d-f2c4-416c-abd7-a31c0c5667ca", "comment": "Malware payload (Loki)", "value": "a98be8ba1244be72242fc31f11e4208b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995689, "uuid": "3d2d0a18-f491-4c69-8c99-67d85abc4ca4", "comment": "Malware payload (Loki)", "value": "9092e21af255af1c646d7c2e9cd9d1a679e990070b56e6f936a265ac65a56ba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995689, "uuid": "d9cfc674-8e8c-46ea-963f-d91751f4ef3d", "comment": "Malware payload (Loki)", "value": "b1305706b2ff0124d7b9a177eb2ccc714e030731", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995689, "uuid": "38508d3b-aac8-4443-93a1-c39cfce58240", "comment": "Malware payload (Loki)", "value": "e9f545962ec9470f5ee3a194b1413d08592915103d9db3f9d2b4e251f94ec4e6464eab221a18f54f7693a2ee37cad71c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995689, "uuid": "ea007267-234d-4da3-994c-96b899237299", "value": "T195A42361B3A8CF22C07953F4840567409BFC3A435526E9BE4CD970CF9987F458BA79A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995689, "uuid": "b5346259-b5f4-4ed3-875c-c62fc6bd3619", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995689, "uuid": "56b43876-8680-43ee-b084-1cdd97b0db95", "value": "6144:4cxmNT52+a6EXfBDnx3yQE88cb61jrMBPVKDGBc7rPuCmF7CgUfCX/VMIa+txP1n:4IkxEXdt2qb6xOdorPuCmlmCXU66b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698995689, "uuid": "eefe079d-0240-4fd5-962e-652364b6d0ed", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698995689, "uuid": "b39cb4fe-9d4d-4d96-af9b-3202b9b820ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995689, "uuid": "5b7437bc-7de4-4817-a233-8de84b0c1db8", "value": "SecuriteInfo.com.Trojan.Inject4.59820.4771.18903", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3e6f04-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996817, "uuid": "05ee7220-8cea-4b0c-8501-69e3ac1a4928", "comment": "Malware payload (GuLoader)", "value": "fa2f4926356f8bf6319365ac998e49a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996817, "uuid": "1da5ec61-c70a-4fcc-a491-91399d20eb49", "comment": "Malware payload (GuLoader)", "value": "912c5fc8f179cd1ff71efbb7cdca171c913204033d382edff57fb3ab53f6a8a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996817, "uuid": "64779622-9551-4380-96fb-9e7b5d9949d6", "comment": "Malware payload (GuLoader)", "value": "b853b0d7773304ca533ec6ab2d16ea64f62bae2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996817, "uuid": "b6f2cfdb-cafd-4726-8ea4-e990826efca3", "comment": "Malware payload (GuLoader)", "value": "2a17e4f734407718dd31972d662fc1322ffd398f5f34d133f8d97dd5a1ded119a026d9f58c02787d8e9c80d260cd4e33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996817, "uuid": "335f68ea-64aa-4dad-8920-8b2f20089ef9", "value": "T1698512B21B3441BFE0365A78B417F66BF1816CA687DE1285EE87FA5D0F73C0A914181E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996817, "uuid": "4672b4d7-edc0-4caa-9060-738651254618", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996817, "uuid": "b06b82e4-b107-4550-a89c-4d7fa1cc01dd", "value": "49152:r0ER8cGD1XnSUCfqzdweNhWf2/Lc3fk62miin0lN3:r0EUzCAdvWu7cnu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996817, "uuid": "9aabe3f0-390d-46a2-a3c9-46e33e69ad84", "value": 1838366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996817, "uuid": "82d19dfe-62e5-447b-8024-8f5217bba520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996817, "uuid": "3ccbfb61-5795-455a-9deb-8e85dfdb797d", "value": "IN09867890009889.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15307905-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981261, "uuid": "3a50ce97-7160-4ba4-a39b-289e162db03a", "comment": "Malware payload", "value": "b34c96dd8104343ec0d6143acafc137e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981261, "uuid": "1c85988c-a92b-4783-a110-92fee2d32c22", "comment": "Malware payload", "value": "91a3e3b13da8b678cd05007b6b614a09c1f345690c74c1f218d65c5a53a71ca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981261, "uuid": "18719aaa-db23-4af4-8c37-d5cdd9846709", "comment": "Malware payload", "value": "db5b72c0e43b47d899b44681d5eae80cec22d0eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981261, "uuid": "9cdfce63-59de-46a8-b4f0-0182e909e1dd", "comment": "Malware payload", "value": "4614639b145b9eecb185d5ad285c15a5909bfc82cb93ec7e554278ce6678085394eee7bb0336e7e6dc7ff1333d0fca98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981261, "uuid": "e10e2f4c-1e96-4fe4-a857-b3b2ed3305d1", "value": "T10072AB4BDF9878E1C845F2FF326507696AF0C2813DA95873A7315E78BC21C156A13E8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981261, "uuid": "c02267dc-68d7-41af-b872-4e5029f6aa60", "value": "bc594123d434400de640bb69320aa230", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981261, "uuid": "6fc4498b-3daa-432a-bb3b-1d692f48cb15", "value": "192:p/3pmSYkHZWLktS0WazZif8R2WesDKDj/a3hi1n5Vm:d5mS9/1ScDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981261, "uuid": "278599a7-0c18-4eba-a3e0-cbd4cee11afc", "value": 16000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981261, "uuid": "5297c3c1-799a-4ef5-bad0-fdd8ad51f455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981261, "uuid": "01c450d0-4d17-479c-a8b1-f74e380bb9d0", "value": "SecuriteInfo.com.Trojan.NtRootKit.18190.27575.14406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be082731-7a42-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699013756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013756, "uuid": "eab99c25-f9a5-4bb2-8d36-21c706dbd381", "comment": "Malware payload (IRATA)", "value": "368a77cb2c6cd3c7e8d7dc237c153e01", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013756, "uuid": "98e22ab9-1702-4eca-8327-f959e337c66e", "comment": "Malware payload (IRATA)", "value": "91e511789491fe4ee95b7cf3eb6a0017fda9a90d0421efc2055c97052473e1d6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013756, "uuid": "9b0830d1-8e61-4369-9f28-659ca8a3d1b9", "comment": "Malware payload (IRATA)", "value": "6d52c331ec8e44960e67a9a798de24f0b79cb068", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013756, "uuid": "7aef26cd-974a-4381-bbab-b0aeeb9bab8a", "comment": "Malware payload (IRATA)", "value": "020487f81aef5de618042da52638b70483ed25c15766ef5d497a380c88318239e6dd7ea124eae59bb714ff795013a552", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013756, "uuid": "68039918-f483-4ad4-a88c-2971c4844699", "value": "T1B426E0D7F7E8592FC877907288AE52A1524B4D068E83AF477D48371C287B6D81F49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013756, "uuid": "e263eb87-f361-4406-89b8-cedb4b82f581", "value": "98304:obyZQz7jM0NzrLjw1ghONSeu45gLCrgsM:dQFNzrLj1P8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699013756, "uuid": "3228866a-02d2-4a3c-a7b0-9f3b342ff6db", "value": 4720214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699013756, "uuid": "f99d8bf6-5e34-48b1-87e8-d62fff9ae083", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013756, "uuid": "67f92199-287f-492e-a742-6d5d76369a3d", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6cbdc3-7a95-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699049243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049243, "uuid": "0e688c06-8bbe-4ea0-b75a-95dcfe0f3787", "comment": "Malware payload", "value": "f2d071e43dfaef224f412637a1c975cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049243, "uuid": "b5c6e767-b2ad-4006-884d-b2371861f3eb", "comment": "Malware payload", "value": "9249d2dda394e98e3cb4d1a43a4fe96c88e8f5744371d2b7c1e1f37d784f21c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049243, "uuid": "1752ce95-ee0b-43e8-ad7f-f028ce625459", "comment": "Malware payload", "value": "b844300a17334a3435c3d092466e9d2730a0568a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049243, "uuid": "ac9baa51-e2fe-40f9-b4ff-fdfee325dc35", "comment": "Malware payload", "value": "3cb6b1ded90e195e01982b0cb0cc1f598d69f9850113bb1c6d6cb1c71553b0c4a36560fd6c528e0c823aebda0d9f9e98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049243, "uuid": "71879bec-dada-4c0e-8159-7238aba4ee01", "value": "T100D3ADE1A740C465D8AB96B9983BDAA76433A20EDC68490D3CD1FF0B7D73347402799B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049243, "uuid": "82a1d7ff-2996-43e0-8fb2-aecbf771c26d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049243, "uuid": "19a7f004-a1f4-4a93-be51-a0e38971bc8a", "value": "3072:dHF29RQOjwM+lmsolAIrRuw+mqv9j1MWLQI:dl29/+lDAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699049243, "uuid": "4a40d5c6-cda1-4efa-84f6-44d13a613447", "value": 131584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699049243, "uuid": "b0919b68-38c9-4b3a-872d-1fbd846d8992", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049243, "uuid": "94cf8d67-fcb2-42bf-b5d2-47cbf81de82d", "value": "bRjZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46decd6-7a52-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699020693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020693, "uuid": "be683bdd-6c8d-4b6f-9060-33889f40274b", "comment": "Malware payload (IRATA)", "value": "f48f4fe1fd86912c46587acd1c1cf02a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020693, "uuid": "fdca417c-0357-47f8-b069-e456c70b5a74", "comment": "Malware payload (IRATA)", "value": "93176edb58ad0e8f9b7a4611724d54abefb47df2605b64f0c334554c97c1e169", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020693, "uuid": "59173166-6eea-4b20-8839-59cee529f12f", "comment": "Malware payload (IRATA)", "value": "21280e8c73d0098a76452970796844e690e018a2", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020693, "uuid": "a772fb17-046c-4db0-9d51-b1b2d9d41f65", "comment": "Malware payload (IRATA)", "value": "9c1a3873e9bfa7c58e294e0e29be022799756c2c56d81eab2c35b4abc07a3ccaa8a0a872706b13b9cacb3414e56359c1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020693, "uuid": "7d05bd08-1c55-4ffd-a968-02f54cb685fe", "value": "T1CA851253F369AC67C8F2C33221B4193516775D25CB43E74A3948B7BA68BBCE84B806D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020693, "uuid": "24583e10-c84f-4b28-b172-67a92c884a1b", "value": "49152:qsgkkU0XYyqrOai34nX87OsurohGQ/P4HZMIng:kkkDXZSi3S8720NnG5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699020693, "uuid": "7c1f4000-e82f-4be1-aa4e-71f3ca0ee654", "value": 1772563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699020693, "uuid": "8c4c0788-edc5-4112-a0b1-a0f3d8d6ed02", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020693, "uuid": "57a5a57e-ea93-4553-918b-55b1558f35cc", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a07540-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699054677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054677, "uuid": "7596af4f-3ac0-46ab-8d4e-bdd30ada3c4d", "comment": "Malware payload (Mirai)", "value": "7692b9ae5b6613cdcb07d8db11bc2aa7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054677, "uuid": "0fa89f6c-6f65-493a-bfbc-696688182090", "comment": "Malware payload (Mirai)", "value": "93d2a5781384c8666ca37f2651466ae7410d287c9859cb1760bd6a03925f55e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054677, "uuid": "3dc56d79-382a-4584-9247-09f7fb1cd691", "comment": "Malware payload (Mirai)", "value": "b61e95026b0000f93ece0a9514f534a04910b2e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054677, "uuid": "2006cc45-2d6f-43eb-8882-d130d769ac91", "comment": "Malware payload (Mirai)", "value": "0b3f262659f28ac1b56ffaca5a9920d7e47aaec52f0adea2525cf9192e33b4b6832f6e584571b5b638993129823c0071", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054677, "uuid": "07dda6c1-30de-48c9-90da-785f6b13c025", "value": "T1D3242A627A3A1B22C4F1647950EB9B5AB2FA4BCD1554C24F3EB20D4EBF549703143AF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054677, "uuid": "cfe6638a-a80b-4681-9c54-f2e57d4006e3", "value": "1536:BW/BskZoqKZTeSZWVGqGAsZdno8C4JKomIkQiXmw0qgJEZyT7r:B+uKGq4e6mIbgAqNyT7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054677, "uuid": "b30cf360-7a9c-43f3-9cea-c97755379c3d", "value": 213628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054677, "uuid": "cf5e77d7-c3b0-44e6-b380-a88172c91244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054677, "uuid": "0d678610-7fe9-4b1c-bfce-6d8645f55f5d", "value": "7692b9ae5b6613cdcb07d8db11bc2aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e50ae6-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981262, "uuid": "1c14cbc3-2876-441e-9d61-8958c7d06e1f", "comment": "Malware payload", "value": "f1b8cb1c7baec0e7b6cf92ca82abb73e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981262, "uuid": "900c23f3-8a65-45bd-8690-917738141057", "comment": "Malware payload", "value": "941682e8ce6e4f12eb73c6974dbc455957cf4149961db910bced6d0cae63a817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981262, "uuid": "bb760115-850b-4f6b-9753-b29bb3ad5ba3", "comment": "Malware payload", "value": "8ac2e6d7c149725e2194d0650d6da4da39718e37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981262, "uuid": "0571b7eb-fdea-4231-af79-01a874dcc4f0", "comment": "Malware payload", "value": "e835e457cdb1a7ce6ad0d3e8d0280a342a205ca45def71b89e3e6e2bcb0384e904536da1522267040fcad35b1d0c8c02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981262, "uuid": "b4f476aa-2f36-487b-810a-006cdd1d7be1", "value": "T1C435E03CF543C523C31A1E3024CA5DA8ED627E61CA29875B7395174EA8323F5BD3266E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981262, "uuid": "e1f4d18b-8f85-4bfb-bad5-f13b50c44100", "value": "5ab56872521611d9fdd54cb287df0f4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981262, "uuid": "47c282aa-a77a-4c7e-9ecf-4384f6903e66", "value": "12288:/GcxwD7JnwkcPETQoHl42+EzoLRRtFcA71HTFmlHYus1KLJp19iL0z1nbETM2a0S:/9Q7JwkdQycGAvPKL31J1bT2a0W1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981262, "uuid": "c13580b0-39d5-4d2e-a427-31042f6d4c3c", "value": 1149434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981262, "uuid": "a5f501df-2781-497c-9413-1e662d3e7188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981262, "uuid": "99704ca2-7fcd-4e09-852f-814cbbc511fb", "value": "SecuriteInfo.com.W32.SfEngine.A.tr.23341.16987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03bf65b5-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698997982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997982, "uuid": "de32688f-079c-4191-9587-fa3099ce7161", "comment": "Malware payload", "value": "2406dd984c43068c1f71ed27dac0b6b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997982, "uuid": "ca929df6-e918-4886-b674-a372684f9a43", "comment": "Malware payload", "value": "95da081ece85c3eeb776c39d6afe404e45b2214e8e8762cc970be0fd791b1962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997982, "uuid": "d67c8702-b7fa-4154-a73f-1454f88c7266", "comment": "Malware payload", "value": "57c1ec966a5700e50e9abd118f6b166b090053c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997982, "uuid": "6e3a04fc-b01d-4bbf-a343-6af4e7201da8", "comment": "Malware payload", "value": "bc7317393163ded5a45ddc17bfa1e4593416a3dcae1f6d0cab23d9fb78861c567d82ea95547a44eaa72c2d6d143efb87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997982, "uuid": "eeea3bdc-3c48-43b7-880d-eb0f33df4c00", "value": "T14BE42356C5EC8BBFF1D015361C352991D275A066AB314FDF2FB08B1A4B62BC8F423961", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997982, "uuid": "574b3302-b51f-46fd-8215-996ef9874c2c", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997982, "uuid": "c3250f4d-075e-4c99-8d88-93d44d19a009", "value": "12288:xPZo75xgD2oxaj0HQCNUSPf3DbeaLEFHJ2la5JhAM732NDrAqx9sp:xPSLEejLQpLQp95JqNXLxSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997982, "uuid": "03632017-7157-4d33-9ccd-3fcc91669ad7", "value": 697468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997982, "uuid": "fd6aa706-e120-40d6-86fb-dc6a1707265b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997982, "uuid": "c5827a7a-6ae3-452f-8f59-7cf19ca81f53", "value": "SWIFT COPY HSBC BANK-97471.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dcfefd-79fb-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698983133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983133, "uuid": "0f3bd746-c627-45a7-990d-8851a0d0e70e", "comment": "Malware payload (Mirai)", "value": "df70980cb1a0c5f6aa0b0ea95c2285a7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983133, "uuid": "4389c997-53be-4b42-9f07-67e682b2688a", "comment": "Malware payload (Mirai)", "value": "9612df8b83bcd1a8bc3d5deddd3f2eca968f4338d31ab33ac3508967ae5f89f9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983133, "uuid": "ce7d8fb6-edc1-4ff8-8244-9ff6c867730b", "comment": "Malware payload (Mirai)", "value": "4fb32f0294d368c8923fa61953cb23be68fbd1da", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698983133, "uuid": "630594a3-c0df-419a-84e6-934a09743abe", "comment": "Malware payload (Mirai)", "value": "8d97f0ce0d519d15ae0dbc2720e54264fa555d2afe16d212ff869e1735158f36da1ec30c419100b327deddf15e8c8daa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983133, "uuid": "1a517027-88be-4822-8da5-f3f65179a5f9", "value": "T16353F986BC81CA53C5D462BBFA5E42CC332163E8D2DF7217DE156F153B8A82B0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983133, "uuid": "526e5f6e-1187-46bf-9744-395d8c84c86c", "value": "1536:kdxx3gHzhoFnS8f8iuYws5Ce9KIWw8PlR:kxx3gTkNw+79pWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698983133, "uuid": "65e1a42f-b2c0-4b3c-a433-f86cc5394c93", "value": 63240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698983133, "uuid": "b734814c-af7f-4d3b-813a-1ec5d5a7233e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698983133, "uuid": "c290fadb-1cec-4978-854d-cec54b91cbd2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb2e185-7a47-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699016009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016009, "uuid": "107cb99f-8269-4160-96e2-8a10f1bd7c19", "comment": "Malware payload (RedLineStealer)", "value": "e669a2bec2c6f03ee96d5b4bec50201b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016009, "uuid": "282209e4-cb2f-4666-90ad-0609f77baba1", "comment": "Malware payload (RedLineStealer)", "value": "96de5e324221f251b758e0d61158231ec909f1f797f9e1eed79e90845d1ecbb3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016009, "uuid": "f1c00bb0-510b-4e8c-bcfd-81267b79bf92", "comment": "Malware payload (RedLineStealer)", "value": "cebee37aee1aff766e3d38a5479b3751a293634d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016009, "uuid": "2fc5dfcb-3d04-4685-8b01-0c07e0510105", "comment": "Malware payload (RedLineStealer)", "value": "fd7a7340c722be8c933f7707776b67928a05970f0bc465542e234c98386fd559e924f119bc1bf64bfc7dc89f49f792f3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016009, "uuid": "1f8268ed-82d8-42c5-8dbb-aa7d7e8149b4", "value": "T1F2F629C7F89611E4C1ADD37089269253BA713C891B2027E76B50FEB42F32BD4AE79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016009, "uuid": "73a54acf-17b4-44de-98ce-200ac4c3eff2", "value": "85cddd6092e65c1a58dd1e6e9ab9fc63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016009, "uuid": "f4d38437-fba1-4808-9670-5578d533e893", "value": "98304:L8M7k5ALRihfyMWwJZ9ECIis9jghbyE88YTVKoD7x+pnZbDF:YNsbw/s9jGf88YTVKpZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699016009, "uuid": "b0071f74-4120-4468-aa79-79b01c90c4c4", "value": 16068609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699016009, "uuid": "325a9043-70f9-4431-8078-57fa4bc2e1e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016009, "uuid": "b0b63e78-1cba-4c67-8f82-f5fdaf1206f2", "value": "e669a2bec2c6f03ee96d5b4bec50201b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242799a9-7a98-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1699050435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699050435, "uuid": "b5162d92-fea0-4981-9ab2-d552af15531c", "comment": "Malware payload (Pikabot)", "value": "06079d5a0b265ccc9c4c874c4b8c36f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699050435, "uuid": "cabf7ec6-509c-4a40-b166-0ee160860012", "comment": "Malware payload (Pikabot)", "value": "96de70ca69f2455e96cefdfc80d1b033fa9d6be71c18df9b5e6c417e04456ac3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699050435, "uuid": "644f08c7-f0dc-45b8-a5ae-a0a8a78b1aab", "comment": "Malware payload (Pikabot)", "value": "a85bdb5414f755fdfcf1fa5089a0460f6a75c5e8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699050435, "uuid": "bcb05df1-bdc9-4a0a-8abb-e4452c492f3e", "comment": "Malware payload (Pikabot)", "value": "eb648b0d1d61deae2a906562633a43f7ac1c99befdc6a278150b84f3c59af1a1e7522ba161e3ee79fd209aa7081c7804", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699050435, "uuid": "ffd14772-e57d-429c-8b12-8fd854b89daf", "value": "T1CD85C0267180CD3BC4BE0A7C8F5AB2A986157DD51D3C860A7AD44F4C2F79AC93B36352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699050435, "uuid": "874a8a1e-86f9-48b9-a1c2-79218639dff1", "value": "6a2b16a076db62f1960b98ea90331275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699050435, "uuid": "44a62429-32e0-4550-9c29-fb447f321aa4", "value": "24576:uqLGX0RC9gyFTrowba5QynnHv0SQxhEGFEwV0qsqDrFciMnNa72:qkQgyuiUHvhQ7EGFlV5sDtNY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699050435, "uuid": "88e230c9-032f-4c61-af20-a3b6acebae79", "value": 1741096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699050435, "uuid": "aae1a934-fa88-4bfe-968e-a77a6d60ee4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699050435, "uuid": "a01087c2-6b16-4fd0-a4be-c5478afed98e", "value": "cadmiumsY.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73c94bb-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699054977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054977, "uuid": "871082b2-48d0-4190-8b85-10f3600009a7", "comment": "Malware payload (Mirai)", "value": "3dcbad8cf15ef009d9358b681339e467", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054977, "uuid": "53f169f3-f87d-477a-82f5-66bb97ed2e60", "comment": "Malware payload (Mirai)", "value": "97912a3cf6405737a2b9aa4415df7a471bc9aa4e341df6ee28d9af2268d39f28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054977, "uuid": "d3cb5757-ebb2-4ef5-863e-37be014d4400", "comment": "Malware payload (Mirai)", "value": "af19fca0d542fd5563971212b41b182e17aface9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054977, "uuid": "ac60e88f-cff7-4b32-b852-af06efef0074", "comment": "Malware payload (Mirai)", "value": "a4e385064d173b7eb477be784e42a32ae021f93b2009625913a6c332aad4d9f4e0a1b9a5653cbd8dafb3d32402bf6552", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054977, "uuid": "d8b17a00-1775-47ee-9435-b5955449eebb", "value": "T13B83AE76C1B86C90D1504B34B7A8C9B48B57B900629BBFF5C2828B551807AFCF64E7F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054977, "uuid": "9010ada1-5924-4751-9097-693ee09a16d8", "value": "1536:C/YDXIYa6HSxHT4WANh6yOKXzy+jYVNWFmCjAa10dc:CADXDxSN4/h6yvX9jYVNWFmYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054977, "uuid": "78841d26-90fb-4fb4-9c0f-f4b1e3429182", "value": 82936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054977, "uuid": "b4bc16ca-aca3-4733-8f29-4905654c5d6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054977, "uuid": "69098706-1fc5-4905-b144-a9a85d3fe61f", "value": "3dcbad8cf15ef009d9358b681339e467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6645268f-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699032937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032937, "uuid": "b2832ea7-f69e-4b8f-b826-9182d73f9c1e", "comment": "Malware payload (RedLineStealer)", "value": "d9e4a900584245e71d76f2854874119d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032937, "uuid": "1ae68140-d260-472c-b8d2-507975a30cd3", "comment": "Malware payload (RedLineStealer)", "value": "986cf82442e6119a730aed56d26da89686d3b56ddf35701ef2f627a59edb0185", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032937, "uuid": "ea5449d1-9a30-46f7-9c86-d7ed15467f28", "comment": "Malware payload (RedLineStealer)", "value": "93955bb260221b0510484df8cfaacfc0c99b685e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032937, "uuid": "4c517a3f-db56-4ace-944f-72e7ffe358e6", "comment": "Malware payload (RedLineStealer)", "value": "56cc1c34ef1b4d0eccc39d97ab2552ac58f29571189239b6d012c41df78bbd979357e975b2cd4e7058be16cd9c7b1b9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032937, "uuid": "339e7b21-aa1a-46c2-b16d-fef34170626e", "value": "T12985FA1176F95B59F5F30BB85ABAA612087ABC6ADF11C2DF1251908E0C31BD08971F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032937, "uuid": "755a3bec-03ea-4136-ac0f-832a30057ee0", "value": "d47242ec56e1a1639468f1233564ee05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032937, "uuid": "5e7bc9b4-75cb-442d-91e8-282c3aa24d3e", "value": "24576:RnIN0rGPjHIsS8nVwxV+pEH6a9Dhvhr9z7gzR:RGjHIsS8m++H6a3vnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032937, "uuid": "0bd19fef-50eb-4f38-a9f6-29b331f02e3f", "value": 1743624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032937, "uuid": "c331d0ac-1446-41b3-93e3-7f965363d148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032937, "uuid": "216dc330-e7a6-422d-8a96-aa73253724d8", "value": "d9e4a900584245e71d76f2854874119d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a408b2-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998094, "uuid": "1beb4685-f89d-4606-a151-b93a066a1f0b", "comment": "Malware payload", "value": "7d424129616c30813f09acfbb7c27209", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998094, "uuid": "f5728d1c-d549-42c7-a723-638377380853", "comment": "Malware payload", "value": "98855ea1e4f6a26872f3b4796800d772433d906ddac37e9d55b3973b50b3654e", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998094, "uuid": "5705dad1-4b67-4b72-a986-ae856b5f244e", "comment": "Malware payload", "value": "67cd6ca5baba1fe7a2f6d7baac09fa452e3ac7c7", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998094, "uuid": "7ffc33ec-846e-430b-a6d8-d622e2142087", "comment": "Malware payload", "value": "4eff973409c7ad97d06b32cbd300e6448c0c605e9b98a9e3e6fe10b3e6ac931cf8e7fe9c31b00bbd40af8646099f8499", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998094, "uuid": "3dc5362d-062e-4455-9fea-83097140d314", "value": "T17E13E02CFF898A34DA5B9074981FB492A1B69D515281DF470F2CE36A148BCD0133BDAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998094, "uuid": "92191f2a-e483-4159-b3c2-53c7f864333a", "value": "768:gHvDoOvassnfSmBIJYfTH+niSpGvDHrtv+nWhFFiKk/fnqt5FrBR1+nQHCu:EvPvaTKmG1B2Trtv+WFFi3/vq/tB+QHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998094, "uuid": "c40cda40-6473-4393-a710-44239d169437", "value": 43210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998094, "uuid": "9b99a4e9-cccc-4377-9f25-2b2dc80e0f75", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998094, "uuid": "b3fcb544-fd08-4d18-bf36-5e0f24035e75", "value": "1054696.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa40cfca-7a5a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699024165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699024165, "uuid": "60b7445b-1eba-499a-8bd2-2b10240b725a", "comment": "Malware payload", "value": "ef20fe4e74fb23a1b30e6b882f020891", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699024165, "uuid": "8f9a5163-56db-4c49-bf77-b3d2f537c079", "comment": "Malware payload", "value": "9b5351a80a813a08edba234f32312277240bea3f28262781d48f24414cb5342a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699024165, "uuid": "9af33a17-7f1a-4e57-8aa3-f179d9f4a4bd", "comment": "Malware payload", "value": "bf69f0488c7055765a4bfab74c2e7b43c3c4be98", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699024165, "uuid": "e6f1566f-7fb1-4bc9-92a7-1b31a46e1046", "comment": "Malware payload", "value": "52b4a95e239487ed31e92c57e891c4eccbe6eac019d62763aa5421fde5f8c90b6ec058fe042f96513b3fd7395261bbeb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699024165, "uuid": "66e8ff52-f88e-4409-997f-ef460f8407fe", "value": "T132C6235135CBC1B5DDDD05345A1BBBDB13B25F7847A0806B6BC029CE69B2FA090BAC93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699024165, "uuid": "88886e64-cab9-4dc5-8843-695217d54aef", "value": "196608:Q+Q4B1JXslcMeRnJMI3CqfykRdynNhYgIW9yjNqWGGUJbvFnbTTkxT27dxN:Q+BB1JbN9yqPynnYgRWydnHY27dL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699024165, "uuid": "6cf04675-bfbe-4a15-b308-899f6bf7295a", "value": 12316672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699024165, "uuid": "d308f34d-8cb9-4194-b719-f6c7ee291c01", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699024165, "uuid": "c2f4dbcd-1946-4a8b-852a-a050967fa99e", "value": "CO.ADVERTENCIAM1.ja.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a801ecb7-7a44-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699014579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014579, "uuid": "e072fcda-36c0-4034-86fa-f429883cd4a2", "comment": "Malware payload (IRATA)", "value": "ef331cbe9053d4a6e5a2d1bb99d52fa9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014579, "uuid": "e833163e-b4f7-421f-8acb-c6b2ebbb54cc", "comment": "Malware payload (IRATA)", "value": "9dc15929466c9052c84921a6954dc5b2ae7419cd7d4e56aadbb0026dd5a11b2b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014579, "uuid": "53998014-bc15-4d23-9c0c-22881a5a9264", "comment": "Malware payload (IRATA)", "value": "ff851b52bbe02dc4225d38f85e4a43e0d726b23c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014579, "uuid": "f7a8d8a1-6055-4f35-8e76-3c1f893de5f9", "comment": "Malware payload (IRATA)", "value": "204bb8b7f9867a0fb752efb93789911a7b81cf2259c1b44a050445082efaac04c5538431d61f6ba80e0bf64eb5401836", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014579, "uuid": "a5def4a6-0b27-4823-9719-5b509ce71df7", "value": "T18CC52397F637E86BC831C13232452739501A1E4AD646FB8A365877EA34FBEEC47852D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014579, "uuid": "b224596e-c7e9-40ae-a4dd-ab45c19e743c", "value": "49152:HFFOp/cBT2DN3cycC7mhVlvZXukxOQgpWk9L53yJdT9cOuKo2qwUVmyw:lQp/cBT2B3pcC7mRmdzL5CJdTWr85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699014579, "uuid": "b4a8b64a-63d7-47df-84d9-d73d66f60b48", "value": 2740415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699014579, "uuid": "991d155c-7179-4962-9fa0-752e35eebd3b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014579, "uuid": "52462cbc-d89e-48ba-a3f7-31746a2a13da", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852256e8-7a1a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698996481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996481, "uuid": "6db0acf2-caff-43e9-8f08-af827ead2075", "comment": "Malware payload (RedLineStealer)", "value": "db9d20bd0059d20245956cf75bb9227f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996481, "uuid": "a7ab725c-80ce-4693-8984-ab377cbef273", "comment": "Malware payload (RedLineStealer)", "value": "9e187779d1735830908cd64765f6b216374b9e67fa2a6e19a849e246cb921c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996481, "uuid": "06168b39-49bd-4603-ac7e-91a156475954", "comment": "Malware payload (RedLineStealer)", "value": "a1bfb4b77437dc05076adae3822aff07ac926272", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996481, "uuid": "0d6def94-de9e-45e5-94db-e8f543a54201", "comment": "Malware payload (RedLineStealer)", "value": "19542ac9d0ce3007e8f21ba2c1e9fd437dc2b38c55b5297d45c41aaf996a663735a0bcb56e0e6b824afef39f89b788b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996481, "uuid": "fe8aaea4-919a-4f54-916d-680f415709b5", "value": "T1AF559E31BDF091F9DD92A07703FCB67942BFDCB8976812CB819416EE87142D26732A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996481, "uuid": "eeb28065-43b3-4640-ac23-cb140830a0c5", "value": "520ab4e8f9944dbd318db6f456d2b2f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996481, "uuid": "03afc376-def3-4c32-9538-fd819342e5bc", "value": "24576:YDhBcPenF2U7vq1nwrzkFhdeijeOXR1Vg3Lqc:KBN2U7vqNyk5eij/cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996481, "uuid": "03be5da7-5d01-452d-9499-b6ed2e1155a5", "value": 1311072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996481, "uuid": "92f2e294-4f08-4955-ade8-76df997e94cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996481, "uuid": "15910c4e-861b-414b-9272-b7a8ae805763", "value": "db9d20bd0059d20245956cf75bb9227f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2152e676-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981281, "uuid": "349f8afd-5669-42cf-8041-8d64390427a3", "comment": "Malware payload", "value": "43468a4b474b5a2299d95a2c7f0801f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981281, "uuid": "89a5304e-5510-446c-aabe-1b66f12c28b6", "comment": "Malware payload", "value": "a07993311fcc7dd2a7be41c76bb1a6b90240cb5328515ae55652b520e732bb05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981281, "uuid": "a7dd685f-b567-4417-a2ab-aae44747ee14", "comment": "Malware payload", "value": "64e317b939848ad09555eb3820af5eb42b1e8844", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981281, "uuid": "04a35fdb-c057-4b6a-b3f7-49ceea2244cb", "comment": "Malware payload", "value": "897ab592fb3d4477fcdb6ff17411d5d3ba7d1cbc3f05a793198c6b664394489c343c282ea15ffd96f22edf325e64cb63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981281, "uuid": "0fb9214a-8098-453f-9344-affd7184405f", "value": "T1BA96335FEB4180B7E40779713CEE31D410EEB1ACE23F6885145BACEA4B0B902D96762D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981281, "uuid": "0880aa3e-5aec-4304-a963-4bfd318e3263", "value": "aa770df5b9e208c1ca436e9267f0d390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981281, "uuid": "d40705bd-316f-4ef2-95c4-85676204605a", "value": "196608:5mIVIInJZ3aEp28SsPQf3OrlvNdqdNh9hs16g:UEJZKEpsus+lzY921/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981281, "uuid": "3b648a5e-b726-4230-a790-43210ae5b31b", "value": 8621368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981281, "uuid": "8b099e13-fba9-4cdb-a69b-807ad5866d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981281, "uuid": "4e151575-f4a5-4bbc-abab-e6cc0699ee36", "value": "SecuriteInfo.com.DLOADER.Trojan.412.4927", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d11281-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1699028176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028176, "uuid": "5c6c71ef-377d-4974-9452-891d8fabe899", "comment": "Malware payload (SnakeKeylogger)", "value": "034400a76e49b6211255a093f6b639bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028176, "uuid": "095e623c-882e-4d6c-9f8b-b28fc3e15c94", "comment": "Malware payload (SnakeKeylogger)", "value": "a07a2559c8b308517f174bb048dfc080591b0576bc8be681b609b611f1a20880", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028176, "uuid": "cb7f5f42-d1ba-4bfa-88ac-7d519ae2d5f0", "comment": "Malware payload (SnakeKeylogger)", "value": "e7a6a80243ac34759a1ac2fb7d6f893cfdb72dec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028176, "uuid": "74aab0ef-2590-4799-842e-856feefea613", "comment": "Malware payload (SnakeKeylogger)", "value": "6e33c433933499931eb6c0071e3085388afa773cd030d6200b4102fe44742b3fbd6eb47f68fcdcbbe821060a744136bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028176, "uuid": "46848f70-63cd-4aff-99cb-546661b0ab84", "value": "T19DF3A4277AE6ADB1C299173AC7D740004365E5D2E6A3EF9D7A8E13E90F533B69D00603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028176, "uuid": "27510464-208f-4288-b5dc-c29a91f9755e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028176, "uuid": "c4ff1178-5164-413f-9dbd-cfce6b3caef9", "value": "1536:sInl09FNBd7i+m0H2q60HYR8DFGeULsfs7HNnmcJKnPij96yiFhfk906uhNdmhzj:TnWlBVdTzUDBmcJlj9jCcS6uhNd2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028176, "uuid": "1580ef7d-c1a5-4f96-a2b4-3f04a198977f", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028176, "uuid": "5e57bc63-4d35-4010-abec-568ae1037a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028176, "uuid": "b08a17fc-dd7d-4765-9574-271c897d6b0a", "value": "Porland Sipari\u015f Listesi 03.11.2023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2627b8-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981274, "uuid": "871d3b04-1959-4875-9b8b-0af28cd7e8c2", "comment": "Malware payload", "value": "2dcd7c6f66b800c97dd554404187da80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981274, "uuid": "889a15a7-7206-48d1-9559-76c6c5e70c01", "comment": "Malware payload", "value": "a187cafc3350a71c732b9e35e0a62ff13a32a6e08b40f180b298eb525f77d402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981274, "uuid": "048d158f-c78d-49e2-bb9c-a3330d8ac66d", "comment": "Malware payload", "value": "2efee89301edce0aa87c9837226920927b996ddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981274, "uuid": "93e401ca-52d0-4ae1-80fd-5886d77c2878", "comment": "Malware payload", "value": "547d6eb54e36a7b5d4e8ad8a16175a3b600d21b930795aeeecba6833790b3057532d97659642000aef30543f59ac7689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981274, "uuid": "17040f3d-6762-4db1-9c63-0d189b24e5b7", "value": "T13895FD0BAA831C4ED5DA34745A3FC76CBADE62D486C120F16274CF9C9B5A20771BD6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981274, "uuid": "9ba09f3f-9761-4acc-b569-654221b926e6", "value": "12288:XPYU1gi0BQVKBOkTix6Bg4Y3GgZfLtFBVJ:f3iQMUd6e4YDTBVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981274, "uuid": "adfc99d6-d4b6-408a-a6b4-1cac21e722d8", "value": 1970176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981274, "uuid": "034b612c-8ca4-4df0-8e79-a8c20b78799d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981274, "uuid": "1ba52d28-764e-4be8-ba77-239bb6b58f2d", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.25260.20441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53db999a-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996828, "uuid": "373e32ae-246e-452b-a4f6-379d7fac613f", "comment": "Malware payload (GuLoader)", "value": "d34ee65fbff37415ead9401c76b7d145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996828, "uuid": "7a48d32a-b9f7-4bfa-ab71-c70ae9200f85", "comment": "Malware payload (GuLoader)", "value": "a1ed46df50f5be3a6b3b291189d115bcccb9ea790a90f7c141a6e4169c0a0895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996828, "uuid": "8e52a407-cb42-41b0-8bd8-e723f42c6767", "comment": "Malware payload (GuLoader)", "value": "27ccdfe6a54a331d1499d477795fea73f19d49bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996828, "uuid": "742a9e02-a57a-4b7f-ab83-d6056a5aa72d", "comment": "Malware payload (GuLoader)", "value": "52f7e09a3310e7383a69b040fe247026630e56849a86c2c17cc277caaac3eb3feba6b6814eab4d35c7f974afca0b2a06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996828, "uuid": "d429daa8-6bde-4951-a910-43c5e8375667", "value": "T1556512D37E044DF7E8291130641B44A3AB356FBFE681193A3299FE2B4D7226B460E53D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996828, "uuid": "6fa51b15-0e21-4e82-b81b-b8c01e9cc0ec", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996828, "uuid": "537970d7-7031-4bf0-b511-e8d73357f0f4", "value": "24576:eZmBzEHw+w3hlKlX233nFWKq8WucI+9vrc6NlrBe7pyIvR5V1e:6m3BB33ndcI+9vrcode1yWRP1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996828, "uuid": "92b3f2bf-63db-412c-8baa-ba03d606ce11", "value": 1466484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996828, "uuid": "35212d4a-30fb-4add-9f49-c5c187e73320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996828, "uuid": "c015c79c-33e9-4625-95a4-5de93a39b6e5", "value": "Hjortekalves.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d444a4ec-7a56-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1699022384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699022384, "uuid": "5ef9c1b8-c318-4d09-868c-8db80e3d4519", "comment": "Malware payload (Pikabot)", "value": "d511051af29ac7ae138845618734f057", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699022384, "uuid": "8aece232-828c-400d-aaca-93288ffee8ea", "comment": "Malware payload (Pikabot)", "value": "a343e73212e34e59fbecf73785e1c162ce85986b744a3eb14c91adbf0722f2c6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699022384, "uuid": "50a39bec-ddd2-47d5-8140-afb0c3713edd", "comment": "Malware payload (Pikabot)", "value": "70fb85a8473428e0cb9fc4d62b0e30c26936e84e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699022384, "uuid": "31123630-4bef-4383-8e43-2493e1c0979d", "comment": "Malware payload (Pikabot)", "value": "1b4d2a23f1a1de6e11921b2d1f4fa8a0754cffc52a1b87066b651c59be40b6359b8682d4bd9942e25979b8a3105d4c2d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699022384, "uuid": "ef11c206-e220-4982-9869-35668f5c014a", "value": "T14A45F122B750C032C44F0139F85AD7F895B9BA709D799917B3E84B2D1F703929B29F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699022384, "uuid": "198d95b9-51f3-4bfd-9668-3a10ddfcf1d0", "value": "0793fc5146cb2625c14847ed7595a3e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699022384, "uuid": "b2b112c5-6402-453a-a98c-60265ad99ff9", "value": "24576:EtrcFS3D0x4f8FJbA8dE/D3A6y2smW8ZWTgHSbK6SjcpEtWL+ol9FS+EIZmNQ1:q4S3q08FlA8cD3ZFsR8UTgHThjULT7ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699022384, "uuid": "d89b9765-a648-41b2-8b9e-8c9da96ebebe", "value": 1210024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699022384, "uuid": "f6a26e11-631a-4399-b7a0-e138c5734178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699022384, "uuid": "3f136830-543f-4f63-a7d7-ea685a7aa3b4", "value": "pika.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588b36b0-7a43-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1699014016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014016, "uuid": "eb16dd34-be9e-4754-8312-ca1a96c6cecd", "comment": "Malware payload (Pikabot)", "value": "898854477243e8b9b431e73e31246ab4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014016, "uuid": "a1a313e0-f94d-49cd-9ecd-0135e414b3f1", "comment": "Malware payload (Pikabot)", "value": "a352b9eb373fe914888128f3e6e72cab5a5193cbe491af45304ed7985c9dff8f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014016, "uuid": "3c02fff5-13d9-4d0e-ad8a-6fc527073527", "comment": "Malware payload (Pikabot)", "value": "803ffa5b263aad9c4f24d92fe340a656af80e9ca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014016, "uuid": "9a574052-74b7-4e9f-8bfb-fcbc2b6728b2", "comment": "Malware payload (Pikabot)", "value": "7b6ab17789d388afd314fa1f4132c95652add9ccb212728213ab0f1da7e269ff448d454e44c6ca1ae81b793094a7c091", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014016, "uuid": "be8b7824-8a96-4eff-9a06-926ab9d941bd", "value": "T1F345F122B750C032C44F0139F85AD7F895B9BA709D799917B3E84B2D1F703929B29F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014016, "uuid": "c6622838-49c5-48e9-b1aa-0a0753ffe0cb", "value": "0793fc5146cb2625c14847ed7595a3e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014016, "uuid": "a3988978-54f2-4feb-86be-90a0c174165f", "value": "24576:EtrcFS3D0x4f8FJbA8dE/D3A6y2smW8ZWTgHSbK6SjcpEtWL+ol9FS+EIZmNQ2:q4S3q08FlA8cD3ZFsR8UTgHThjULT7ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699014016, "uuid": "5fd913c7-08f5-41d8-8225-11ef6bbb7fa2", "value": 1213217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699014016, "uuid": "fd70d5dd-560f-46f3-9bde-31bb9381a22d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014016, "uuid": "06674bfa-cf08-4c5d-bc64-1d049f64568c", "value": "UHQvR.cpl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c9f726-79dd-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1698970063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698970063, "uuid": "24fd3083-48b0-4485-b4c8-c5cba4aa67e5", "comment": "Malware payload (AsyncRAT)", "value": "f40de7d2006a227a8541ed00dd6494d4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698970063, "uuid": "76cbc2e8-87ef-4b78-9646-9b0bafb84f5e", "comment": "Malware payload (AsyncRAT)", "value": "a3d793c8368a2a036f8e1b20ae53f96c0ab4fe6e82ee610702660efb9b1ddd2d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698970063, "uuid": "a7a4cb79-16ff-43b8-9558-61e9204ea1b1", "comment": "Malware payload (AsyncRAT)", "value": "d15b4e49ef49ecd08b0683256d2f04861f2a745b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698970063, "uuid": "f7ad047e-77bb-4905-a498-11f39786685f", "comment": "Malware payload (AsyncRAT)", "value": "370b8987b0c42cfea1bb60e1858bf2c779fd143bb007e11d0a425369add04fe8ef37f9034987e083e2a9dd6140f9d824", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698970063, "uuid": "81b0186d-199d-466c-85b5-de3740434ffe", "value": "T14A236D003798C13AE2FD4BB5ADF3A1058679D6672D03C6596CC860EA2B13BC597036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698970063, "uuid": "d6f219d1-6772-4cab-9473-f6b2b9b6ac3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698970063, "uuid": "cc7445df-052c-4788-b5bf-e92b0f77b923", "value": "768:V96mxUTILWCaS+DihzRiAJ8YbygejY5Z8f/Q7vEgK/JzZVc6KN:V96AKWlRzb1y277nkJzZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698970063, "uuid": "807270aa-6190-426e-a7b8-b8d2cb8aaeee", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698970063, "uuid": "7a253c5d-b31a-4e1c-a662-b7e7ca98a1b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698970063, "uuid": "ed535ed2-b97b-4470-b7b4-cf274099850f", "value": "bRhY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c1dffa-7a92-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699047916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699047916, "uuid": "0ad48a99-90b7-4fa4-be6e-4f454fac4737", "comment": "Malware payload (RedLineStealer)", "value": "1976c41f6b4e1a5726feb4a1592b716e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699047916, "uuid": "859d4b22-c4ae-4a30-b139-7195dab14ca0", "comment": "Malware payload (RedLineStealer)", "value": "a48f620502bbecc81be0a326224b2b9ed17f137bb401ee987e1c7bfcd9f8cf2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699047916, "uuid": "7e0f9225-23e3-4730-ae90-459eccbf279f", "comment": "Malware payload (RedLineStealer)", "value": "baeb86291cc14ffc2e69a331738a699e81d32e8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699047916, "uuid": "51ddb210-8e6f-47e8-b404-95504b27809c", "comment": "Malware payload (RedLineStealer)", "value": "33b657eb81637a691e5e92941fef2267a31c140cc0bf17a5469e2b572443bd8bdba86a418d091bd9737d0b95bd6e336a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699047916, "uuid": "94d7f683-9eac-40a6-adff-2ab241f237be", "value": "T1C485FA1176F95B59F5F30BB856BAA612087ABC6ADF11C2DF1261948E0C31BD08970F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699047916, "uuid": "a443fe26-7471-4fed-bdf8-290b965c8f1e", "value": "d47242ec56e1a1639468f1233564ee05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699047916, "uuid": "31eb54ac-0911-4616-86d3-9c74c32edc1c", "value": "24576:On/y0rGPjHIsS8nVwxV+pEH6a9DhvhqMjyLzR:OcjHIsS8m++H6a3vZyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699047916, "uuid": "4ebee1b1-f4d4-4eea-bf03-116464ee1cb9", "value": 1743624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699047916, "uuid": "7e8ebfc7-8a40-4a9e-b9bc-56ec37ceac2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699047916, "uuid": "98641e76-d74a-4c4b-88e7-908039d37dff", "value": "1976c41f6b4e1a5726feb4a1592b716e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79634bae-79ff-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698984865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698984865, "uuid": "b7db836c-8988-4fb1-b241-c604d799cab5", "comment": "Malware payload (AgentTesla)", "value": "06c30c6dcc35de215dc10a21d26154dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698984865, "uuid": "d98dbcc8-f728-45ef-a0c7-a1adefa00baa", "comment": "Malware payload (AgentTesla)", "value": "a671341ae41235ddeac07efb4d8477ae696ab43f9208aae564594faf523602ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698984865, "uuid": "0180bd56-3fdc-455a-881c-9043c50932b5", "comment": "Malware payload (AgentTesla)", "value": "5b63e38108bd85453cbf45ec2d4ea5160545f776", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698984865, "uuid": "96c05024-e760-4ce3-954a-c79fedac91ca", "comment": "Malware payload (AgentTesla)", "value": "691928c92564525f433ce3a50e73176cdecf4006363f8e0f742461e3d140d873c2e5add58732341af499357c5b869795", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698984865, "uuid": "576960f4-6358-450a-839e-422c1770756a", "value": "T139D423E173A89B75CD6B47F29022A13177FB26671569C7892CE430CE6AF7B510070BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698984865, "uuid": "1ff28cd7-374f-4614-8f76-ab79c1eb8c4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698984865, "uuid": "d4d1c92b-e319-438c-bb0b-ba5af379aab7", "value": "12288:ZIkuTxFEZUpBnzwM/FK3WgbmxP67jXMloPtS3k0D+ukm5rj4RSbC:ZIksFHnHMWgixi7olZ39Nwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698984865, "uuid": "8c2b784e-f42d-45a0-a08f-d4b2442805ea", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698984865, "uuid": "89d7614d-710d-44ef-8d71-fdfe07414e72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698984865, "uuid": "50ed3ae7-f6fc-4304-a5bc-8a5de1bf8274", "value": "SecuriteInfo.com.Win32.DropperX-gen.2970.32259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afd5f0a-7a53-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699020972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020972, "uuid": "476a3ca5-57d1-4950-a012-1de0a01c4aa8", "comment": "Malware payload (IRATA)", "value": "71b91caccdd044fd5b5e5dfe07489168", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020972, "uuid": "d0d02d39-93ae-4ec0-9eda-4a2cdec351a3", "comment": "Malware payload (IRATA)", "value": "a6f9e70ff4677a6e980acfef065c3ce1b7c5507dd0f054b932b3a7b43d9068a2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020972, "uuid": "db0d34e2-99b3-4def-a061-2d758b1ed4d0", "comment": "Malware payload (IRATA)", "value": "4a0f4f6158322360702d252e23ac48cb2c5bdac8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020972, "uuid": "1db28c02-cfc0-4d0c-b5ab-284be55444ae", "comment": "Malware payload (IRATA)", "value": "8ce5043b4baf81cc7b4a1054d36fdbb281f786dbe92fb150546055e23463f0b2210da2e34808b1c25a7930822fa273b1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020972, "uuid": "46735b62-8e73-4338-9eb4-48fb1d723fce", "value": "T1A2851253F276B857C8F6C33221742635517B9D25D703FA8A388873B928BBDE80B856D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020972, "uuid": "e398d6b0-c265-45e7-a8d6-8c60f20a88dd", "value": "24576:Gws6xxnq+OeOvjozgLGNNUVqIYMWClxFiDB5ySEV0KmK6mH2r/uB5RjN:GwsMXOjMKSuVqqvLFYFG0rK6C2DuvRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699020972, "uuid": "f56cb5aa-5b4e-4a77-9b1c-4196f190dc82", "value": 1756120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699020972, "uuid": "a8b8ebeb-c313-45b6-a708-67a195f07be9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020972, "uuid": "752c7dff-64aa-4965-b4fc-e3e20e8746ac", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b92531-7a8b-11ee-8907-42010a9c0042", "comment": "Malware payload (Stop)", "timestamp": 1699045128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699045128, "uuid": "d840921e-f882-4fd2-82aa-2b39a1eef530", "comment": "Malware payload (Stop)", "value": "147f66a4ab5d877e9cd347e9c16fcd72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699045128, "uuid": "4e6321e1-5f93-4de7-a3da-08fb994899c4", "comment": "Malware payload (Stop)", "value": "a706c1d0d748f3847de78ea63f7b3b6a6336f5750c84241e6b7fd0d45cd43765", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699045128, "uuid": "5899eadd-afa0-4c16-aba4-d3212741ce06", "comment": "Malware payload (Stop)", "value": "37e9024c5d64d51d01a1b1c9b3f1b5758693cedb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699045128, "uuid": "18434da7-0e9a-4510-86e0-864fe806fbc4", "comment": "Malware payload (Stop)", "value": "479250e0b4d7fc714c021e358566d235711745cf7c61018d0a6d619d477febc7dbd3e2fd82f4da2be4b4d28fcd91b048", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699045128, "uuid": "2e906e4d-9c0d-45fc-9348-c4d17d8d6eaa", "value": "T140F4F15363916CA0F6236B338FDEC6F4F61EF9618F553B9A1254AA2F05701B2C5B2702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699045128, "uuid": "1528365e-8654-4e81-af21-0674c0011eee", "value": "ce8b02cf0e0e47bfce02667d7460664f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699045128, "uuid": "2625ec5a-77f3-4ac5-a520-3f659a89ee46", "value": "12288:uA8auX4Zp7MC2bkWKvkfsIvkjAvh1rJyjvQe4XcIVvfdquBAsbDG:uZXcV7kkkfsI2qXF8vQe4XcILAs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699045128, "uuid": "c13ffdf2-2768-4887-b13d-ced26604fec9", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699045128, "uuid": "51d5fd80-1133-4cf1-bb68-5ddd5e02bb21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699045128, "uuid": "1375dd68-8d18-465b-9cc0-96aa556ca2e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585fd978-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1699032913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032913, "uuid": "d3d417b6-a5b4-4ef8-9a38-65461261caed", "comment": "Malware payload (njrat)", "value": "536018d01ee05bc37064c480178e2bf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032913, "uuid": "04643af0-3636-4b2b-9535-f1116dd4fbd1", "comment": "Malware payload (njrat)", "value": "a9ea7800b0f50505268b058f14a23dbe4cf6c0f134681a68dce7429b9df8d88b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032913, "uuid": "749bc74d-dbe8-4707-9e2b-43545ae6f241", "comment": "Malware payload (njrat)", "value": "1d21d2d4f21fa7a19cad7e69c8c143bebc9ba7fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032913, "uuid": "aa943725-4056-42ad-83c3-978625d8b4e7", "comment": "Malware payload (njrat)", "value": "3e2972fa307a43b73aef5e3cb02baef5a811f4c1e50189b7d2135c2cf7bf8dcb40f041f2a2a008a3f799a9bc8686cc3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032913, "uuid": "33a106f4-45c1-49f1-ae6d-6da31b1976e9", "value": "T1B735DF1F11A0A033EFD236716998B2603F6DDD5AA7308D8F32C432FD4AF1AE26975255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032913, "uuid": "e6bd1a1a-a7e3-483a-8ed8-348794f31d98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032913, "uuid": "34163405-c734-480e-99e7-36c3fccf99ff", "value": "24576:vtW4x8xgmUdUcyezFSjahBaNOMGC3UgJuTYdIMlM9QVmcIOLfEdjJYVB1X1:s4x8x1UGexmbcMGC3U3MlLVmczEdjJYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032913, "uuid": "e685d97f-dfee-400f-9593-f479c05cdbb6", "value": 1078272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032913, "uuid": "be0e6203-fbb3-4058-a506-ae500fcc17a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032913, "uuid": "a5094cd9-5fe1-45b3-8c03-8d2ff7cbe29d", "value": "536018D01EE05BC37064C480178E2BF8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec81e345-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698998373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998373, "uuid": "3557780d-1fbc-4d38-811d-ccb2a81baab0", "comment": "Malware payload (PureCrypter)", "value": "57edf5a0dd446f1a9e0dcef304db825d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998373, "uuid": "ab94acc3-dfab-4ae2-9a59-1bbd3e5cd272", "comment": "Malware payload (PureCrypter)", "value": "ab1e9c4a9461493e430c853ca6ff797e32636ea00dc100f4955a18e6b3708bd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998373, "uuid": "fdf4cff0-6801-4aea-a97c-b1cf01dfd9eb", "comment": "Malware payload (PureCrypter)", "value": "a04c5f75fc38df1abdba76cd57738718ce6a4559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998373, "uuid": "54090215-7af4-4260-8b71-dfac09995a0c", "comment": "Malware payload (PureCrypter)", "value": "d8690873d51142f051ccef8e77b7d62986fc0ac2d8a33ab75284822634d16ab3acd4b764ea4aa5b6cb55055adc0ccf5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998373, "uuid": "3c628dbe-ff22-46d0-9187-6f453c328fe1", "value": "T1A904EC52EBB6EF31CE340A3FC245B3295F2E5E9181F27D8E704DB1652EB9D01C5406AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998373, "uuid": "eb52be02-b313-447c-ab68-cd2a8eb719dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998373, "uuid": "f60796d3-fae8-4f77-a7a3-5475a3c288fe", "value": "384:eyyffnuqaaidINmwww6BKpwWowwwlpESUJXtdhVm13jWtSHPWcAwaYQ:eyVCNRpESUJXtdhVm13jWtSHPWcFaYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998373, "uuid": "806a6072-8639-47a5-b94f-649c6a0b351d", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998373, "uuid": "cf870276-362b-438b-894d-7d6e5f0881ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998373, "uuid": "577068c9-99f2-4d4a-acf2-889dfb23536c", "value": "HPZ675375_ONEYHPDGT-BGLsigned.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d7efd9-7a44-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1699014494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014494, "uuid": "2a0ec8b2-9bef-48dc-ae95-8c3c71225cc0", "comment": "Malware payload (AveMariaRAT)", "value": "6c55177bfb8a79a653c953be7eb884e3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014494, "uuid": "a8cc704f-2012-490b-ab7b-de5ed2623df6", "comment": "Malware payload (AveMariaRAT)", "value": "ab9be9e443a6bbfa3979ce0977147c28f38a4d17d70b469e6d168acc0c6a16c3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014494, "uuid": "a173972d-3b43-46a5-b737-98c012f0d471", "comment": "Malware payload (AveMariaRAT)", "value": "0e037e55bb7057d80075ec7d3b66e1a199f70baf", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014494, "uuid": "518941a6-8917-47d4-a280-4b35489d1691", "comment": "Malware payload (AveMariaRAT)", "value": "970de211442901c6fefa6e0f9f8e61744cd587432468dd9b5a5761202d37eb27f87cc052150346384931c726201d0e1a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014494, "uuid": "1c2fdd31-0133-41ed-ba2d-d045e1216821", "value": "T10003C68637A8AB37DDBD8BFA69A1104107B1712BB498F34D1DD170CE2A73B006A50F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014494, "uuid": "8248db4a-f379-4b12-8f92-3ea6039d88da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014494, "uuid": "88f482eb-7c8c-46a7-90ff-ae7fd4ce2839", "value": "768:a92PckMMY5R2/L3LqfereJU2OhhWiY92UemRCt/FLrHjo39xfmXx/tIkyHroo3:T9MMY7iLNt9LYf87yLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699014494, "uuid": "64888d50-7279-43a9-92ee-9b3075e16774", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699014494, "uuid": "4936ff96-259a-4d4b-a6f1-a256d7c1d8af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014494, "uuid": "2c50528c-b329-44bc-aa00-2e16d9d48cd8", "value": "ab9be9e443a6bbfa3979ce0977147c28f38a4d17d70b469e6d168acc0c6a16c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee2695b-7a74-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699035286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699035286, "uuid": "a48a97b5-1182-4b2b-a6c8-e14ba88d6b76", "comment": "Malware payload (AgentTesla)", "value": "548dc3668c2566b60b02fd77cf786c4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699035286, "uuid": "9bf064d5-b0a2-4d61-afb7-ca98fb890a7c", "comment": "Malware payload (AgentTesla)", "value": "abc504150c3ff15e2df61c72059fb4c39a720983983029fa5da6ae384a009b78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699035286, "uuid": "71e97af4-0f71-43bb-949c-667654e5c24e", "comment": "Malware payload (AgentTesla)", "value": "648ba4b9c5d9768c0f053b3a2cca4c63de5a39c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699035286, "uuid": "99ad6a52-e65a-4c43-a59b-1052dae2fea8", "comment": "Malware payload (AgentTesla)", "value": "a4597814a9799215548d09b7abac5e385a19e77acc43005c3c5af848634d16149c67f16ae59644c0ed66fee6c62a4e16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699035286, "uuid": "d32bde5e-442e-4d5f-86cb-e84f18458525", "value": "T1B1D41200BAB80B12D6FEC3F60894655907F5B4AB6451F7990C94B4FE766AF808F90F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699035286, "uuid": "b2f46f6e-f4f5-4297-83ec-ec36f3922691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699035286, "uuid": "f7680514-8bb6-4371-b7dd-e7eccb970865", "value": "12288:JEpEQmwTZ7rY2ujbHtO46xsuZnJ0XLta0jYnG8BW8N5Zc0OdTfGL/:JESu8bHtO46pZubta08GmubOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699035286, "uuid": "fb7845ac-f330-407b-a3b3-918fc5983da3", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699035286, "uuid": "6701632a-1ff2-49b9-9e63-d950083d7402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699035286, "uuid": "387f5638-e0f9-4ede-ae9b-e288e785f558", "value": "SecuriteInfo.com.Win32.PWSX-gen.11355.24812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69d8f89-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698997074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997074, "uuid": "0d059cb5-fd6d-4a47-a671-8a8d44e714d7", "comment": "Malware payload (PureCrypter)", "value": "491afe09d9b0ffccf3d3471fcac150b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997074, "uuid": "2d23eea5-7b45-4719-80e3-114ce84964a3", "comment": "Malware payload (PureCrypter)", "value": "acc856cd5bbff56054c263244867b8fcebc9e81899ba7ec83a243364f71d7137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997074, "uuid": "fd0d56f6-b819-4f41-bdea-c28f596534d9", "comment": "Malware payload (PureCrypter)", "value": "5ffccc2c798a2b567819a7db5a588e9d169fe3a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997074, "uuid": "ca95940d-21f4-45ce-90a5-8c1a3a3567a8", "comment": "Malware payload (PureCrypter)", "value": "a13cfc5ddd1887060c41a6b9882fd70629e6ca94beabb92e0d1efd3dc223e4354cd590fbb906f13cf4b45409ce62379f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997074, "uuid": "ffa26169-3e60-4d91-9611-4c86ee71ba36", "value": "T1A0F3D70777AA89B1E29917BFC6D704044372E583B6A3EB0D754E1BE90F07BB69D21603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997074, "uuid": "6f15f83c-40e8-4f3b-b840-d12752736af6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997074, "uuid": "e631d869-278b-4129-84f1-cc8689de0c8e", "value": "3072:vEZygkwUTCJfzopj40dgF8fRq2GX1RGIxF:cffUTmfzoF3dgF8ceIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997074, "uuid": "dcb04d08-85ed-414e-bd12-c2f24723721b", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997074, "uuid": "d7b0c4c9-2653-4c7a-af51-cb278212651c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997074, "uuid": "e089bbed-d6ef-4955-833f-52926ae9d60e", "value": "NOV_RFQs#456372_SOFW_600SB_Rr_TIANJIN_INTERNATIONAL_CO_MATERIALSs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52d8935-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998360, "uuid": "92a21f13-9122-413d-9846-153a87d0716f", "comment": "Malware payload", "value": "b14cd0f5f852e4a4829563e8be9f3255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998360, "uuid": "12211cf7-62fe-4f8c-89d2-e6d51bbae3a4", "comment": "Malware payload", "value": "acd6124fd2447d72e94060e022d2084bae94834aa8a3db8e7cc6a6d9b5141e01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998360, "uuid": "1a6e3163-fe27-41ce-9586-08cd2755112e", "comment": "Malware payload", "value": "45fe483ecac81a36dbcfa62e08c466015ae128ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998360, "uuid": "f967f203-64b9-4cfb-88f8-a0c58a168e86", "comment": "Malware payload", "value": "dd70636257d44646afbd962cccb0c8f9895b0431996206ddf43ecb9f45fe22e7dfe9e555d5f06da6452d6b060ac2e1d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998360, "uuid": "2da56193-67c2-44e5-8074-72ab7f73fbfb", "value": "T11564B602D7B6FD22C63441BBB0A67148CEADDE9043AAB6956814F1E3BF74744B9F010B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998360, "uuid": "6f3fa24d-b89c-47c7-91b4-b8b6ed8b3ccf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998360, "uuid": "6b65e7e2-726f-410f-bc7b-80bc29e89f34", "value": "1536:lBz/KXz5hwQLhk27irlIPOToAtglZPUQtkvN2PjVNIYqjSSs:ll/anbNk27iKVMgjml2bIjjSSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998360, "uuid": "faea4bbe-118c-4868-9e3a-f0d481d5331c", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998360, "uuid": "14603fa2-d9fb-4e3e-a7b1-cf0df0c3b487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998360, "uuid": "5f4fda3b-d4a8-48d2-8f7c-3f776394203d", "value": "summary_invoice_payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5240f0-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698998377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998377, "uuid": "9f749cd6-9476-4416-bb43-c3b41ed51bf3", "comment": "Malware payload (AgentTesla)", "value": "967ab617fcd455e6c1dacf8893d1b725", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998377, "uuid": "fe9d1b23-bbce-4349-808f-2aa86bbf0bc8", "comment": "Malware payload (AgentTesla)", "value": "acea69f1fbf27a3ca045260fc74f504387b2b34a2db2f4cddc855246785fd151", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998377, "uuid": "9d35aad0-2979-4e4b-ac0d-192546e5eb0c", "comment": "Malware payload (AgentTesla)", "value": "66551fb74dd7ea1cb4448dd9718ff787612223db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998377, "uuid": "bc8f5827-2190-4334-ab55-5d92cd802096", "comment": "Malware payload (AgentTesla)", "value": "9dd05de3b7d3e4f2f16167f46e7726641319cbc35e5f21c8dc7ed0030a91169d1d365177cbf86ae30f3c84b15d2085a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998377, "uuid": "adfe7b05-561e-45da-b558-f8a2c8760fc2", "value": "T1FC04B742EBB6EE31CF34053F828573354F7E5E9281E2BA8E7558F1652EB9E44C4402E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998377, "uuid": "5021ccb5-6e56-4088-9d44-90d6404a7d1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998377, "uuid": "51010eeb-d99a-4790-af7a-429bb5baaf16", "value": "768:LN/DMtnp9qYOXyADiVR6ES0JXtZhVm13j2tSHPWcSaYy:Lx4po5XyADiV7SL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998377, "uuid": "4cb9aae4-b2cd-48b2-9458-0c1472ca28b8", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998377, "uuid": "59d57c07-780d-46c9-a111-a9f1e325838b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998377, "uuid": "a5010af6-69d5-4126-ab99-2514f50d6c16", "value": "HPZ675375_ONEYHPDGT-BGLsigned.pdfp0-PO#2301-DBOU52003320230508-1.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a138ccd-79ff-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698984866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698984866, "uuid": "a79264d2-92a7-441c-bc8f-5e0b7f235545", "comment": "Malware payload (AgentTesla)", "value": "b38dc9fdc7cb07f8ccd59ed9f1c03b69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698984866, "uuid": "6c2e96a0-09d3-4cba-b4b4-7e45c1916ba6", "comment": "Malware payload (AgentTesla)", "value": "ad01f89f8f0f94e6e16b4891bfded48a1debaa0397a9e43511a64170f6b32f55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698984866, "uuid": "b7ff0d18-5f7f-4da1-aab7-71d9639ad277", "comment": "Malware payload (AgentTesla)", "value": "01f7fb3a5bff28d1090ea8a783df5481ab0f05eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698984866, "uuid": "ec445baa-ae4f-4e40-8fa4-45c1346967d2", "comment": "Malware payload (AgentTesla)", "value": "154ecafcd592b542e154a942aa22a4016901b6054a650a2428b07560fcb18dde2c2151191cad23d9124f89bab3ea5b00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698984866, "uuid": "547ccca5-f145-4e86-a83f-134a755c26d2", "value": "T15FD42377B9E02F32E92E5FFA405CA50353BC252F5600D2984FD5A0CA9A7BB689474B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698984866, "uuid": "c9d99144-8d47-4cbf-90bf-cf5bbb61110f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698984866, "uuid": "2a2996ff-9b23-4e5d-b9fd-e6d01d88ac23", "value": "12288:GIkCKAVqcvo6ZAQYqBzMigSoGLyD7Tfvd2a7rjqL:GIkFAlbwS9mD/Hd28j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698984866, "uuid": "21ccf9c6-aba4-4bf5-96d8-0a022d262c1b", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698984866, "uuid": "e66c2c3c-432c-481b-bda7-e378bcad1db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698984866, "uuid": "b21386c6-292b-4231-a348-cab011f430ad", "value": "SecuriteInfo.com.Win32.DropperX-gen.28528.679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe4c36d-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981252, "uuid": "fbadc6ca-a8ed-42c8-8004-7125b111878b", "comment": "Malware payload", "value": "f958da3ef390e5163ee42e2dc164c653", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981252, "uuid": "313f787b-dd17-4c99-b098-74935c277205", "comment": "Malware payload", "value": "ad1d2286583d41ed6584ba40c99a02386f0e011ea49d73d4f36dda5217e8d26b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981252, "uuid": "8b69c003-c11b-4d1c-8b85-8423ccaddf63", "comment": "Malware payload", "value": "1894926a04a1200a2e820b5cb18d7c6d111c11a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981252, "uuid": "f0ea90dc-955a-4f17-a44e-fab3549ae25e", "comment": "Malware payload", "value": "4dac2688e0500e3bf4307fe6d0602cb2a667295937f7f875a4bec4ca33d7c0822f242665418804a8e049551896d0b0aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981252, "uuid": "470e068c-28b3-4d16-b025-78e6005c582a", "value": "T178157E11BAF240F5D754153044BE3736AA79A6462B128FC3F3ACDE1D1F362A1AE37219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981252, "uuid": "c493f75b-82b6-449d-b43a-318b5294d2ac", "value": "12288:MdNGcgwyjJ8GBf6o8UQ2+cIrTD4QuWd1GOzh:MGN8GBv5QjcIrTUQuWd1GI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981252, "uuid": "125c1653-16dd-4a8f-8ce9-ce7be70c006c", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981252, "uuid": "6135adc4-ddcf-44f2-bdfb-dee53a246e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981252, "uuid": "ae3099d1-6e0d-40b2-a476-3e4a8a9b7cd9", "value": "SecuriteInfo.com.Win32.Trojan.PSE.10S0A6W.10000.12258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc37185d-7a97-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1699050314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699050314, "uuid": "a16f02dc-6219-4fad-8747-7432bc2d304a", "comment": "Malware payload (Amadey)", "value": "7f26eb486504368baaa6bcbc7fe4caac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699050314, "uuid": "82b77a24-dbcd-4107-8748-4cffe7d14896", "comment": "Malware payload (Amadey)", "value": "ad8eaf453e7529fd470fe12c15a74ac938cd358c2d2787f6c524ea52283bbc9c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699050314, "uuid": "b00cd6c9-4479-422b-94c5-d3462007d41b", "comment": "Malware payload (Amadey)", "value": "661dde8397b0d375338f5b0bb1efaa524161ac9a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699050314, "uuid": "3470e3f1-baa0-42a4-8e9d-209a064e09c5", "comment": "Malware payload (Amadey)", "value": "d7c91b05875eea291df9b348a817b0d28aac22cf71f3c4981bd809c7ad5958a1cc21d703f59a699806235b57543ea43a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699050314, "uuid": "3e600328-c3b7-4e72-ab9a-cc104c8b8a85", "value": "T1EF85FA1176F95B59F5F30BB85ABAA612087ABC6ADF11C2DF1251948E0C31BD08970F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699050314, "uuid": "b2861fcd-5f67-4e26-910c-7bed85dee29f", "value": "d47242ec56e1a1639468f1233564ee05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699050314, "uuid": "cf2b473c-24aa-40e6-8cb9-fb443e5d42f4", "value": "24576:xn1s0rGPjHIsS8ntwxV+pEH6a9Dhvh30kfzR:xUjHIsS8e++H6a3vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699050314, "uuid": "d10e02e6-571b-4e5d-b8fc-cc3530775edf", "value": 1743624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699050314, "uuid": "a5298595-2a16-4e8a-9218-2b7e1e1a5706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699050314, "uuid": "d2884f9f-3ebd-44db-b935-050667f00d10", "value": "7f26eb486504368baaa6bcbc7fe4caac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669612b4-7a85-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699042386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042386, "uuid": "3136c5a3-89a8-4ab7-9d33-ca194955a178", "comment": "Malware payload", "value": "bb897b6af926de14bba7e9752318061a", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042386, "uuid": "00096811-b4dd-4828-a461-beb8448ef4c0", "comment": "Malware payload", "value": "ae0f7106f8b0e11c5526a8f1326c4705266a24cc933b5caa4dca735692cd959f", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042386, "uuid": "b80a847a-807f-4a5f-8b0a-77a7b119d3ea", "comment": "Malware payload", "value": "2dbd55f9cedb96553a18cb863e27b8d608cce40c", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042386, "uuid": "2a023caf-1fe8-4b4e-af48-a2f7769fcb08", "comment": "Malware payload", "value": "d3033a06ba94b105e14e1085e1f8f78435d68229e9b23fff107b58b78dccf58d2fef0b3266dec1636e5e5f354101abf1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042386, "uuid": "d6f61a36-1cc4-44ff-ae2d-244b30c89f4a", "value": "T1E0449439749B21225B3772775B5EA018EBB581275902A104BCAD439C2FF894C12BBFFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042386, "uuid": "6c5ccfd6-6126-4fca-b3e5-39a0322ca09a", "value": "6144:de7hgXeerjqlI2Iro+W8Bne7hgXeerjqlI2Iro+8:dIhgSlI23J8pIhgSlI23V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699042386, "uuid": "4bb9cc17-bf3b-49e4-8780-522f2dd3bb12", "value": 259829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699042386, "uuid": "b60db3cc-b3c1-491e-b426-386fea31252b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042386, "uuid": "b43a7ecf-4194-4d45-af09-a0b16b1749f7", "value": "GGGGGElicnse.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb2dde9-7a55-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1699022025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699022025, "uuid": "2679fbb4-cba7-451c-981c-f59923fdea47", "comment": "Malware payload (Smoke Loader)", "value": "c5ba83f3b662560019f464ff43773b68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699022025, "uuid": "70b251a0-d96f-406d-8c24-75503c4c7930", "comment": "Malware payload (Smoke Loader)", "value": "ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699022025, "uuid": "e0610761-acc2-4fd4-89ea-55919cf85d69", "comment": "Malware payload (Smoke Loader)", "value": "e4b1ec9a5f65771c82311dee0902cef934bb7e3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699022025, "uuid": "ff32824c-ada7-42e2-aa22-532ce65a8f6f", "comment": "Malware payload (Smoke Loader)", "value": "41e4c9b42e5f7b512755f44b830d831afebf22d2706611c99013126f44e83a55dc7de82bf4441e4b638eb5fe56e561ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699022025, "uuid": "ed5ccad7-06da-4daa-aa42-fe64013800b6", "value": "T10C352322F6F95033CCF5237058FB02832A353C609E69571F27459E572A72794E532B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699022025, "uuid": "0fd434ed-b698-48d7-aff9-a7e00736ecd4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699022025, "uuid": "ff065847-f1a8-4955-8c84-2ded92a8160c", "value": "24576:jyI4C8bsrl4bQ4+1TBhkU3PHcybRmFqlfUBuZaz7tov:26hl4bQ9dfPHcFCLZad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699022025, "uuid": "86cfba1e-9a94-41f1-9453-f22385db2f47", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699022025, "uuid": "42135a23-bbd9-4be9-8ed8-be6a8f8eb931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699022025, "uuid": "019b9403-bae1-4d11-a03b-2379396e1510", "value": "ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e350f279-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698997069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997069, "uuid": "6442a588-b4ec-4324-8742-6298e4a4b503", "comment": "Malware payload (AgentTesla)", "value": "640ff3a2a90c76840dfc4dc19645a665", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997069, "uuid": "d5fad8c9-c1be-46f8-a34d-4aeb345fd478", "comment": "Malware payload (AgentTesla)", "value": "aee00173af3d3e8630696a72bd942522543734c26b37afeffbee6d2057285a9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997069, "uuid": "034954e7-5fa2-4aff-892c-bb385b1eb53e", "comment": "Malware payload (AgentTesla)", "value": "1c8efe8217dfd439155e67c84ba748a317e9698a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997069, "uuid": "46b46153-0522-4bad-881e-5ce38cd67159", "comment": "Malware payload (AgentTesla)", "value": "c5903b0ded7c681856bef57800983a35493a098ca2ab0dcd6e226ead6e5aed60ffae6657cee6cf83241832f74cb753e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997069, "uuid": "9e2f760a-3070-4961-9020-cb8839f01d69", "value": "T1CE04F129B2A6D465C163D47F4ECCC7FA160EBC958E12D70F31507B9D0A7A1834B9B32A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997069, "uuid": "95ba117f-b181-448e-bcfa-ff10796aa7fe", "value": "3072:bzcgBbq3MesTzKt0qld7f5I8kNwHRwFdpY+QYG7FD1CF351CfS+1EC2u:bzcOU6gWNwwdpY+iFhC2SXC2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997069, "uuid": "fa6a6d65-d6a7-405d-9e48-b3c7f89a3791", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997069, "uuid": "9d034feb-0262-4390-8560-0dad08934db5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997069, "uuid": "a8a5540a-f544-4f91-b047-0ae7e778f740", "value": "2300900360.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ed1058-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998038, "uuid": "bf4fecf9-52bd-466d-a22c-7f74d1e65c86", "comment": "Malware payload (Formbook)", "value": "e3ffde725018b4c4cc8d51a655a09526", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998038, "uuid": "fbdcf259-ad53-46f7-ae2d-facd754adf9f", "comment": "Malware payload (Formbook)", "value": "afa3fdb1128e9f1c66459130cd28486858ed1e04ef553f7e51f06fc70a9cda0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998038, "uuid": "edbfda64-d7ef-4b51-983a-e59f9adea802", "comment": "Malware payload (Formbook)", "value": "5d77030f4c546372fc081fe5eb0d7dd40abb2132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998038, "uuid": "4cc59827-4243-42af-8a89-808219d52480", "comment": "Malware payload (Formbook)", "value": "7ee9029217d7b89f40b6640b7aa69a680b579d315fe1058bccceb4beed6d17a96077180e5de3089439a99e4ab24b5c45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998038, "uuid": "cc9783a9-94e7-49ee-a701-0935973af8b2", "value": "T1E0B4F0C1D58001E5ECA96F3165338C38A6777E7E9EB06A8E4A9DB5702F73187002BD5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998038, "uuid": "94ea2186-fafc-4103-8c44-5a4851f468c2", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998038, "uuid": "1e0bb432-670f-421c-b70c-633f1ac8e0cd", "value": "12288:lPiFuz6TzgqegDe2Q7wU84mjgxeD2S6eo2p5UlJXYoit7:lPiFuz6Txe2imf2Heo2pmPg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998038, "uuid": "594d554c-eb56-4d9d-aff6-7cde47b53be3", "value": 509166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998038, "uuid": "021c76d2-f85c-435b-9f70-8e4faba81aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998038, "uuid": "12244b15-2acd-4251-90c0-856a71dd4197", "value": "SWIFT PAYMENT & ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314f445a-7a89-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699044015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044015, "uuid": "1211d72b-b766-4104-93ff-565f7a5866e0", "comment": "Malware payload (RedLineStealer)", "value": "9f55390934317f9d308b0e8d509c8c5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044015, "uuid": "749bcd41-3972-4204-8b7c-daa9a198a4d2", "comment": "Malware payload (RedLineStealer)", "value": "aff301f79ba9740cc34b6228604901b6209ec7a5f84693f880bec40b52e2c2ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044015, "uuid": "1113ec43-e510-46ef-b24d-29f7e28faffd", "comment": "Malware payload (RedLineStealer)", "value": "6ef655cf11ea5dba5e48f7dba969cbda82a48795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044015, "uuid": "96513b3d-0789-4ddb-83c3-2c4af3a1fadc", "comment": "Malware payload (RedLineStealer)", "value": "9c450dd01d9608a78b11ea6ab876df3cbbe7272f544d27ae061a1adb802dd0b4fe2fe208cd92b3f2ddc6fc38014650e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044015, "uuid": "082793c0-5a91-40ba-999b-cf8f2a147630", "value": "T17A8533A2AFE48873E5722BB048F7594315763CA04C78927F225BAF562D73AD07931732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044015, "uuid": "51b3cc1e-46b5-41fc-a09a-568666407ae3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044015, "uuid": "3c7f9ab9-5e68-4106-bcb8-8e7d0d43749a", "value": "49152:DzSXpv9E7ywHNZ71NEau+y02RZDfw8CFUHaZEizC8:fSXnmyKNZ7XEaxsrf9K7z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699044015, "uuid": "71eeeea7-3aff-40d5-9131-00d18440c28c", "value": 1869824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699044015, "uuid": "6465221f-6b89-49df-af39-877864a2a803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044015, "uuid": "99c012e2-5597-49d7-a45a-b132cb8b183a", "value": "9f55390934317f9d308b0e8d509c8c5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad36e54-7a43-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699014234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014234, "uuid": "7a955f97-04d7-4e68-8dcd-20ca9458b109", "comment": "Malware payload (IRATA)", "value": "61261348983355398d061723f1e0dc27", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014234, "uuid": "8eac92d3-c5d4-4721-9bfd-6b02c11ef52d", "comment": "Malware payload (IRATA)", "value": "b03e2fa0596af977e1078099897ff3e5c8340848f168a28e9be06b7a2ad9b10c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014234, "uuid": "fbd67a52-f993-46a1-aa88-8c8fe8beeca0", "comment": "Malware payload (IRATA)", "value": "011e2def0ab9f2ae60348233dd3f655dc12c4a67", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014234, "uuid": "70d44333-9b07-4595-9a13-343380380139", "comment": "Malware payload (IRATA)", "value": "dc5b23ca6deca6ac6975a9b9d64e153c2678414a854e788a70d08248cb54b183d0d6b6d419cae40598c514f6cadec89b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014234, "uuid": "49702f26-4a03-4323-bbd7-30ee79846a02", "value": "T1D5850283F266A847C8F5C3322571263521765C19DB43FA4A391C37BA2BB7DE84F852E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014234, "uuid": "b1e37cc4-37ee-4471-b8b0-709c57bc0ce0", "value": "49152:KsmjkknGX7ca06AeuJGJXXQpFVwbsPldSXRC3:KjkkGXIa0ouEJnQRw+SXo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699014234, "uuid": "8fa4f521-086d-440b-9295-1546ac69d44c", "value": 1862870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699014234, "uuid": "a1d85410-9038-4204-8045-6663d7e778a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014234, "uuid": "19382e4e-dc29-4484-a320-581427b5f58d", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ca9cfc-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981284, "uuid": "4725fc57-e1f9-4562-89dc-d7ee0ea5ba85", "comment": "Malware payload", "value": "a9802a7f82e70e44e9a23ca3b1c1c9fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981284, "uuid": "c6f6092d-7d93-47e1-a3d5-0d291e70bb97", "comment": "Malware payload", "value": "b05e6101f5d7b26f8793277b77f89b692938edeb985b1460d3aa8903f44d2693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981284, "uuid": "b489efc1-c958-4dae-9729-3216b8d1c246", "comment": "Malware payload", "value": "3aba9ccc24406c547e0926184c1b2b5b417def9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981284, "uuid": "614258fa-cfb2-4dfe-b044-f475c52c2443", "comment": "Malware payload", "value": "45d4c5efc0977666cb8bb2458f55e24d027d8ac96476793fbc192561800d433f39f1c82cc27231775cdd22646bdbb2e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981284, "uuid": "7882be75-ca33-4da9-9455-acce2f42944c", "value": "T1F615D0857B408C96C42F4D304DB2FF6CFE316A90BEA68F47676B624C2D726406D3529E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981284, "uuid": "32495a63-ca80-43c4-b4b1-b7889bc82039", "value": "821c455b475c3595aa1e4e6ad93e77fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981284, "uuid": "6e4ca7c2-2959-4dfc-88e0-d24ecfa0d240", "value": "12288:XK05wTHo+PcZ+gAABjGNt/9nusZHxqRqW5z3YSMZz2PbM/yy+f1YO40LAl6qxzhG:X2IyI+gAABjGNtdZPTZ8gKdtfUl6qxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981284, "uuid": "f9ce10ce-6c98-44cd-8523-5186a90d13bf", "value": 894705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981284, "uuid": "dc148948-c8b5-4c24-92c9-5d68508c14a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981284, "uuid": "70c2d5ea-644d-486b-a06a-60165bcf53f9", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.24068.8800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775e9e50-7a2d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699004618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699004618, "uuid": "95d8adc0-6dcd-472e-80c5-b6ee4bfc161b", "comment": "Malware payload (RedLineStealer)", "value": "efa4cd8325e4546ab260ea774d4acc23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699004618, "uuid": "be6229a1-c571-48c0-869c-89889283bdf9", "comment": "Malware payload (RedLineStealer)", "value": "b13a57c400f6768b5d11c671dfa94414c1c1130f840575a19ff15121a0cd3c3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699004618, "uuid": "a9c6c66d-c482-4840-9bee-d81c9e4a36ef", "comment": "Malware payload (RedLineStealer)", "value": "dd1f1879f2c365c92f0b03700443da0c1615e92a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699004618, "uuid": "02edee82-bbb0-4017-9696-0e5ed6c9273b", "comment": "Malware payload (RedLineStealer)", "value": "3d38ac0b08f6673aa1c0e6758f9e280be4ab1f354fae411f4848d8cb3e0f813a260d0577b9460bd9ad3384895bd33ef8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699004618, "uuid": "23409765-6e5c-4026-bf89-812ad32dfaa3", "value": "T19E75230A63DC9763CAB533B069F740430A367C995C69A1AB2795FED609B37C0953233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699004618, "uuid": "e957c7c4-2c7d-4868-9c2f-4ca1252ba8ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699004618, "uuid": "313edeae-6db5-4b27-bfc3-ac535df543d0", "value": "49152:7QHuD8D/mP7f/A/Gwv1nOuaomFwuUwE6:aIe/mjf/A/htOuaP1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699004618, "uuid": "9036def9-f7e2-4024-bdf8-41896ad84dad", "value": 1603584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699004618, "uuid": "2aec68da-6d1e-45c6-bcae-2022b3a41f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699004618, "uuid": "2919a93b-68a8-4154-96b1-1f64429f339a", "value": "efa4cd8325e4546ab260ea774d4acc23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab99a53-7a89-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699044299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044299, "uuid": "24b4e11a-5712-4146-beb9-64feb62e6c22", "comment": "Malware payload", "value": "698d299b604f8750aadc3362290ad13e", "object_relation": "md5", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044299, "uuid": "0b8a23bf-d751-4d85-8fbe-922c8959940a", "comment": "Malware payload", "value": "b13b795f369654dd25bc0ffa2bc26b3d2eb07270df04cfd197ffdf8a6c61cde8", "object_relation": "sha256", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044299, "uuid": "c3f51e35-637f-4da7-9d42-36eb23bfea87", "comment": "Malware payload", "value": "117f5e98644c5e905f9f966d9815bd874d23d6b8", "object_relation": "sha1", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044299, "uuid": "40b70094-bb5a-494e-85da-4bc0b6c697da", "comment": "Malware payload", "value": "5667110c4cf2077cf0a9cbe2f15f77d6bbeb7c0c358a8f3340f6d9d8be9d62a4727338e88cd914c44bc194d7fadd4810", "object_relation": "sha3-384", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044299, "uuid": "81af43c3-366f-4978-9b04-1a639e58935f", "value": "T118B4CF7AFEC199859732B90BD2E7C6CD8F41825A84BD4DC704C93438EEB79815BDEA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044299, "uuid": "f2872d04-cf2b-411d-bda2-16ef0d91e0ac", "value": "12288:6zEvFgmuqkZTltA7XIf3y5ByZErTWERji:c8Fg3qqtEXImGEr7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699044299, "uuid": "43743306-a629-4cb2-b461-6ad2fbda93a2", "value": 501150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699044299, "uuid": "d1787367-5c27-4915-8754-71b0b98ca4b8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044299, "uuid": "748b4f5b-c869-411b-b4eb-5816a9ca35a3", "value": "script.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007f5481-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1699028041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028041, "uuid": "b776fc49-7821-4a0e-adc8-4ab7b0565ae6", "comment": "Malware payload (RemcosRAT)", "value": "a0cfb10e0156a9f6b759e58869cd0abb", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028041, "uuid": "c8aad051-196f-4f96-8a69-2514675829ea", "comment": "Malware payload (RemcosRAT)", "value": "b1ca8bbed94ba2690e722c88c1af75082b8a4abf9d7f70206f986746aaa0eae2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028041, "uuid": "5bebff30-ff9e-452e-ba28-7c60a64ae9d2", "comment": "Malware payload (RemcosRAT)", "value": "ac4a2366746afb46b33d37911aa38cb2baa339d0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028041, "uuid": "5e2f8ab5-b73a-43aa-8787-1f55b714fa49", "comment": "Malware payload (RemcosRAT)", "value": "7af78a9b6d16ef9b8369289c61b300a67b67de64d866a6d51cabc1bfe53cfdededd839f0ab356c4082b24864eb30e0b4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028041, "uuid": "b72a0bbc-c06c-4813-b9b7-e9fd2ca5410e", "value": "T1B2B5D0E2935C8872E46B3A7CBC853AD03174ADF4AC0BA8CA459C6E5A1E74B707D7540F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028041, "uuid": "cac7b3dc-112c-4536-8480-9561e44b220d", "value": "aed486c97a3056cc8315be050383ea24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028041, "uuid": "fc93182b-2bd3-4b98-8323-5e9313025927", "value": "24576:IZvkwR6rJQo6sObXVFvGkpyct5iWHANjQyedWlRfTDvxGl3/TVK/xEgGz20w69JH:IPrFvGkpy2glNjQyewXk/gClA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028041, "uuid": "6aa46869-6f02-4093-90a2-6093f5e960d9", "value": 2434048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028041, "uuid": "c4a26526-d0c1-40ce-b532-8c846f46086e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028041, "uuid": "2a6360e2-a30f-4a0b-877b-bdf72d5ce58b", "value": "docs-0311.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4201aa15-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698998087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998087, "uuid": "be77e931-8b50-4595-914c-dcc3fea37c76", "comment": "Malware payload (AgentTesla)", "value": "977a1b62661c1849339aedf8a794d551", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998087, "uuid": "80695f5d-e79c-4691-83cd-090af6ca3e7a", "comment": "Malware payload (AgentTesla)", "value": "b2436df85bd09d9aeac01c9f7e9b0ba093ad117b8444c99fed71db13ce86f95f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998087, "uuid": "4c81b555-0cee-4dd9-b712-c475665d7233", "comment": "Malware payload (AgentTesla)", "value": "c599bc2e1af7ba03e0e90e5ee2a55b1f4378c44e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998087, "uuid": "4ea5e36b-a42b-4168-ac8a-a5361629e934", "comment": "Malware payload (AgentTesla)", "value": "f1bf0957d45ae8223c3ec51108dfa7eb6b32287404633c4582a382e64075da60449667202c3c06075ac885191276e6d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998087, "uuid": "2ab1e0fb-2dea-4219-b408-7df90be51a2e", "value": "T13BC4234176B90E19CB78CBF5A6B65140437A81260FF6DB5E2DC932CA07E3F941BA1783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998087, "uuid": "6ad85c11-88b9-4de1-b6f0-c76606454443", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998087, "uuid": "854bde1a-2352-4895-815d-a3e9c918c38f", "value": "12288:d8o69yqL+zsFCtuJvVDV939YZlrXI2MFYV7+:d6Xyzs8uvfB9YZZIlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998087, "uuid": "faef07a3-f609-4189-987c-1177a65e928e", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998087, "uuid": "6d2bce5e-b383-421d-9d3d-4be9bb4205a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998087, "uuid": "552c43f3-344f-4a69-b38a-ac61b55df59f", "value": "HAKE METAL \u0130\u015eLEME SAN T\u0130C LTD \u015eT\u0130 TEKL\u0130F TALEB\u0130_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305769df-7a22-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698999775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999775, "uuid": "7c7b3490-cda7-402c-9a2b-3abc6507cfd2", "comment": "Malware payload (PureCrypter)", "value": "ee6b7e795cb0641686f1fb4630c72ce2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999775, "uuid": "5c331b59-6221-4222-b302-f194e2abf596", "comment": "Malware payload (PureCrypter)", "value": "b2a9f63fec49f5e805eab225ed6fa19f0167996cd17a7b2d57e5ba5d9bb0f99e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999775, "uuid": "91047d9e-fa8f-4425-8f41-bd3c08a77033", "comment": "Malware payload (PureCrypter)", "value": "ba4adaf0f93024f0785b069905150a79456a9e41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999775, "uuid": "913ffd73-b381-4e2c-adf3-5b8bfcc745a7", "comment": "Malware payload (PureCrypter)", "value": "45e6a8c95f9c46501c630b407dc7108d307a17ba919f8dee68931343fe87e4e4bdec7b9b2bb2555f147d2a2a1c31706e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999775, "uuid": "063c7682-4ea4-4976-af17-8dc38abd6605", "value": "T15EF3D507B6A689B9CB99173BCFE704044365E58AA693D7097E8F13E90B037B79D00787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999775, "uuid": "f917ad65-5a46-4b5b-b292-41b73da6f635", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999775, "uuid": "0e734dd3-9e59-4131-b82e-ab780a6495c5", "value": "3072:39GqYMwpm5UspfNVE/wGC481l9bNydMh3PizZYph7nKq:PY3pm5Uefr8wd481l9bNydMh3PizZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698999775, "uuid": "5309c742-0e04-40f9-87f7-7347d21d932b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698999775, "uuid": "f8a08d32-b7db-4619-9a21-4e10a5266988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999775, "uuid": "2202570c-1c5e-47f0-bcb1-e680c0eafd84", "value": "SecuriteInfo.com.Win32.RansomX-gen.20200.2551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e94f67-7a3c-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1699011277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011277, "uuid": "6e428176-cf44-46a2-944a-92649f5b1828", "comment": "Malware payload (SnakeKeylogger)", "value": "51f6118768817fc6e37caa27d54199c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011277, "uuid": "fb6f6219-830e-4967-952a-ab84d0a16874", "comment": "Malware payload (SnakeKeylogger)", "value": "b2da4f36ead1b8678b0390e81af0b55b0681776ff272e0250545fc0a0f074bec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011277, "uuid": "ee036a1e-9090-4576-84f6-b3a5b1fb7d8a", "comment": "Malware payload (SnakeKeylogger)", "value": "9d0052c2a2c1b001d65872e91c34b85c5f01808d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011277, "uuid": "6ac1a13a-c88f-4655-bd62-4d052768d5b6", "comment": "Malware payload (SnakeKeylogger)", "value": "45f9bd0cb9275181605466bda32937056ef39760bbec773ccfdfdaba3dbe18e1700a0ab473e1f9c7aafae640f4400359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011277, "uuid": "5b304351-9583-42b5-b4c3-9836765e2bdc", "value": "T16D747403F78AF9B2E23603B6D4A620648BD0C581E7ABE6067609B7D79712795FDF0107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011277, "uuid": "885f4f28-0f51-443b-be69-7f9c4727ac47", "value": "6144:8NwwX8Ok1yGNiWH4Tk6oYaFogQHzMVieJvqhaV5aQWMyvT0n1:8NfFk1TNfHwnoYZgkWNqhk5aQWMyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699011277, "uuid": "b435812d-190b-4028-897e-a75e91aad0d3", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699011277, "uuid": "972d6fea-d2f2-469d-a8f7-d8e7e94d52e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011277, "uuid": "ecc5dd66-80ab-4b9b-b3d6-1c2d42361f3c", "value": "b2da4f36ead1b8678b0390e81af0b55b0681776ff272e0250545fc0a0f074bec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4d9f66-7a1a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698996599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996599, "uuid": "6ec71757-ece3-4474-a176-813dad79e292", "comment": "Malware payload", "value": "231824291460708e1c45b5a4b7a9525c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996599, "uuid": "90768540-1c90-47d5-a701-8bd90334764f", "comment": "Malware payload", "value": "b36233682a1ca0fecbddd480a9db23f157f6569d157c5d45cd91ccaa9d591959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996599, "uuid": "aed2aa15-11eb-470e-957d-ae40d87a6782", "comment": "Malware payload", "value": "53323e62a3e141503943ac96b0e666ebe2c49066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996599, "uuid": "cbeb780b-7c20-484f-83c2-c3fcbdc12b4f", "comment": "Malware payload", "value": "2c704e210e1917d31383b3c0c8f207999fe87c76a016cda4a11f20814e3ef774c8c751539a95cd5f42c8ae573b5a917e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996599, "uuid": "894ee2a9-4fee-4321-8f28-0dd6e13e0148", "value": "T19405B307BA4B86E2F26D17B2D5AB1C109361D983732BE70B788E237655733A68CC550F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996599, "uuid": "34429dc3-97ce-4938-9cf8-097d072cd823", "value": "24576:QOUplsaS9Dl9E8BlBIDwC3vNUoZJscaBDwc:E27hm3oDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996599, "uuid": "dd9e0ea8-57f7-43d0-a22f-c540626e760c", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996599, "uuid": "86367dd6-ee38-4bf2-b0ba-17b3e39adaea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996599, "uuid": "f06e98a2-480e-4120-a585-40babeafbfea", "value": "Cnhssppi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e62d4e-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981267, "uuid": "c092e1a8-a6e6-4c0e-90d2-fe5644e959fb", "comment": "Malware payload", "value": "53ef14df35cd281941414d85f40588fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981267, "uuid": "788b4527-535b-49c8-a829-6e6f09dd966d", "comment": "Malware payload", "value": "b4a57873984bbbb50effcf6b769e593956ed9c88140829aaae57374861caa5fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981267, "uuid": "180c05b4-fbb3-48ed-bc20-74000795cddd", "comment": "Malware payload", "value": "a82ae20541446a9bb4209c1f1886c2d9b1d7d267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981267, "uuid": "5da4b9ee-e1cc-4624-adcb-57cca52e7c1e", "comment": "Malware payload", "value": "85a1cf52533bff3009de0309632df955fd61e4b4722ec5143ee2f7895349bbb84a1fd1e549025fe2e8e4aa0afaa9f2f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981267, "uuid": "a9b1c467-ee0f-4cfc-ac36-c91698c00551", "value": "T1E9122987EA0A54F7EF40157B0DBAAA6EEE7AC445022D7E83DEE46D0558312F4DA5C303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981267, "uuid": "e1761d91-d639-4cd6-a862-be47635bafca", "value": "a33c0c9043eb309725d06f84c039c662", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981267, "uuid": "aa03c082-c78b-4c7a-a76c-abdaf7ca2be0", "value": "192:iewcylS7iBVqiogBrKiRxV1BG4FAxZBT7GgK:yxtVfoArxh1pAxZBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981267, "uuid": "95f16a1c-ad52-4311-8bb0-3af4643b68e8", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981267, "uuid": "8a11ab07-855b-4b84-b650-dff35781e082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981267, "uuid": "11ddf683-ca9e-4d7b-adf2-b41ec7d65552", "value": "SecuriteInfo.com.W32.DistNet.C.tr.16060.4680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a75f71d-7a17-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698995094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995094, "uuid": "2455e6c7-cafb-4dea-9cf1-6c023bfb5c36", "comment": "Malware payload (Formbook)", "value": "cc1ed5e76151391f2b04d9c3101978c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995094, "uuid": "bf47cf62-1044-4007-ba9a-2c780f4f7439", "comment": "Malware payload (Formbook)", "value": "b5081a6bb5cd550a99f314c6dd7e76cd217473ddfec2f65c1b5ec13a000680b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995094, "uuid": "85a77789-b1b4-4efd-a731-1bb748060dbc", "comment": "Malware payload (Formbook)", "value": "683e13d743f2d9f728fb91ba4a14c7747892f752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995094, "uuid": "917292a2-26be-4204-b94a-1b89cb2fcc38", "comment": "Malware payload (Formbook)", "value": "278196a0af478aebfa07556d0fdf701b76b9891d23e30030c1857b0cd445eeebf381428157fd722c19fe6764d9ebb818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995094, "uuid": "5b99f22f-3d7d-4f81-9522-8ca749a10a05", "value": "T1C605BE12B99ECEE1C29E57BBD696C414436DED71B652DE0834BE33D8CB733A2D900606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995094, "uuid": "9801c028-0326-475a-8a23-8271b4b43fd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995094, "uuid": "dd66a2ee-e972-470a-9e13-c79830cd01d5", "value": "24576:drpRB5aT0VhGHxcECMzoIoekZoROCuDpc:1pRB5abHxGMzKZhCuFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698995094, "uuid": "88b29a5b-b7cd-4376-960f-a16bb0937d96", "value": 812616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698995094, "uuid": "764c90bf-50e7-4c45-bb85-3ff9bc46e307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995094, "uuid": "d3743e1f-3d65-4cb1-aeb4-994a95ccd682", "value": "PO 876-1057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc631db9-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998292, "uuid": "10c28962-fada-4d3d-b8c1-3d2f4bc349a6", "comment": "Malware payload (Formbook)", "value": "67e9aeecebbbc227aa69898b02c634f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998292, "uuid": "c8e02c33-5ab5-442a-9fa3-4379346ce72d", "comment": "Malware payload (Formbook)", "value": "b59acfb5b280cb3a10b0fc0d758187750063096dc6690b6d2541ad036b816acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998292, "uuid": "9bfb6500-256d-4728-9f4a-0c605a3346e8", "comment": "Malware payload (Formbook)", "value": "3d1a1d9f85995fcc952acd093c49294396a6ff61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998292, "uuid": "f3e2ce08-15ef-4f7a-883f-a8015b3a02a5", "comment": "Malware payload (Formbook)", "value": "ff0fd0d17498a146d3df557d603bcbfb8745460877d8ea1539028c27bf7748edf1da4801412c1e31a21fed7f398d946f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998292, "uuid": "3b3cf883-11d6-45b0-9a40-2af72c105f08", "value": "T1A1D40117BB25EFB9D13B47F63C11941046B5EE1EA860E75868A637E29C32703807DB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998292, "uuid": "6dab40c3-ae6e-4a72-82f9-fe377e7843cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998292, "uuid": "a4d0ab68-7d89-489a-a676-abb71e9b0e81", "value": "12288:CbWJp09HUmSeuRx8OHQ3SEZA4leOSd7q:CbF9POKZAZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998292, "uuid": "cec33ddd-d134-4f42-984c-1a4042da53b4", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998292, "uuid": "fee9c053-d2d2-4e9a-81a8-abb13b3f457f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998292, "uuid": "ffe66d69-0f13-4314-8572-daf49be75e05", "value": "Rockwell27-08-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fff7af-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998284, "uuid": "297b21b1-5025-4401-9276-2f24ac313a28", "comment": "Malware payload (Formbook)", "value": "6b0f770c2c1dfa58421b296e6e37d6cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998284, "uuid": "737d8328-8eb1-49a7-9083-f31562a3ed3a", "comment": "Malware payload (Formbook)", "value": "b5ce2b1141fc91ee21782561b83b5b04ead26e000ef1889aef775ce57ad3bd43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998284, "uuid": "428c48d8-6e56-451d-8af7-6d6db4279a5e", "comment": "Malware payload (Formbook)", "value": "e7ab55b92db933a651500572b5fcd33f8213dc78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998284, "uuid": "0f2ab0f8-c059-4aec-9648-499593f7a94d", "comment": "Malware payload (Formbook)", "value": "5f71031b1c7ddbd42a1a940704fa680950b030c42ec1b97dd70425149a6c93b540c11ee7cb365c3237b6e51ed66e39b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998284, "uuid": "0e365069-3f5f-4f90-9273-fab91fa37b32", "value": "T10394DF06AFB2EE71CE71053F8745733A6F6E6E9091F1394A3218B6653EB9C01D908397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998284, "uuid": "4a43330a-8b8d-448d-981c-fdcee9f13542", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998284, "uuid": "c17bff1a-a9f4-4528-8719-75b6b11a003b", "value": "6144:yYa6mS2elf/nkqZ6RMWQc4uit0jw9i+7OLi8Vo7SB2rMf1MG:yYkelf/RtWB80c9isOL1B2rMfGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998284, "uuid": "466e4070-5c18-4122-8011-65259ae6d3e3", "value": 438205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998284, "uuid": "df0d1450-747b-4398-aed3-8e2ce875ec05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998284, "uuid": "0ddcf223-e393-475f-b5ad-c44675a0b4df", "value": "6290507462-20210204104222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1d6d70-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698998046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998046, "uuid": "b1aeb783-8398-4a9c-ac83-74ec9df07712", "comment": "Malware payload (AgentTesla)", "value": "8fa36c749a4d5cbc370a4ba479ef73e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998046, "uuid": "714ba63f-b05d-4047-ac62-99f77bfc9d47", "comment": "Malware payload (AgentTesla)", "value": "b5eb7b358298a5f4c3363203ec34d338c24088ea8ab2aa79b7d3f068cad42963", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998046, "uuid": "dd7b2981-73da-4a0e-bf13-1fdf13791b64", "comment": "Malware payload (AgentTesla)", "value": "1d9965e42823a5455f714f7793de6758563dca21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998046, "uuid": "2e0a8c87-6658-4053-97c1-02583b7dc488", "comment": "Malware payload (AgentTesla)", "value": "78ebb9df96b7a3b83172aa5115fc45943d3bce398e07611ab811a4fc701c4ad3a3ffdc7720bf5f9b222b4dcbd04738a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998046, "uuid": "a8666cfb-b1fc-41ea-9497-113a4ac571a3", "value": "T1BA0502217AC089B2D4B2283917F597316B3CBD302B764EDB97581B1E9F301D19A39B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998046, "uuid": "952a65fa-de29-4797-9d95-307f439eb915", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998046, "uuid": "d8312178-426d-4541-aaac-9a59db94ab95", "value": "24576:5OtT5xvEeTl5CUhO4gyGg7u4Rg/379C4ec:5OtT/Tl5CUE7g7uWy379CY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998046, "uuid": "6086b3c3-7c00-49f0-a8cb-f01ecc8b7a3e", "value": 861951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998046, "uuid": "9441cef6-5099-4940-8f6d-bc9e888db570", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998046, "uuid": "4d3a2803-077c-48a5-8fbd-f9e03014196d", "value": "DHL DOCUMENT.sfx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2384dc-7a63-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1699028036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028036, "uuid": "6c3cadc2-e4ae-4767-941b-71028fd40206", "comment": "Malware payload (GuLoader)", "value": "44370aecc3425cad9d37a16831ef32ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028036, "uuid": "5143ff13-2d4d-4795-b42e-c50a6960d72d", "comment": "Malware payload (GuLoader)", "value": "b88a5b8c804822d467f30b800c594d0df466cda554045679d3917d8a4e8560e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028036, "uuid": "3b78ccdb-8f85-4a15-8729-6cdcc620035c", "comment": "Malware payload (GuLoader)", "value": "749167a549d24a9224f53bc61510f755e4db8d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028036, "uuid": "c6ea677f-a624-4eba-92f2-f3ab5b9b4c44", "comment": "Malware payload (GuLoader)", "value": "bf40d0d8502593cceb9ff008fe236ca7d9c846d658701a4ef315033202bb5b34e8dd0ccccea3c27b3771bae735659422", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028036, "uuid": "d548bb12-e6be-4e02-9cd7-dc85e96684a2", "value": "T12EB46B7163D79CFAF42732FD78B684102457EC1B45E8420AA66EFA3891BB31168F7907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028036, "uuid": "192420e3-e0b4-4b99-983b-34b1b1dc743c", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028036, "uuid": "c31c6156-9018-4591-bf66-9464e15e0555", "value": "6144:cWhUjjO13a1CStqiE4pLYVqGyZ+lWpTCA2vsRnSPkTOoEp+IChSY1IB5xQTDzEfu:3e16FTA2vqSfYC3QTDzuw/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028036, "uuid": "3e6b7e4d-904b-4b75-8c9d-a7bebd191c0c", "value": 537309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028036, "uuid": "82eae3ba-537f-4b19-836e-a63f3a3cfd57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028036, "uuid": "1312697c-f1b4-43e9-9024-ef4f1efe682c", "value": "SecuriteInfo.com.Trojan.NSIS.Guloader.26526.15163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d08bd02-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699032921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032921, "uuid": "85afcb85-cc39-4804-9f7b-151563fa147d", "comment": "Malware payload (Mirai)", "value": "3df26be45c23cf7564f788280dfe3aff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032921, "uuid": "798669fd-8fe7-4acc-a50e-88f0825302e1", "comment": "Malware payload (Mirai)", "value": "bacaa90a96ffad4e65d707595733951f99adb1ace1b40c65e9b5f74bdc0f7366", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032921, "uuid": "2aba5631-1c56-4afa-b5f6-af0416f15f4d", "comment": "Malware payload (Mirai)", "value": "57bb989f2e2f2dfd5efb4ab27630369fa461e315", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032921, "uuid": "b3068f8e-6297-4ad4-9c2e-1742e1cd3fe1", "comment": "Malware payload (Mirai)", "value": "1fb6935717368288df48a80c6401a897827b94db34810ab1d5c125f9c5310be865f315b5388b95c44a037f7054c679fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032921, "uuid": "c4d01da2-9c7b-41e1-aa63-d991ca230cbd", "value": "T185334BC4F543DBF9D84900717032EF369F33F1FA226DD997D3995A32AC92602A506A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032921, "uuid": "104550e5-978f-4be7-b915-96f6303a3367", "value": "1536:vbxZ+QmM0P+IWFWidh8dsatrsukc0iIBYF0x5L:dZ+QmBto9BPBuEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032921, "uuid": "ee626b9d-3f24-4e90-aba7-6c6d9c8d7ca8", "value": 51508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032921, "uuid": "60447386-e9c8-4491-b85d-dbd686921b70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032921, "uuid": "546b9543-5821-4073-bf0f-2cae81095916", "value": "3df26be45c23cf7564f788280dfe3aff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f538185-7a8a-11ee-8907-42010a9c0042", "comment": "Malware payload (Glupteba)", "timestamp": 1699044468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044468, "uuid": "e88e0656-0c39-4dfa-be68-69c5429c6c0f", "comment": "Malware payload (Glupteba)", "value": "25d28a6ab24450e6664793352ca2f84c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044468, "uuid": "cd8cc9c9-2d4e-4c0c-8c30-0faed9eef11f", "comment": "Malware payload (Glupteba)", "value": "bada456f7b51709847d11d6b7d17a2e1d4322dec3c36abbd87ed594242ea2b59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044468, "uuid": "0872cdd7-6f25-4bbf-aaf9-08e7b6ee0859", "comment": "Malware payload (Glupteba)", "value": "94e74bf2d109b5709acad9f9f6fddc607241e787", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044468, "uuid": "8a0ee645-7c63-47c7-93fa-5498186584df", "comment": "Malware payload (Glupteba)", "value": "c8d5bd34bf3e623053ecef1c45f450b32c2040a038c847e08f583fc1abc0f4a788e194dce2b79f7f8578626985654b1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044468, "uuid": "ed2743cf-8d1a-42ec-a09b-9d4db486238f", "value": "T1E716331391917C36F22A47738F9B87E8F61EFAD09F556F9B2318592F04B51A1CA60F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044468, "uuid": "5fb81c6a-32f4-4b9f-b934-cb6924222fcb", "value": "92608fc6b2e4b19ba939ff3327438f0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044468, "uuid": "6ec06476-8444-4251-be51-f58ec9574174", "value": "98304:n6oKpofZdzwjcQuXGGlGIsQRx3kr4oG29oyLTUmQAuYgDKg7g9+N+gj:n6bMUjIXJGIf3kgVyLTUm5wDgyHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699044468, "uuid": "2c2453b9-9f2f-44fc-ac5a-835917e4e6c0", "value": 4344176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699044468, "uuid": "ebdc1e25-f2b3-4a71-86e3-dfb598fe12b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044468, "uuid": "08deed95-14c5-468f-89d1-a67b40d5e4b4", "value": "25d28a6ab24450e6664793352ca2f84c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c165b38-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996922, "uuid": "1af7be3b-07fa-4856-8427-91a42bf6c846", "comment": "Malware payload (GuLoader)", "value": "0a67bdcc2fef8027355492d43976051a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996922, "uuid": "f1ac2603-a5b8-4039-900a-922895b479c0", "comment": "Malware payload (GuLoader)", "value": "baf63e9b18587a73500a3b3d4bc922eaecefe62f4d76933a649eae771f1d826d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996922, "uuid": "718ecf36-cf08-4108-b93a-47540a1758e5", "comment": "Malware payload (GuLoader)", "value": "fb62ebfef6378427fb85a3c3591ae20759a3748b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996922, "uuid": "3c41acbe-cc3c-4b68-b784-22862f445501", "comment": "Malware payload (GuLoader)", "value": "e8263438f6cd33066adbd346f448054a9371e4b5bccc3429a795c2b6c23054f15e17caae1fd2c32735b7c31aabbc884e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996922, "uuid": "7ee94be3-0d06-4137-b474-c0cb1df9af8c", "value": "T1288502B2177441BFE0365A78A027FA6BF1816CA687DE12C5EE87FA5D0F73C06914181E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996922, "uuid": "d46ed587-c973-4734-9060-3c95dd522c23", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996922, "uuid": "b27bb773-cc1c-4beb-a402-41f16503bf98", "value": "49152:r0ER8cGD1XnSUNpYdweNhWf2/Lc3fk62miin0lNa:r0EUzNpYdvWu7cnua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996922, "uuid": "552c9699-7398-4e7d-9741-790deff09c37", "value": 1862433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996922, "uuid": "e22e7f24-b3eb-419c-aaf6-b828d5d47a4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996922, "uuid": "b6605215-4e92-433d-b4ac-5190676ef8ac", "value": "fact098654567890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184741dc-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981266, "uuid": "c5bf79b5-20ed-4077-b2f7-ce9052c48ea3", "comment": "Malware payload", "value": "8be62987215770b08892d6efc12b4ff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981266, "uuid": "6dbecdf9-14b3-4b82-91eb-002a3a14a559", "comment": "Malware payload", "value": "bb288aff44f07795d3ed4318e2175afc0324f533293511357f8ae7e273375452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981266, "uuid": "e77a4c07-270f-435b-aad7-865e631e953d", "comment": "Malware payload", "value": "786a6d43f1211301aed1b1231e7685990fb69055", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981266, "uuid": "c8addc7b-6826-4d8a-a9fc-e41de075a3be", "comment": "Malware payload", "value": "8e2a58b10c704249a5f0948199c762ce9bd6dd740b2c1c698505c0d6555921f3dd42efd1481d3774d312efd355e8fc42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981266, "uuid": "d2d329bf-7463-45fb-8c18-57cafcae995d", "value": "T12C63E0417B19C6E7F8FB07B60D42456A022AF37D1E2F0FC72140874FA6299DF09A99D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981266, "uuid": "792e6dda-3dfd-43b3-97d0-8a271cd6e436", "value": "73ec795c6c369c6ce2c3b4c3f6477daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981266, "uuid": "b822b04d-121c-4d6c-be9b-7fc596ec4017", "value": "1536:zYnOJaUPlU86Mhr/JuBQZZuBpqxrGLum8aPAKJ4ZlPiQRjPWlhvhcxU1V:z1xIS7ZuBpqxK18aJaZM8jelhZzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981266, "uuid": "480b1d4b-3b7c-4d05-8caf-8ceb1a97c97b", "value": 71811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981266, "uuid": "748f2e50-4d66-4260-9014-d36ba22eea0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981266, "uuid": "7555e1d3-0a27-49b8-a0bc-0d1cee84aa23", "value": "SecuriteInfo.com.Trojan.MulDrop4.54205.26050.4852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb48af8a-7a48-11ee-8907-42010a9c0042", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1699016409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016409, "uuid": "28bab45b-ec84-4bfa-bb06-0bdbabff470c", "comment": "Malware payload (YellowCockatoo)", "value": "1721d5471545dc000a9eed818486f7cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016409, "uuid": "bcd6c739-f3fb-47ba-b8cc-94dc434b73d9", "comment": "Malware payload (YellowCockatoo)", "value": "bc26b9e97ff87505956ade79f05be5d6d1ac7fcebfc1d7b6e8c463b6ac3ca080", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016409, "uuid": "a980f12c-af54-4059-ab45-7faee6547a6a", "comment": "Malware payload (YellowCockatoo)", "value": "797c48f2e7abb80c6091c8cbde5bbaf629e6dc2f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699016409, "uuid": "2874f9a6-d8b0-4b27-839e-b2916c9ee645", "comment": "Malware payload (YellowCockatoo)", "value": "d5e0cb27587baa2f4051be08c59d9cffa266c385fe80739e8277cde797cbfb4a4b1b024637f2d7343d1ba8bab0aa6746", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016409, "uuid": "754776fc-7e71-44f8-8f62-1410eeb1cbd9", "value": "T1FFE4DE143BA4CC508B2C56E968DB93079B2756A7EEFBFF1306A281740A1B86357513CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016409, "uuid": "6fba3d77-1e39-4a97-bb5e-880ac2b41df5", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016409, "uuid": "4a923b8d-b8e9-4dc1-9f5f-0652fc16759f", "value": "12288:FPzomFRlnMaQkTjSSEdhNnhocysb2Ejlbn3S:JkmFSyCbyrE53S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699016409, "uuid": "3c752dd2-dd21-4e20-a728-5310f3e616ba", "value": 715280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699016409, "uuid": "6500d8fb-ea7b-446b-98d6-e9fea9bc86d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699016409, "uuid": "3988b609-a6ce-497a-8681-d7a888103924", "value": "NABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZi8ufvDOMSTWE4hVSVQWTfIGaIbeFtRSsQSam4sEIQ9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea62e5d-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996819, "uuid": "7516cd3c-7e14-46ba-a4ff-0c812d4e86f3", "comment": "Malware payload (GuLoader)", "value": "1eb13546f1305154d9947f54ad57d530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996819, "uuid": "12b488a0-eb8e-47e7-b909-9cd5bfa281b2", "comment": "Malware payload (GuLoader)", "value": "be686699584d9bc6b1fcc8c901b4b27a36d03f992e6e976477752957abf70a00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996819, "uuid": "661424a1-5676-4d74-bb05-b8482fd3db02", "comment": "Malware payload (GuLoader)", "value": "bd605def8fa0bfd383ba00bf306053fdde06f26a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996819, "uuid": "1e14791e-58c7-4951-9e04-a9ab8babeb54", "comment": "Malware payload (GuLoader)", "value": "060bf9c57e61e7b9450ce6437c0a5b5d7a38bda2b7123cfe8ecab6a99ecd0aceb5d8a4413a379f0b9ce2d6e104eff295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996819, "uuid": "fa3f8136-5e3b-4ace-83a5-a788efd1a878", "value": "T19D8502B2173402BFE0255A78B067F66BB181ACA6C7DE12C6EE87FA5D0F73C06914151E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996819, "uuid": "f15b9fce-2b88-4ecf-a3e2-19c65b54dfcd", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996819, "uuid": "bea499b2-b36c-407a-936b-b15c37b00028", "value": "49152:r0ER8cGD1XnSUlTX1rhtmdweNhWf2/Lc3fk62miin0lN:r0EUzlJltmdvWu7cnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996819, "uuid": "57b25bb7-406a-4efb-b650-156536b475e6", "value": 1856700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996819, "uuid": "4b6c23f5-b646-4431-85e7-986dedeb89ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996819, "uuid": "2756153c-0b33-45af-9cef-e9cf2dbc9e8a", "value": "1eb13546f1305154d9947f54ad57d530.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32d923e-7a1d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698997927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997927, "uuid": "adff08f0-44bb-493c-a9a1-73035e74ff69", "comment": "Malware payload", "value": "ee376bc029c176929aa18e965677e956", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997927, "uuid": "9a8804e2-b211-4224-a373-d7e26b6e8437", "comment": "Malware payload", "value": "be7d29f555c5228d1db89c96986a03a2296e42a379962702693c90498de77988", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997927, "uuid": "850b94c9-beaa-41ac-9e60-51ed16daed0b", "comment": "Malware payload", "value": "f36b7b0a4efae98832cef4ed8e8ee2549448095a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997927, "uuid": "ce644240-9c71-4b7c-8199-aa6b1fa712bf", "comment": "Malware payload", "value": "5d2ffab09f319a309975ba5273d98e0839f75d5413914e1670272c0e17e1cc9499c7047c63ec1e37fb82411111f67fdc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997927, "uuid": "210a2d39-1a78-4ded-993b-1eebaa923bc1", "value": "T10E123209381A6C6AF86325A270BA7CCF0575F3A942D8587525ACF5BBEC2CADC35708C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997927, "uuid": "1a858637-93ab-4165-bc2d-1fa25094c9c3", "value": "96:NFhahrkpNctlTlM8knaje4xDNpF8aM8EzhelvsNSOeu975EpdKNA38dao/6C:LkjTik64xDNQxgvsNSOe87Gp4NA3OFiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997927, "uuid": "d5fe9573-1c60-4398-b0a5-417669fe8d4c", "value": 9860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997927, "uuid": "56186940-c824-48c0-8e46-7dd1a282962c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997927, "uuid": "5308c33f-b8aa-475e-b602-f07d218b8ad4", "value": "banezhteb.com Secure Email Setup(IMAP).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07b5b62-7a96-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699049811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049811, "uuid": "03092db0-2404-4a4c-bb5a-d431f6614a84", "comment": "Malware payload", "value": "be3f593519768fd8aab56975bc934b12", "object_relation": "md5", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049811, "uuid": "47a3c863-5ad5-4f99-be8e-2222b3d7f22f", "comment": "Malware payload", "value": "bfb5e2e224de3c24e5d762caf8a1dbd500333065140d1743c5bca0475b3d3fb3", "object_relation": "sha256", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049811, "uuid": "f2cedec1-ae98-40fa-897e-bb4543bc34e4", "comment": "Malware payload", "value": "fdd0d91b8fde1fd8643a47d097c22d75c13a9374", "object_relation": "sha1", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049811, "uuid": "05a29a86-636a-4ca7-8fb4-9e4c9129c1ac", "comment": "Malware payload", "value": "8b7d8fa81e7884a5b886590687442c5c2c31016304492317ded857254904bca8bbb00860b676b123b04d2c48c57728d7", "object_relation": "sha3-384", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049811, "uuid": "c04ccd46-a5ad-44c6-9f84-a5d8f3ecba90", "value": "T124949D3627F82076E5F6467D273B3B588CBEFDA1E674C41D522028DC5862E29A4F8317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049811, "uuid": "e654da94-a908-4e51-81df-9803df3975c2", "value": "6144:ptxvk6uJVtBDm501CkAp0NJjACVdi3xhhjgbUG8PBFb0i59ODxht2ExmjsDZKNVw:tvPuRB650aPdwI2cZcQ6j1dRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699049811, "uuid": "a4230912-94fc-4c81-b74d-773635a42ae2", "value": 419132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699049811, "uuid": "6dba4c32-d633-4a20-9f63-961f4f2aca8b", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049811, "uuid": "2b02ae3b-41bd-4766-92c1-545f62e61e63", "value": "46C4B4.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef9e74c-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699028227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028227, "uuid": "dcbca00f-2066-45c9-9478-6fda2c2e3653", "comment": "Malware payload (PureCrypter)", "value": "8555a2680414af4683f78a8cdca78495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028227, "uuid": "1ff82e5a-790d-4f33-8161-350b14e33715", "comment": "Malware payload (PureCrypter)", "value": "c13ea062e1f95644caadecc45351ed4b7d9cf18452e25f06aa3dc83262be8036", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028227, "uuid": "0923862d-c70b-41b4-92b2-4ec1789aacfd", "comment": "Malware payload (PureCrypter)", "value": "752dfde6b2b18bcef8c1cbdbb54473c2235c631e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028227, "uuid": "8f3bd1ab-ab58-4f81-8643-d46ffae45e08", "comment": "Malware payload (PureCrypter)", "value": "2765350646149dab6f39d3803484a8621cf34e9fd3b97de26350192a6aa7d587e874200b789f6dee22c1471bebe89ea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028227, "uuid": "98291734-bbe1-4940-9d8a-b2b074c9e9d9", "value": "T1A722C640B7B89423E8248BB09D931691077E7D0338C3DBEFCD85558A6DA07488962EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028227, "uuid": "657e6316-c139-465c-b8e8-34f474cdb888", "value": "192:y7IL+xEnKtuEKehO0S/PFzLZTs253wdDJABOvB/Krdd:PdeA0uz9Tl53I915Srv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028227, "uuid": "d6303452-2c24-471a-ac8c-100071e2edc2", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028227, "uuid": "f1c12d11-6c55-4c32-8531-7a4fab311787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028227, "uuid": "0a0a13a1-994f-45b3-b9ff-441196fcc20c", "value": "Uuxcibejso.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d28e10b-7aa1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699054396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054396, "uuid": "6c7e7195-17d1-4aea-ab26-58000e68c058", "comment": "Malware payload", "value": "e533f71c253551d1be4ad5ffd52fb793", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054396, "uuid": "fdb0dc2e-f5fc-42ff-89ee-16e09f5799cd", "comment": "Malware payload", "value": "c1bd141a8c2a27b5c7318229556282a4259a9caba1b3768ec58a83dc2d7afdca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054396, "uuid": "19e168c5-3554-4e48-a5be-c9d99a447dae", "comment": "Malware payload", "value": "a38cd558106de33fad4e132021d350273e6b4639", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054396, "uuid": "88f79d67-8054-4a3a-b724-edd83bac30f0", "comment": "Malware payload", "value": "4b7d830067e7a4e01c02c869c7fe23de15958c7d4e5b739b48d12cd0833ee627b3eb460cc5afd18a6ac5bf31e45eefa8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054396, "uuid": "58e6493d-a3a0-4cbc-be3a-d166852253e0", "value": "T143463309D40D51A3F2912B74D46EE7B729AA4E508EEA0C2BB9E1BDBB313D51739317C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054396, "uuid": "d7f49a47-4107-4dc1-935e-e8187e3f5c42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054396, "uuid": "7cd61e73-165b-4190-aad5-f21d9437276f", "value": "98304:Vi9vWWTILsbKEAYwwg3zhFCvjrIGn6kfL9b2mGz+PkUQXxIhdFuPK0zWRNaHw:VIvWWTIpkwVj3Cv4BypbBGuzZAWR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054396, "uuid": "8da8f827-0291-41fa-8217-5642cb7222a4", "value": 5509120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054396, "uuid": "09485664-cc13-44a3-81b7-307fcf71ca94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054396, "uuid": "28ac29ff-3f9c-4460-ba60-0bc5aa4909a3", "value": "e533f71c253551d1be4ad5ffd52fb793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005202bd-7a85-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699042214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042214, "uuid": "680d20f0-c6e6-4381-9636-485d034a91c9", "comment": "Malware payload (RedLineStealer)", "value": "91dbace5bc17870685f7f8d87fad9965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042214, "uuid": "fa968767-bc60-4037-b97e-0c69a4d58b7b", "comment": "Malware payload (RedLineStealer)", "value": "c212ba48a109bd687a456421a87059d28673e59167fc72016cbf707dd08737a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042214, "uuid": "c8b74323-b80a-424b-bc57-f1c5135a1b8d", "comment": "Malware payload (RedLineStealer)", "value": "0436972e0537dfccc282581e05fdd27e55e71266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042214, "uuid": "07fdf873-5f9f-4667-b698-37a97b6139ef", "comment": "Malware payload (RedLineStealer)", "value": "192d7e192a1564a20a805d52eb0648f25651a4636e5711b9d135ae0df46747a97cfab365c38a98da339cf5308c7d270f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042214, "uuid": "e4e2d27b-4c70-4863-a5fc-190e1aefe2e7", "value": "T142F65A87F99005E4C1AED370C6265262BA303C891B2127D73B51FEB82F76BD4AE79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042214, "uuid": "3b326bbd-2d0b-473d-a1ab-74293340e3a8", "value": "85cddd6092e65c1a58dd1e6e9ab9fc63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042214, "uuid": "ea3de7f4-a1ed-41e4-b268-6e338cfb7add", "value": "98304:8kUPS8Y0zONU+ic3cQfM2LshEcGYPrYq7+:zyOncQfM2LsiclPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699042214, "uuid": "aae0df56-1314-49ac-bea4-0ad2184c9aa2", "value": 16776193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699042214, "uuid": "3284a971-631b-4026-9758-382a83a53c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042214, "uuid": "1e8fc8d9-0a93-4937-a062-3ed92a352b9f", "value": "c212ba48a109bd687a456421a87059d28673e59167fc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429e057c-7a44-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699014408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014408, "uuid": "f297e81d-649a-4a69-8c43-84f4c537db6a", "comment": "Malware payload (IRATA)", "value": "52e0505ce51b682cc07adb1f908a6299", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014408, "uuid": "8df97df6-016c-4746-a3a7-0cbe9044faa7", "comment": "Malware payload (IRATA)", "value": "c2a5899d1a3f36a51971ef6a396f30ac4c6f279da7d08a05ea29c69ba8abdc58", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014408, "uuid": "a8c31fe3-2652-4216-b9c4-eb26eab60c03", "comment": "Malware payload (IRATA)", "value": "6ae307d27ca50d74519d85b163620b540c4fc71b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014408, "uuid": "f267c1f5-e169-4268-82d4-9b31002ad730", "comment": "Malware payload (IRATA)", "value": "1dc0f947b8af59e6e485224b5c0a3ab5415d599959cf20b502511ee6c755010cefc075c4e1cc7c373775800b4af848d9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014408, "uuid": "42e690fb-5854-4d45-a891-5449608fd14a", "value": "T144D52353F673AA6FC831C0327249233A141A8E29CE45FB4A755973B978FBAD847857C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014408, "uuid": "e605f2ba-f2d2-4805-9d6a-04e8b8ea7376", "value": "49152:D9mZCjnmSzphSwNydbf43Exfm5Hwqv81UBZWZrBnyzIUSZ1kSn:Zm0jmSzfXIdFxyHlBZWnnsgZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699014408, "uuid": "1d30de45-9fa9-4b5a-88cd-6e81615ba2d7", "value": 2752760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699014408, "uuid": "09b0c3ea-e351-4dc1-9965-ef49e0904bac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014408, "uuid": "c84ce062-accb-4ee2-9520-c1d4f0d580fc", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a6832f-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981265, "uuid": "db8e54d7-ef83-444f-9700-f0f79bee17e7", "comment": "Malware payload", "value": "c95d21014538ebdcfff21c404a742427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981265, "uuid": "62a2d75c-b5d4-49a8-9e62-ea7369b65126", "comment": "Malware payload", "value": "c35abf9d5fef8f6870d6a414abe545fd3be0d460348a248ba27f06e75904d417", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981265, "uuid": "ca16f77b-b3d7-43eb-a9d7-2f33ae1aee16", "comment": "Malware payload", "value": "8eb15ec98c0ad67221e3f7a0141f910f77f85c62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981265, "uuid": "6973f983-0b28-433c-8bfe-58666e99d13e", "comment": "Malware payload", "value": "adba3bbcc9424de0b282d47cf0148ca03ce7c98fe1c8b6c0d88ca84b17d4535fac4a0a171f5ca42b5d6e57b11dee3ae3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981265, "uuid": "6c68b0ad-9623-4869-b78c-2168bcee00c4", "value": "T19FD5B60EB9831D0FD5D73834057FCB2CFADA668849C254F16130CF6DAA2A60B71B9AD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981265, "uuid": "5414db41-9100-4efb-8614-e25479370c10", "value": "12288:2PYU1gi0BQVKBOkTix6Bg4Y3GgZfLtFBVq:03iQMUd6e4YDTBVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981265, "uuid": "5d3e28ba-11fb-42b7-9c64-0427b7d13afe", "value": 2854912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981265, "uuid": "d9ea6921-d861-4d2c-922a-b4237d723770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981265, "uuid": "7e8211cf-fb2c-4262-8b74-a0ea119c039d", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.20047.8968", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78eead86-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996890, "uuid": "4e5e357d-4788-4eca-aefc-6738c689c6c5", "comment": "Malware payload (GuLoader)", "value": "0047c7766077e6fa3a36b3b0ff708339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996890, "uuid": "43f50d79-fdd1-467e-9c34-0cae68278cf1", "comment": "Malware payload (GuLoader)", "value": "c441d96ca4ba3c11505a600a14bce5d64f7b634f2d40e96d3f5eaa591e7af130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996890, "uuid": "4bfe085b-7a35-4708-8aca-1fbdec5c84c5", "comment": "Malware payload (GuLoader)", "value": "a148fad3d97d10bf18f130b70b2b2910806529e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996890, "uuid": "fe575003-740e-487a-992f-3c872ac9532c", "comment": "Malware payload (GuLoader)", "value": "625f8c673cb56422673e8ca5ec9af5be36d5976c4e606cd08a938aa7b881e870e851478e13c83e081143ab8caf53da32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996890, "uuid": "aca69129-4ad2-43eb-b17f-13a3f1cb64e6", "value": "T1560523917AF0D5ABCBB722744492100EDBF1FD21A16B521FDB143E5CBD37AC28329664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996890, "uuid": "2c8f9a09-d7be-40b3-bad0-e5b5d063bf17", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996890, "uuid": "1560bef1-1c8e-4865-adac-5aae0af5df2e", "value": "24576:INPx3TpS2ZTz6uc1L9J8xVCT5ATqY2BXY6+g7:mBTjz6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996890, "uuid": "8df02637-c63a-47da-be7f-05fbd5323b1c", "value": 871549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996890, "uuid": "65ff063c-aaf6-4c1a-acce-e1f7a714fb8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996890, "uuid": "d95ca9f2-31b2-4520-b11f-b08b37b034b1", "value": "Manchetskjorternes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0a396b-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981247, "uuid": "389bd2a3-72c3-48b2-8a07-f3c3422fd37c", "comment": "Malware payload", "value": "bc63d05604036cc84055bc186a1b9ef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981247, "uuid": "13c1e35f-093a-4383-9af6-e30605c44e11", "comment": "Malware payload", "value": "c45dc6b8a6b01f5682fa06fa9356bf5843f4d210d732b8644b6cd74030602297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981247, "uuid": "675c3972-1452-4093-a66e-b3910231f682", "comment": "Malware payload", "value": "970832b6fce558d9c58e65d22b542cea8f2ab603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981247, "uuid": "7bf59fbf-6b35-45ea-9110-0a71e87e76d2", "comment": "Malware payload", "value": "75c90bb4a040f85e3f63f8a7947427c48f9306ec61fc8f20f036fcd1be36afa5e7644162d458063ebe3a21375b4d07cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981247, "uuid": "eb0db950-885b-4bb0-a414-03b291a993c1", "value": "T1DEF48D03B6D290F5C238213265A6273ABE76F6010E258F93E3A4DE7D6E335509A3355F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981247, "uuid": "a65c733e-c15d-4a6c-8f49-8a783efb9a82", "value": "0b1fd7280a854990ff7ec247b717723c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981247, "uuid": "bed2f55b-03d7-48f7-b4b6-c16684f3e409", "value": "12288:7DAAC8me/3pWYj7cQpfEfrqyeTBCyeYKS:7DAATmI3FcQtEzqyedCbYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981247, "uuid": "6085ead1-94e1-45f0-82e5-a0361ee555f7", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981247, "uuid": "515f55cb-1d5b-4864-ab46-c52ab3ae8c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981247, "uuid": "f1024214-0cdf-45b4-8bcc-6ee14409407f", "value": "SecuriteInfo.com.Win32.Evo-gen.1319.29135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b162325-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996894, "uuid": "4e3ea96a-0e5f-41f2-85a8-3b5ef7cd1e98", "comment": "Malware payload (GuLoader)", "value": "92f69cc7fdc97f6695200a5171c398e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996894, "uuid": "f27328e4-21f9-42c4-9447-636ed50e6884", "comment": "Malware payload (GuLoader)", "value": "c4a1184ec66278ea7d58877555a57aa0c3e25f1782bba8510f9fdfd352cd3892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996894, "uuid": "0236b2d2-a00b-42ee-bc55-c7ff1dc261b7", "comment": "Malware payload (GuLoader)", "value": "c497af0856ba8ca3cbadd1714b85b98a9e382c50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996894, "uuid": "84ea1320-1f3f-4d73-b584-3b3293ac0b5f", "comment": "Malware payload (GuLoader)", "value": "89c578ab13d223b7a33ab3826103040a937ffbd35b45395fbe84be20adf8b60e66c02ba3aaea50602bed187ef6c10aa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996894, "uuid": "8486dcee-140b-4c02-b719-050c41454dae", "value": "T11C05239056E0C8A7CB7F923052D9495DEBF9AE31A5B793178B003D09BC76AC3C2167D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996894, "uuid": "a9674ec3-bd2a-4691-9cad-e2e070bde1d2", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996894, "uuid": "3d069fa1-5b2f-4854-96b9-af6c7498a9a3", "value": "24576:INPx3TpVJ5aPT5L79AZYXutz6uc1L9J8xVCT5ATqY2BXY6+g7:mBT55aPBpAZYetz6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996894, "uuid": "31d91ccf-6c95-4ff0-8e6a-6bd24828724a", "value": 844099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996894, "uuid": "a05c134c-c4f8-4be0-8b4c-1401223aeb24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996894, "uuid": "e6d64a5f-b735-419d-be9e-45a3151033b4", "value": "Etageejendomme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654834ae-7a43-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699014037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014037, "uuid": "07d3a905-4f60-4de8-b12c-65479ba5721a", "comment": "Malware payload (IRATA)", "value": "44b16c09133e68ea777e6a13d7263701", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014037, "uuid": "5eeda0e9-8aa2-48fc-8b48-a79bd1b99b96", "comment": "Malware payload (IRATA)", "value": "c4dcd53206976049573271f81f064bb8787188bfb83163483f57932fb34571f4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014037, "uuid": "83b21395-d244-4505-b545-41917f0b7075", "comment": "Malware payload (IRATA)", "value": "d54b97c68f85a1f2368f580551b2663002d8feee", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699014037, "uuid": "52ec70fc-177e-43f1-ba00-01bf538560dc", "comment": "Malware payload (IRATA)", "value": "5f3b01adf8349b333d6ceaa1efb208f25093f316b724341734014899797b5e16fbdd529254979d5e41ecbe216a5f5431", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014037, "uuid": "118fd8b7-b5f6-4995-97f1-061c2a8c8729", "value": "T1A126E0D7F7E8592FC877907288AE52A1524B4D068E83AF477D48371C287B6D81F49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014037, "uuid": "d0450382-6a2b-40a7-8ddc-6ca5ff5f9893", "value": "98304:LbyZQz7jM0NzrLjw1ghONSeu45gLCrgsiP:kQFNzrLj1P82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699014037, "uuid": "faa0f202-7773-40c4-bfad-da84b5db456b", "value": 4720214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699014037, "uuid": "465a2ed6-869c-4221-bbc1-f66e15a5faf1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699014037, "uuid": "e5c32a5d-a74f-43ad-9139-dc5368bd2219", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0a1e99-7aa3-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699055337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055337, "uuid": "172d242a-8c5e-49b2-b85e-3258f47a42c5", "comment": "Malware payload (Mirai)", "value": "630fbe45992c61f29c85d98c36c8b4c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055337, "uuid": "3adf4e0f-b59f-4a70-87e1-9ba40b40b540", "comment": "Malware payload (Mirai)", "value": "c5c5976a211c3d7a650e383127c73833725fc5e2de4a486003039e0065e39f91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055337, "uuid": "b3852710-66d6-41d9-8c80-e23253d321d5", "comment": "Malware payload (Mirai)", "value": "2867fff997b9f19d6d934f1baea46c458bf7fc6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055337, "uuid": "fe5da396-3fdc-43de-891a-7ea55eb069f7", "comment": "Malware payload (Mirai)", "value": "a2856804d80d6d886004c7abb30cb771c6eba9bfc4763177e6b7605ed23dca4c3b64f78fa80d50248856420050339ecf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055337, "uuid": "191cf01e-ef56-4dcb-abc2-0c939b44f476", "value": "T18DB2CF0517658AAAD247FF3FE17A4E4A654DD8100FB74348F3B604DA628F56708AF87C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055337, "uuid": "e7f92007-4d7f-4cb2-801c-e933ca228e21", "value": "384:MNpB6Yj833S7YSpsGE0m1SAqMaECTS2lMnvk+G38/wYb7fjMWzfdNx7pKgyp+v1s:+3j8tB0m1SAiTxqMs/wYbrggF0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055337, "uuid": "3ac35ce7-72fe-4a9e-a33f-b46b80126fbf", "value": 23616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055337, "uuid": "1208e74b-2d8c-4239-a642-4e912865949e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055337, "uuid": "0ed00700-bd51-492f-9bf9-c29469ea394b", "value": "630fbe45992c61f29c85d98c36c8b4c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa28aed4-7a3e-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699012139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012139, "uuid": "de0c752c-b5ac-4c04-9fc3-e722d181a688", "comment": "Malware payload (IRATA)", "value": "2197f395367433dc3683aa03f10596b5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012139, "uuid": "af926859-72ff-4cba-90bf-a68dd5979afc", "comment": "Malware payload (IRATA)", "value": "c5fb0bf30e72f867dfd401fa27c6affc11e5f52729285a8bc2c6e24c50f8b23c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012139, "uuid": "0d8710a3-59ad-487f-9c22-e49de2b9ad52", "comment": "Malware payload (IRATA)", "value": "ce97a1121483b1b0de5c877e60b66d8acd80317c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012139, "uuid": "05579987-107a-4659-9faf-de43b2b93d30", "comment": "Malware payload (IRATA)", "value": "c24da253f31192f323392aaa5031c2bb82d30a79791d076981a0ed5582b80f9d3959934797996faaa0bec4c95bc9fd23", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012139, "uuid": "ef7fcf8e-8471-49da-8c33-c84b6e67a712", "value": "T1DA851243F376E91BC835E1322195163165561D69CA43FB0A298833FAB8BBDF84FC52D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012139, "uuid": "568f60a6-15f8-46c5-b917-5956ee9adc6f", "value": "49152:4sFkk6EXLqKfSh+0rLUF9QKaI2bPfFdg64S4/D:/kkBXzSh+CLUFoBdg6sD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699012139, "uuid": "33fdf38b-b7a1-47fd-84e8-cd90278826db", "value": 1776691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699012139, "uuid": "a59fa6d4-80f5-4c85-9257-6aed01b3fb14", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012139, "uuid": "429d497c-c791-4d9a-8c5a-065c4c85663c", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb609e48-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698997082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997082, "uuid": "a2b42bfb-15c4-40b3-bc13-ddc566ac24e1", "comment": "Malware payload (AgentTesla)", "value": "64aea329f5f1b3083596c4b2d20913cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997082, "uuid": "a5b5f5a6-40e9-4701-8155-579cbdea4d22", "comment": "Malware payload (AgentTesla)", "value": "c6800ce0835e6faf9ecb2513a34ebb7e57943dcb506ecde04b854b3d4208cd57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997082, "uuid": "c8935fb6-fc11-4344-8e4b-b4c3923ad1ef", "comment": "Malware payload (AgentTesla)", "value": "d9bf0f60f6171391ca56dc78dc8822015daf2594", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997082, "uuid": "ccf5a8cf-c594-4e07-8666-f45fd25451e4", "comment": "Malware payload (AgentTesla)", "value": "b65d4b19113666a40684e46bc2bab57417ee244290b6fe17f6047af8f6ec5db71a8a369932199437eb3b75031778d2fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997082, "uuid": "5c7069b5-748b-4075-a1eb-f25cb9ec10d2", "value": "T1A565A80FBA8789B1F159173EE5EB083407A5D5817623F70A354B23690843BB66F4DE8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997082, "uuid": "609dd6e4-4b17-486b-b873-3d482c483a48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997082, "uuid": "42a66941-f4dc-4614-b87f-bd901940fac3", "value": "24576:tnA3w8UReqOenML28Xk7Aeu6EaTQ7Kwtox:a6ReCOwTuRaTQ7Kwto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997082, "uuid": "ebc53f85-b700-4bae-89ad-ab10ffefc131", "value": 1499136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997082, "uuid": "cb1d9642-a0fb-43a2-ba60-e5b9c9552dc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997082, "uuid": "95e7532e-b8dc-4e15-b096-a454ebd799e6", "value": "OCT_RFQ#456372_SOFW_600SB_Rr_PHU QUANG_CO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7bfd77-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Pony)", "timestamp": 1699032945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032945, "uuid": "624447be-5b60-4cef-aee6-343a41f76add", "comment": "Malware payload (Pony)", "value": "42c84e6311867e7dec5e797f70f3b594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032945, "uuid": "dd7c3388-6fed-4399-8de0-f9599715fe5a", "comment": "Malware payload (Pony)", "value": "c7a78d6ceddf6e5bb98d62c2f9e4259fc8a7819ba08e54aca63e3f1b5476a754", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032945, "uuid": "1b6aeaef-f8f4-4351-8303-01ca646916c1", "comment": "Malware payload (Pony)", "value": "cf18e2f1e3600cd01d2e2057ae0e8d34a3b97fb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032945, "uuid": "8b36008f-46ac-4e83-9a56-ccf2d25be46e", "comment": "Malware payload (Pony)", "value": "e2a8b6e8c070c6c88f7ef21d2a0fa5c9e5179db0b2dbf34b6f8e9bd8abdce95139c69d473e5246f69ab37adc260e915d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032945, "uuid": "5712d78f-8e93-4493-a632-96a11118a180", "value": "T14CE302439E9D5DCAF4958130C89F4BB79A767C550A90DB2B9AA4F72E3C35380F11B0AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032945, "uuid": "39da68ef-8fc2-4d92-b4c7-db38a11cecc9", "value": "5eb5cc69cb7b917f1b7f303bce429cda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032945, "uuid": "76ab202f-0e82-4191-8593-ec8e31bd6140", "value": "3072:og1KnSxN2Kpv963IXNGq+vACl5gtga0xGM+ToFQ5G3SVshtAqblF040DRQ:og1KSxoK1I3IX8z5UT6GM+8oE/EqblqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032945, "uuid": "ed39a1a3-abc4-4957-bdfa-6aee65d2d80e", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032945, "uuid": "8625728e-3e1d-40e4-8125-c14d8608ded6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032945, "uuid": "79f0dcff-7484-4498-b6e1-c72329d644b7", "value": "Trojan-PSW.Win32.Fareit.cvec-c7a78d6ceddf6e5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70e7ffc-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996994, "uuid": "2c30c478-8049-4dd4-bbd5-dacf90a112a1", "comment": "Malware payload (GuLoader)", "value": "cfedc4289e0c0d1aebfd96f74fde962f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996994, "uuid": "70ea5a68-44d6-4201-b517-4f7b31021f6c", "comment": "Malware payload (GuLoader)", "value": "c8e3f3b6912762a4baf60b2834e5eda3df8c8122534e058b750d7e4e3c689184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996994, "uuid": "f889aa8a-d970-4d7d-a279-6a7428ca4eeb", "comment": "Malware payload (GuLoader)", "value": "3114db09ec55fa20db404e3d5868953284b90a54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996994, "uuid": "178ce364-5343-487e-84cf-fd80e90d27e6", "comment": "Malware payload (GuLoader)", "value": "f3b7e3b771b5be57d6ada572322d088e7b7851a9ff9d5d0bd211e8b64d23cf7373fd341d55941d312b06586ea55791d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996994, "uuid": "a380c239-cc2d-4afa-856e-db0ec199aa89", "value": "T1B50523E473F0C867CB736230C696521AFEF9EE15766B63875B103D8CBD72AC18226254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996994, "uuid": "cacc436e-e647-43b0-97f6-9c969dd31a69", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996994, "uuid": "bc7e3a39-c63e-4272-bba2-89972df8e05e", "value": "24576:INPx3Tp68AHsY4z3lz6uc1L9J8xVCT5ATqY2BXY6+g7:mBTIQ5z3lz6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996994, "uuid": "61a9b2ae-c157-4445-a623-349d36dd1748", "value": 855584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996994, "uuid": "32c79419-3819-45d6-8881-c64fd46ee8d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996994, "uuid": "aa01a7bc-2a1b-4cce-907d-4ec89b6a787a", "value": "Lampadephoria.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b721f7-7aa0-11ee-8907-42010a9c0042", "comment": "Malware payload (Nitol)", "timestamp": 1699053867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053867, "uuid": "aa71b340-0708-4df8-aa0d-26a7bfd77134", "comment": "Malware payload (Nitol)", "value": "a04b173e5b0cb462684e646d91b14683", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053867, "uuid": "ae70c391-8d42-4cd1-8b70-0f7018ad5fe8", "comment": "Malware payload (Nitol)", "value": "c9a965af469f70571a191271783eb2076c2e24e12353a3ec545d8a726fef61f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053867, "uuid": "d0ff4723-1f20-4e17-8029-d61ef28e78ef", "comment": "Malware payload (Nitol)", "value": "444080797cbdf70fe9c594331457f8d25176aba7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053867, "uuid": "b8ae788a-627a-43e4-aa7c-6b6e3d34cf78", "comment": "Malware payload (Nitol)", "value": "dab7f115af67d0b0694a0acadafcedb52e8548fc32d8c4b2bada398defe0c78e6cd2b1605486f2ae3856fe0554a92555", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053867, "uuid": "ef808b92-b9cb-4eaa-9023-0654ee7c135d", "value": "T134636B2176D0C072C05A64756855C3B15A7EB931DBF9C583BF9B0BBE9F212C06B3A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053867, "uuid": "ec071701-85d0-45c0-9458-9902d1e46863", "value": "070b5b44988eb91ceb5948a1cf23bcef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053867, "uuid": "83c71351-87ee-4074-bfba-828c1e36dad7", "value": "768:G407txg6CVX762AORxFGPRDEEOsx3n+79Namb3GluLrXCS32Ta1NzBoFsxHv5rMx:Gd7TGAgFqoQn+mmTCuL79NzBl55rw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699053867, "uuid": "9a4dd379-6093-4854-b110-71c1694430b6", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699053867, "uuid": "54fba48b-e0d3-4154-b8d2-03c32771790e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053867, "uuid": "368d9fae-fcb7-48d5-b97f-4f867f11f222", "value": "a04b173e5b0cb462684e646d91b14683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05658978-7a19-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698995837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995837, "uuid": "10c4fc6f-97c6-4f7f-821c-7c7c8e627665", "comment": "Malware payload (AgentTesla)", "value": "a34d0ceef649d849c1132abc941b2130", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995837, "uuid": "60eac2b6-b4da-4d11-a1d3-c64a5b53a4aa", "comment": "Malware payload (AgentTesla)", "value": "c9e482f689c074f1d8e1db7e5838d852df424a93d4b13a105165b66c0fe2dae2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995837, "uuid": "c5675956-5120-415b-9796-37a832e49fb3", "comment": "Malware payload (AgentTesla)", "value": "fb08263a1673197dcb7719dc6f6a23f5295d6801", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995837, "uuid": "9e5beda9-789f-44fb-8b7f-8207a2276eff", "comment": "Malware payload (AgentTesla)", "value": "b670a7338016ae3c5e9ec8a797952e25241e33e38a335e6769e3dc4f4de8fe5afb267ce79e37246b0ac3ef10189ee444", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995837, "uuid": "6185fade-da81-4190-908c-04c3ff3728aa", "value": "T1B8D4234492F8AF2AE97ED3F1A424938117F6A4571920E15B0DEA20CF953FF350A61EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995837, "uuid": "5587b73a-fda5-4bb2-92a5-5d854303fc3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995837, "uuid": "18b8f4c3-da37-4bb2-a763-197c42bbda82", "value": "12288:oIkPyOblkdqKhIgKgyhrsUWVu4jPaloVTb2+KWX8sMZxNMKEIrhB4rF1J:oIkqObKYKeiQcPalmeW8fZVVhar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698995837, "uuid": "f3bdc112-b4ef-4e4c-9ba5-fc5eb1eab4b4", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698995837, "uuid": "f305a7f0-389b-4305-8367-71c5525ac8c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995837, "uuid": "c30d8bba-0edf-45d7-b4f0-2399aedd2e59", "value": "RFQ MT-764439977.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feaf4370-7a33-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1699007422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007422, "uuid": "3ddfd3ab-fbd7-4a62-befb-e641e0eadcbe", "comment": "Malware payload (Amadey)", "value": "a7744d285a50d0d39fd77d28c33251fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007422, "uuid": "ece775e7-869b-402e-937b-03e3e936e942", "comment": "Malware payload (Amadey)", "value": "cb4842b767474531d720f2837cb6546a31c7e93f8f9d5f516bdc28e5eb1fc297", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007422, "uuid": "803f71a9-5950-42dc-a9cf-9c474983ea26", "comment": "Malware payload (Amadey)", "value": "3842b3e918bdebdf78e6cf718f1478acf4793276", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007422, "uuid": "c1464aec-a247-4f43-a219-a486b5eeda8a", "comment": "Malware payload (Amadey)", "value": "9a3b34c24484b4c3062e3405a8d73c16d51c54fa78a63c892185b139ff95809d83e204bef7f21c55fcf3519b89f2a28d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007422, "uuid": "543debad-1b3b-402f-880e-687218f48334", "value": "T170752356D3CC965BE4B113F058FB42630237FE2399B0536B6250DA491C73D899AB1F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007422, "uuid": "66f983dc-5074-471b-87e7-e753459dd871", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007422, "uuid": "5964b487-2114-4ece-9d97-92d3697fb1ba", "value": "24576:iy+ZMN6+C2QeEfonVHTpjQmbxfTYBjvH6rVxExUDymNtxpHVCllN:JYMAN6EfUVH1ZYBkEx8yOHvCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699007422, "uuid": "1fc63173-fc7f-427f-80ef-7bc538a0e066", "value": 1605120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699007422, "uuid": "c3c360c6-8298-414b-bd48-cca27d091465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007422, "uuid": "df5482db-6988-488a-91c5-f55c552788b8", "value": "a7744d285a50d0d39fd77d28c33251fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10466b7b-7a1f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998433, "uuid": "893f2186-15ae-45d6-878f-332e916bbe2f", "comment": "Malware payload (Formbook)", "value": "ba681e3205ca33d5ae84056fe7bb1da3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998433, "uuid": "4fdc4dfd-2392-4412-adea-98a84b054d7e", "comment": "Malware payload (Formbook)", "value": "cb67fbdadd5b53174e117c296acf0c1b1764a5c3f548b03d2ed9d4ab75aa7c4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998433, "uuid": "8df4faae-eaf2-4135-b29a-2e504d9bed47", "comment": "Malware payload (Formbook)", "value": "c119e2535b00e225f2ab7073e00b4d615961c566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998433, "uuid": "cb2ec424-593b-45e1-ae8c-e777d77458d1", "comment": "Malware payload (Formbook)", "value": "0d4276beae523c48d115d7b6942bbcf9c10135d72d06235961b11f858a812302c9b0335640c2162a1a0930006532f829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998433, "uuid": "3cdb7329-7cf4-4ed2-b927-0a367fc667da", "value": "T185D4CF9D766071EFC85BC976DAA82CA0EA60747B430FD253902311ED9A4DA97CF241F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998433, "uuid": "b896da6b-e141-4d2c-9b53-82fbfdc60951", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998433, "uuid": "9e977c48-83ba-4d26-b38f-9cd3c39e4824", "value": "12288:zpdPHIkTZ1n1GBmVImEOiSl5NehScU7Kuk631jr1beVMaq6Y0OaIt5oVOxzI:zfPHIkT71uYvEOl5ITU7xk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998433, "uuid": "4f6eb09d-ae27-49a8-ab07-bfddc5398528", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998433, "uuid": "a55acdd9-cfb9-4c0b-b6d1-18637c7181e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998433, "uuid": "cefb3995-5776-4f27-a1ec-70332a28b22e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca7bedd-7a43-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699013969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013969, "uuid": "d4f184ec-10dc-4aee-b52a-d798505cf556", "comment": "Malware payload (PureCrypter)", "value": "625b169be5b1d83d4406828f04ae1e2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013969, "uuid": "187c3ab9-0818-4b1c-9436-52fd7436e8c1", "comment": "Malware payload (PureCrypter)", "value": "cbf16782202823f4a67679afc49ceada8faaff4f26875f3c5ed48821033b05bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013969, "uuid": "e4fd8d84-74c5-4dc3-808c-3a267daa90ce", "comment": "Malware payload (PureCrypter)", "value": "adf32349a3902a2fe150a8a7d5c3e1cb9a2304ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013969, "uuid": "75e7bdd4-a45f-4818-8d69-5c3eaf45b26b", "comment": "Malware payload (PureCrypter)", "value": "6242b9f651c8ae1d7f63bca0991cd7665bb4de715e1d5913272aa8ed9f624c6042aaf0b2097f122525fec7d58d248ff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013969, "uuid": "47cc93b9-7e54-4631-bf31-bafc620f387d", "value": "T11B530817B75B85F1C255DB7EDBDB44040375EA82B623E60A388E139E98837BF8D4060B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013969, "uuid": "086614d3-0bc5-4104-99fa-6dd010be9b10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013969, "uuid": "3a318e2f-9af9-4d14-9a12-1bd7c19b0e4d", "value": "1536:SVQLO6dw5fRF0RYPuZ1wl9aVsq0hOz4u5nP:SdAP+9aV/XzzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699013969, "uuid": "d1c8281b-98f1-4e4d-97b5-1b5a15120261", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699013969, "uuid": "e86da3e6-f0d6-404e-bf1f-cc7231f365e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013969, "uuid": "457eb7fe-7cd4-42f1-9fef-38b455578b88", "value": "cbf16782202823f4a67679afc49ceada8faaff4f26875f3c5ed48821033b05bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996599ac-7aa3-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699055356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055356, "uuid": "0b6ee9e5-cf8d-4e85-95c3-7278ae09408f", "comment": "Malware payload (Mirai)", "value": "28a3e9761ab3634597ec8a992d872b7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055356, "uuid": "89e8ec46-063f-4ec7-b306-04d18c5772b8", "comment": "Malware payload (Mirai)", "value": "cc125b22440de6c5737c49f4d5cfe661e587fa8584b479bb0d8a93b966041ec9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055356, "uuid": "affec80e-0011-41e1-945e-adfb782453ca", "comment": "Malware payload (Mirai)", "value": "bfdce6f4fd6b02cbdd41be75bae93a5cc069e4fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055356, "uuid": "a01eb57f-1f11-40a6-a8e2-e5bb36cb43d6", "comment": "Malware payload (Mirai)", "value": "e0899edc09ff2f801ad3d250742ea175868eec9fb8a8ee7739c74250ad23a73dac551f2c64ea16a43b2053be8896b6df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055356, "uuid": "ba9c0a16-03ba-4a87-9993-71ce204713a9", "value": "T187C328742449F2BCE9B7A075E04325D604520A083FDCD2D3B983653BFFB9B496269E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055356, "uuid": "a808cafc-592f-40ba-ad34-119c0473c39e", "value": "1536:WEJQ4yB3hugZ+g1asqgS66TzZArcYVBIVCCfy0K9q80T105JM:WB3hrEgJJMzZAQ2ux8aI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055356, "uuid": "2c89c674-e501-48e2-9cc5-33bd4ee6acd8", "value": 118296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055356, "uuid": "c1621e15-ab74-43c0-bf52-996a110354fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055356, "uuid": "5885db04-740b-4147-b44c-d49843b8f2df", "value": "28a3e9761ab3634597ec8a992d872b7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d5c11c-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699054704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054704, "uuid": "99818f83-a858-4d31-8c13-3eae0b803bf6", "comment": "Malware payload (Mirai)", "value": "5aa1d84e7d2ae9ae30bb9a4500924995", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054704, "uuid": "8ede34fe-8753-408e-8c63-65748071e910", "comment": "Malware payload (Mirai)", "value": "cc9feb4971cf8be862000fed8ff66e88ae8fbf4f5040e85f4c103f5f58aa442d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054704, "uuid": "fcf42e1d-15d2-41c9-b6d5-a3380de7ec31", "comment": "Malware payload (Mirai)", "value": "54046637ffbbcd7398da0bb4adf7e8b30e2d9b09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054704, "uuid": "9f9a9857-90ef-421b-8e8c-d57d0f127ece", "comment": "Malware payload (Mirai)", "value": "236469225a34e737577fd91bce1da684f6e19cddef7b5925d6f76a8337c9211506646c00903853ff18573c3ad252ef90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054704, "uuid": "3df27298-053b-4940-b1bb-2b5b911c4073", "value": "T14D835C86FD41A62AC7D0177BEE5F508D3310A7D9E1DA3647CC244BA47A8E90F0D67B06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054704, "uuid": "e78d407a-0f87-456a-afea-960fa4b828ff", "value": "1536:hdTZUyU1ucAqhM9sRPoQA4lVUg+F0Rq8qz8t46xA0nya10dW:79UyUymdN+Grqz84GACU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054704, "uuid": "868481ad-e3e8-4db1-b7c0-dd057948785e", "value": 83180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054704, "uuid": "6f250428-f7eb-4677-abbc-c3d16f8c4446", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054704, "uuid": "9f726b9c-179e-4a90-8afc-7c8f64036ca8", "value": "5aa1d84e7d2ae9ae30bb9a4500924995", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921cf1c0-7aa3-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699055344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055344, "uuid": "f96fefca-f8bc-4207-b0e8-e4bb660d4a00", "comment": "Malware payload (Mirai)", "value": "520e4318ce4603967b4e0e5b27ff9d67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055344, "uuid": "5195de78-886d-461c-81fb-82ee860fdcb8", "comment": "Malware payload (Mirai)", "value": "cd57d062d6c58ed29731e086e56cd26a15bf8b8163a7048cd947e44617e025e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055344, "uuid": "24cbea5e-46c2-4648-93d3-9574768f64af", "comment": "Malware payload (Mirai)", "value": "3cd39167bf0c335492ebf9deb7e4a906a1166c57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055344, "uuid": "de860758-276a-4a39-8887-54f9251d1798", "comment": "Malware payload (Mirai)", "value": "8d0ecece11dc515b4e92ad389fb048a9d782687b373c71eda2302ad7a94030a71935bd91140bc42a134f20660302a9b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055344, "uuid": "97a02be5-e393-4485-b093-43e69c3606e5", "value": "T1EE836B4133584E07F8950EF8283F17D483BEFE5025E5B585AA0FEA0A4235E73594AFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055344, "uuid": "88a378b9-59ee-41ac-84a9-b4eaa462fa18", "value": "1536:cD/CLxSFuiXWkiOpOlL/7waswUlOgLMDnBxIyCa10dan:c2t0VilEw0OVxIwUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055344, "uuid": "1d840731-38fb-4936-a681-e2b8adab63c8", "value": 87136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055344, "uuid": "d797b857-9c84-429b-bc29-d01b8fb07975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055344, "uuid": "158cd003-83d0-48c5-854a-d9b6941646dc", "value": "520e4318ce4603967b4e0e5b27ff9d67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b327e14-7a50-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699019550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699019550, "uuid": "c2ba84ce-1425-4e6c-9088-7fa89bcfef45", "comment": "Malware payload (IRATA)", "value": "9344e640f93630ef6da215ae4dfc6e75", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699019550, "uuid": "a319b3c1-3e1c-4f24-9932-d30ac040df75", "comment": "Malware payload (IRATA)", "value": "cda8990ff3f0203038bb81ebdf281090a975ee4ee79c5e83e571403acd537d22", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699019550, "uuid": "a960cd8d-463b-4627-9780-09e488d11dc4", "comment": "Malware payload (IRATA)", "value": "cbfc418a30daa5b765c2a684a410e95fec7744ba", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699019550, "uuid": "561d5cc0-8dfe-4340-878c-438cf2450088", "comment": "Malware payload (IRATA)", "value": "1576b540576a8d23911b73025d8a2e8a279cd118f105ad707b266aa041af312b3061bf0ede2cc63a49bb20076eccb99c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699019550, "uuid": "34ba4454-3708-48fd-88f2-53f989e4ce09", "value": "T163851243F27BED17C831C13224911A3A651B4D19C986FB8A695437FE68BBDE80BC17D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699019550, "uuid": "2333cc42-739d-400e-ae11-7385562f1988", "value": "49152:vsjkk6EXLBW8aQLqAhfEjC6I4rrLpR/5IRaJh2IPQwr:IkkBXFzqA5sCSnpLIRcsxwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699019550, "uuid": "2f0da5ea-7497-419c-854f-0a516e368667", "value": 1743923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699019550, "uuid": "fac4973b-5030-48e4-84a3-859adbebee71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699019550, "uuid": "31cdf3f7-2c7e-4ce5-8766-c807d8a4b479", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8d87b3-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998056, "uuid": "9e9d6840-d650-4c85-a68f-2549dc147983", "comment": "Malware payload", "value": "4c98a3e5385da8246cfa4eb786fcde72", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998056, "uuid": "e37147d5-0c5d-4e57-8078-553bd2c9cd6a", "comment": "Malware payload", "value": "ce104cdd11b5b431a2cf10a59d4a37bf6cfc0127a028ad73051ff7ca08ff12f3", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998056, "uuid": "71794d2d-7049-445d-afba-76b04e908d92", "comment": "Malware payload", "value": "97654eace5b6918fa1a85025c6fff67e888625c7", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998056, "uuid": "ec8aff7f-37a7-40c7-b458-d7555022b4f1", "comment": "Malware payload", "value": "554599d75352b96dd6fe40792d828855470b5945dd3169d2b2bc56d9f56e6e0c62ec4ec8e0303be9055370954456a90f", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998056, "uuid": "2abe6240-6d8c-4c70-9ed5-7146882d7b3a", "value": "T1F6E15C9C9D984C14DB694036C1A025C88FFC7C6529C6971B92B8E26E0DFA4D9734FF1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998056, "uuid": "df8a4df6-3502-4849-8afb-d417a460fcf4", "value": "192:/Nxd9nSVSnG3QEthI6DAvj0jgTisF6KGoK4:lbdDnCQEtpUuupGp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998056, "uuid": "1f6f7752-0887-4b58-ad70-4d7012749011", "value": 7330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998056, "uuid": "4a3a0cef-da84-41fe-9afe-8945c00e939e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998056, "uuid": "3f9821eb-b7ae-4bfe-b2b7-9c28b2b36ad5", "value": "PURCHASE ORDER COPY .xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f9a357-7a85-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699042409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042409, "uuid": "a0d2b775-f51d-437a-a5c6-7ff41aae52cf", "comment": "Malware payload", "value": "7adff3b753b86dd76bf901eaf1fd0ab5", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042409, "uuid": "dfe50718-e79e-439c-a160-741a12ccd592", "comment": "Malware payload", "value": "cf4d7ebbd49811c02587417e1a74f79b9a997be243384ac39fb49ff9883d3e1f", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042409, "uuid": "a25e380a-7806-4f79-94bc-8b371548d3ce", "comment": "Malware payload", "value": "4bdd37c8f66c89ae3dba85a5101d1329156fa1f7", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042409, "uuid": "cb7d093a-0911-41c6-8cef-94ea028be875", "comment": "Malware payload", "value": "2eb8360fbe6cac6c182c18f5433dd4c34f89ccdbb6bf9fb2884992f4f5e78b9d1e4ba47c0e5871daa87f039e244fb5a7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042409, "uuid": "0352b6ea-3210-41fd-92a8-e4fddbe1da68", "value": "T19B63029AA265D7CE7B04101511AE0ABA6F8233A7C0909E06D4DBE87F147957F7CA1CB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042409, "uuid": "673951da-c479-4c62-8b9c-5efabe7b0886", "value": "1536:o4nwR7ntI3tTeyBLdwFOxmSkq4m0BHEV5zETr:bwFAd1BLsO0q43Bsxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699042409, "uuid": "822f8d6c-101e-4079-baa4-a91f7c4b4fd7", "value": 67176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699042409, "uuid": "3533d094-6ee7-43ee-9717-611a90b0c673", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042409, "uuid": "d2d5b411-fd36-436c-a822-63010acaf336", "value": "04112023_0217_GGGGGElicnse.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7e934d-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698997084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997084, "uuid": "0754a42e-d957-4501-a920-02c011086ec0", "comment": "Malware payload (AgentTesla)", "value": "f2d4b56d07ec744f516bdcc13c829882", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997084, "uuid": "8fba4a98-95a6-41a9-8aed-46b9ccce68e0", "comment": "Malware payload (AgentTesla)", "value": "cfab773d94f001f1db2a1d37f14b775956ee0599d8dfbc822a6a6442c864dc73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997084, "uuid": "b1274820-08d6-4c6a-af75-49ee4c52c5cd", "comment": "Malware payload (AgentTesla)", "value": "b5bd1512427c9093aea35424157441ede2e3bc65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997084, "uuid": "8f500d2d-f53d-4280-b079-f5e7a420e805", "comment": "Malware payload (AgentTesla)", "value": "cc05e2c00c5d6da6325cdb5fff22c266de954384d82dad27c0a8504ff9cd788666d7bbdc7e6410e8f22a7f023f6ee54d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997084, "uuid": "caa0b5a1-ffa8-4404-8806-ed097e12d845", "value": "T160D4291757EC9795ED6F12B6F0B4712D76E1E006E6ABBF8BC684BEE028837506C01163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997084, "uuid": "378b56da-0a40-454e-885e-554fc6ac854f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997084, "uuid": "b1b37f09-0c5b-42c6-89b1-c430c026ed52", "value": "12288:6Zyg6P79OfJLdy9qqBrKehQPuXzUv78R57T/lx//KtU8TdhgaQC7ox2/3VrN4DWJ:g6T9OfJRyg8rK4QDhgR/sXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997084, "uuid": "96573111-e6af-4945-a2d0-d068d778a757", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997084, "uuid": "6f015e58-2bd3-4c26-ad35-549b04fb2df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997084, "uuid": "82dc75ab-ee85-4357-b7b8-e1a308d044df", "value": "OCT_RFQ#456372_SOFW_600SB_Rr_PHU QUANG_COxX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfce349e-7a41-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1699013384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013384, "uuid": "d81c7ae5-37a8-4d6b-b49c-1bddec6d20b4", "comment": "Malware payload (AsyncRAT)", "value": "1f3b5ddafb8fb65d28e7eff007ba2e65", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013384, "uuid": "24a53199-1ef9-440d-b2b0-d42d90893a7e", "comment": "Malware payload (AsyncRAT)", "value": "d0812b9e320479317bb356c3687ae467d09a8caa4e0aff32bfcbb99f6932a5e4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013384, "uuid": "bd328525-c728-416e-b327-1b48b206c6b2", "comment": "Malware payload (AsyncRAT)", "value": "b77055da491c31d31ede7382e772a5fe4c2f0e82", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013384, "uuid": "97c1d5fa-9146-406f-9367-27d284e1c80e", "comment": "Malware payload (AsyncRAT)", "value": "4e798fa466ffc319ce2d5d6203ddb8ad8a0ef4ecc6e742ae3573846a7ab97a8749ca22371d0446c2ec89c78fec4a5009", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013384, "uuid": "f726c2a8-3f70-4dae-a397-0faaae3879e1", "value": "T17AB48C6831EB1FE2D036ABB6D3942B8997F6B475931EF81E7FE506464030F449E23621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013384, "uuid": "366a62ef-2eed-49f0-b4b9-31318055ce47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013384, "uuid": "5fcc6261-f4be-49a5-b3fa-a24dbb209dee", "value": "6144:E3YTNuB/hxgSTSrgGAs4ai9T3/ckU+vtBI4yqC+MH/55XaReNIxjgVxZaTl3DXr:E4Ni/HTZGji9jckpvg3qCXBbegXZQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699013384, "uuid": "6d684de8-9488-4385-8f6d-cf5cf3aebe20", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699013384, "uuid": "9b574525-09e3-48b6-a7b2-17feaa8db60c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013384, "uuid": "b0e0a015-e3e7-4c2c-b004-daae9dbd909d", "value": "d0812b9e320479317bb356c3687ae467d09a8caa4e0aff32bfcbb99f6932a5e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6525ef40-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699032935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032935, "uuid": "0f619dbd-81ef-4c2c-9c63-afccaa691687", "comment": "Malware payload (RedLineStealer)", "value": "27783cd412bfe98808386c5f3dc7d970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032935, "uuid": "4755428f-93b7-41ab-abe5-e3ec78a55a48", "comment": "Malware payload (RedLineStealer)", "value": "d24dbfc796b0b1b56e8a669aaac50a6eb730882738111cd1ba66790d85b4fa7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032935, "uuid": "387c8eea-afae-41b1-99cc-beb96cb092a7", "comment": "Malware payload (RedLineStealer)", "value": "872e2f10614d9692a26624f2422896684184279d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032935, "uuid": "891b4d6c-564a-4505-800a-a5b79551bb4f", "comment": "Malware payload (RedLineStealer)", "value": "7acf5ee1b2f04c777f2d0a380e879e1bcf213cb1033a407a4077eba8aaf3260506fb13722d970f0297ae45a1e18eadd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032935, "uuid": "2c553364-edb5-4a13-b360-fc46c74c2db6", "value": "T1E9953383A6E8A413D739577148F30F972338FCC65EB8923726449A1F04A35D6A9353BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032935, "uuid": "be96a3ac-75b5-4d85-99ab-788b9a94e7c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032935, "uuid": "1e1e2a23-44a1-424a-8ce0-8f59e6f07f9e", "value": "49152:ycLtOXKaJxjwaeHU1It8eY89VWgPO532Do8xRINzA:tLtiTJyaeHU1iV9NPO53coAcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032935, "uuid": "fb0eca40-29a9-439d-951c-64c4967f2117", "value": 1885696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032935, "uuid": "f8629766-9927-43b2-9e35-f698ab9b65c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032935, "uuid": "b30aabd1-d066-46f4-8209-2b2bc2a66efb", "value": "27783cd412bfe98808386c5f3dc7d970.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47beaa96-7aa1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699054360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054360, "uuid": "3be9cd89-dc8a-4e3a-b3db-dff737dda72d", "comment": "Malware payload", "value": "e475865db01526fb12e99dde5fb0d553", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054360, "uuid": "08e77607-f111-4f78-b360-a2c5b562bcc1", "comment": "Malware payload", "value": "d2e07f0516d7df039709a274495a90d5ddcedc96a4bd7240a7593ca55c9a7383", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054360, "uuid": "b5f5731a-b099-4bd4-ab12-d4e826dd50b1", "comment": "Malware payload", "value": "ae681f4d8e5989006b5b3cc7183b4ec0bf8fd0b9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054360, "uuid": "c0b69c10-2fa6-4f1b-8714-5bbfb05dad77", "comment": "Malware payload", "value": "b9c296c1b9f59951bcfd32362eb39866b90b1cae5b7763dda9ba7879673a444a30dc688aae6b50bb6a1a4f7aebdcaab2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054360, "uuid": "8c82edca-f022-4827-95d3-5d2e05a4eb5d", "value": "T1CED5BE2A35CAC636EB7E82306669D77A65BE7EE00BB100DB63C43A1E1E305C15275F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054360, "uuid": "eafca293-cb71-4fc3-a229-41062e16cd63", "value": "49152:yIjRd5W8zBQSc0ZnSKxZKumZrDq4Fb6HXr1iWnYs4ntHurpllQ6aBuxtZ6eGisGg:920ZnHKbFnWnwuxCeGiZDal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054360, "uuid": "b7dafa86-d3e1-4a54-bc3e-e5d383324f6d", "value": 2820608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054360, "uuid": "0e26a546-98af-4d60-aa9f-a84cc2a6595a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054360, "uuid": "33ddc4b4-ebd1-4b5b-a1be-9b288b418b6c", "value": "Cheat.Lab.2.7.1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0a7228-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998053, "uuid": "13e710b2-c1ad-42e7-ba45-2509c2715473", "comment": "Malware payload", "value": "b3bd5002c0c470098c0fd3612b6d769f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998053, "uuid": "ea97a275-6889-40c8-b331-0615fa07a1b4", "comment": "Malware payload", "value": "d41f36f1e1d13b8655f62e420d9d15500fe85287bda79f74484372e812624d33", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998053, "uuid": "ef27ebe0-0995-49ea-9cb6-8d7ef7f1d30c", "comment": "Malware payload", "value": "9d87841aca7de52e0351e2266cde151ceeb88b81", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998053, "uuid": "7e01cfb8-8390-407c-8da9-14648b511aa8", "comment": "Malware payload", "value": "e68ab31c02fb23b97ea216c2bdd4f4061ed5f8082be1a484b167cd96d49c6e87af073da550b6e743d71b1d509e76dc4f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998053, "uuid": "878b58ed-82fb-4566-8a0d-375ef5f36522", "value": "T1C2E423F7782BDFB6449422B5DCB7C8D9B4BC19F244FF468C39A091454C2A457FAC2A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998053, "uuid": "f12abe6d-99b5-4087-b589-39559eb384d9", "value": "12288:UOk3A0VLic4IFeQWsMPiWtOygSoE+/U614VVD3l71ExklARNKEoBCEt0Q:UOwA0VLitQWsMPhV70/UK6V1SsURQt0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998053, "uuid": "e254633c-b680-4b49-b2a9-63d3d7904e3a", "value": 716572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998053, "uuid": "086400ca-ba4f-44ec-bc90-ecdbc4e32113", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998053, "uuid": "b8039097-3786-4535-87e8-bd6494b37c19", "value": "P0#790932134.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d92107-7a59-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699023544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023544, "uuid": "fff3a7a2-eafd-4edd-a506-cfc102bc1011", "comment": "Malware payload", "value": "3a90aaca580e1318b6fa5ec092e82dfc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023544, "uuid": "55ee5e79-9040-43a1-a05b-de7fe476af0f", "comment": "Malware payload", "value": "d51ab45c535547658566fd182d7b0aa6eeba6bf6d087729a7872fa16d96c9ff9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023544, "uuid": "9650b214-5b23-4794-9043-7003e5d2b970", "comment": "Malware payload", "value": "6216af65853b8b3e596bacff62f895f118235016", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023544, "uuid": "003a12b7-8e9b-40c7-9f8d-ec9ae064c8b6", "comment": "Malware payload", "value": "2e2d91576440555777e557bdd3835574d5819b5d63a7f84e90513ff80126b3bf8b46d2f85e5212d44f1366ea2cb61794", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023544, "uuid": "093d841f-194a-4fb6-9d87-22b384f83b1a", "value": "T1A154421163FD5108FAF73F846DB592A84E36BCA6AD79D2AD1260105E4AB2F40CD71733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023544, "uuid": "7c8d48e4-87a9-4697-bd81-2885f53bb3f8", "value": "1536:1cjwoD3AE4g3qLBwcMmKYI6nQTYlR9fo/tFbT2ngJqQAXqM36sS2lX5sOxBLP8sH:O8dkeQAsTbQ9Z4295pHLfwKpvs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699023544, "uuid": "27e40ba5-bcc3-475a-baf0-25f4169df426", "value": 303248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699023544, "uuid": "58e22bf4-8bb8-41e4-bf21-315f9cdbf9c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023544, "uuid": "e18f427b-1f54-4c90-9d4b-9da4b5a7754f", "value": "GIWX0678_9173423.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2feb3e7-7a9f-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1699053735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053735, "uuid": "90313ff3-62ce-42ae-b7b4-f0d4d90afd4e", "comment": "Malware payload (Adware.Neoreklami)", "value": "6e98198b081fca1498e0c18217e71496", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053735, "uuid": "99bb7957-0d19-4c4e-9971-2e2c40ca2b70", "comment": "Malware payload (Adware.Neoreklami)", "value": "d5f7e033b24a73f491c6a45bd1f8e449924138ed65a8e299e715f99b632dda46", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053735, "uuid": "76896d5d-8f07-4497-b3ff-923b30d4506e", "comment": "Malware payload (Adware.Neoreklami)", "value": "ad42850e4262202014d143e4d1747d563e27170a", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699053735, "uuid": "5e6f90da-6d6a-4270-a300-90538c6394e2", "comment": "Malware payload (Adware.Neoreklami)", "value": "19eec5ee02d72c67bc370c880c9bafcd2a81273ec2116b513530d534ade7d8a5dfcb3677a26b511fa1f9622f9587623e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053735, "uuid": "cdc6eaf0-eccd-4288-9906-d658c646d4ca", "value": "T16976335A31E58CF6D36211378A483AF1D6F8E2892F7055534BDC062D2FFD2C9C4AA729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053735, "uuid": "2bb4eee8-a04e-409e-ae01-1b2179cd4680", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053735, "uuid": "5d469c8e-d7dd-430a-b583-4c152d09a7bc", "value": "196608:91ONbW0zDcJwbWKJYgmAa5QPdcgKbi+Esi29MWuTp:3OpW0ywxJbBa5AB5729MDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699053735, "uuid": "9c957466-b00b-4cf2-aa41-f25170275dbc", "value": 7483009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699053735, "uuid": "8ec9f6d2-cc3e-4e11-9cd4-a9b0dde435ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699053735, "uuid": "b167c6da-3212-44a2-98d6-b9745de7d0f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8dcc3d6-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698997078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997078, "uuid": "2047c26b-0849-4927-88a3-fb36de0ea2a5", "comment": "Malware payload", "value": "ab9df444f947e66e4e83ce96a30dfa5d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997078, "uuid": "fe3403f4-c025-4c1c-bb97-5ace84c3edb7", "comment": "Malware payload", "value": "d6eb7d0210d2cc014f55f3da067156a2a230aede302a3f47605f065679a12ad4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997078, "uuid": "19f9fd1d-30fa-4259-8707-84acd35a2be3", "comment": "Malware payload", "value": "d0e5213ce431d8250cd978e5357c49611348a59a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997078, "uuid": "b320d152-a896-44ac-a0be-072289a1f7c0", "comment": "Malware payload", "value": "f868e9715ba451084910079e7261b9c0ec72ce69de1fdc233cc861fe9bc42ebb7447140109f0c435c51697cf57a400bd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997078, "uuid": "e2c7575e-ec8d-45ef-9937-2db4a40afe38", "value": "T1207512139DC38F93D01F92F42FA72B991F126D884E80BAEF20867B4A3A757610D5D25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997078, "uuid": "e82ef5ec-50d0-4088-91a5-2a1070bf18fb", "value": "49152:7emZCGawtlRMleOjtjf04gE+mZTy/2xDt:7hB/reBjNf3+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997078, "uuid": "b4e72db3-e848-4919-8602-c61e39ddba31", "value": 1658368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997078, "uuid": "22c4e674-1846-4238-a0da-6ccfdf5c6104", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997078, "uuid": "17701bdf-20f6-40d8-aa3b-a41db3a793c4", "value": "Promocion Edgar Sosa DE-990-2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde8aa00-7a8a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699044787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044787, "uuid": "5a376d5c-6369-4b3e-a069-b337def2179b", "comment": "Malware payload (RedLineStealer)", "value": "09ebce8c99935801e72f62127c172f59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044787, "uuid": "49843cad-6328-4c90-9c08-ab80549e4174", "comment": "Malware payload (RedLineStealer)", "value": "d84228bc8874974717b8a2a3ad178b09ca535aa6e8387e6fbc3f5199055fa750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044787, "uuid": "ec2b3c02-0064-4d6b-a6b0-49d4a84e689a", "comment": "Malware payload (RedLineStealer)", "value": "c2dfaacd8aeed1c551fa3df5fac7a62f1195287b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699044787, "uuid": "8c922c44-ee76-4426-a121-c8ecc0108ad0", "comment": "Malware payload (RedLineStealer)", "value": "39a441563b1e152adeac03dae2cb03f6b5990626e9b5a5465a7edafb74e8219b2a85a6edd7b2c3ceec2bbd4fadd24903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044787, "uuid": "f4b64654-aa9b-4c5f-a210-090e5f431fc9", "value": "T1BA953C1172F95B59F5F34AB866BA7611C83ABC6A8F11C2DF1251904E0833BD09B70B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044787, "uuid": "0b1ea1b3-2f3b-46e8-bdae-f021cea6ad49", "value": "d47242ec56e1a1639468f1233564ee05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044787, "uuid": "4b2ab0fd-ba21-4adc-8cdb-146bf3839438", "value": "24576:nfl0rGWoHIsS8fLwxKWps46a9Dhvhg9mDf1Gzfdz6:nooHIsS8bW+46a3vvcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699044787, "uuid": "ebf4ba70-0f85-438c-a03f-01d27711db23", "value": 1982304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699044787, "uuid": "285c8a62-ac18-4c65-b143-6d52f7ce641c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699044787, "uuid": "5b1cd564-8ac6-4d38-aed2-ce13628ed832", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2065b19e-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698998030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998030, "uuid": "3a7f8472-2c70-4c92-9292-509226385e5d", "comment": "Malware payload (Formbook)", "value": "d1876d3139b2296d6a714d434b1a5d38", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998030, "uuid": "95cc5661-0f3e-49aa-8f48-081d1d1d9e5e", "comment": "Malware payload (Formbook)", "value": "d860f7f4cd3767f61baa052dba19ab8df2c1f1e1b76a7a86eff40a676ba391ad", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998030, "uuid": "17566fae-c2ca-4c47-9858-29325329b305", "comment": "Malware payload (Formbook)", "value": "688a3a1d7924e7942cc17a0aa90e357b87a1b4b2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998030, "uuid": "19f07d4e-500b-4527-81dc-88d8a6ce47be", "comment": "Malware payload (Formbook)", "value": "2d6097354ba533c9637e7fc3d9a152050b00255d7ea008b57fb8d0b7448d80197259433cdbb49b92b1bfa58d14fdcc7a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998030, "uuid": "80e5936a-fbd1-4879-b3ca-635e43edc99c", "value": "T1ECB4E0D2E48041A4FC591F7561338C39A467BEBDADB4AA8E1A9DB5703B732C7003794B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998030, "uuid": "4b206e31-c12e-437a-bf4b-4fbea4bcee95", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998030, "uuid": "11f7b9d0-b9f2-4ee9-a697-9fbc3002bc62", "value": "12288:lPiFud56vB1ZEP490rxXudCu3M6erLQ/IOoTLZ:lPiFud5gBDEQ90rx6J3M91LZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998030, "uuid": "71590d8d-1cfa-4e6f-85e7-c03bbcb29e66", "value": 515421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998030, "uuid": "cde9f3dc-ec1d-4a30-a2e9-c343fda37221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998030, "uuid": "571b2819-b60c-40a1-b240-e32a026a5f88", "value": "DHL_Original_Shipping_Documents_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10aec08b-7a59-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699023344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023344, "uuid": "7334675c-137a-4936-ad76-5d933a74ec80", "comment": "Malware payload", "value": "68dd8f254f6b67cfac490468e2435cea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023344, "uuid": "17ff2f04-30c1-4c3d-a1b6-3d09e8add325", "comment": "Malware payload", "value": "d8a2f79ef593016b61a3bb8d0cf87312c162f5abc26cc44eb8653545c25d5808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023344, "uuid": "3ee2f47d-fbeb-45eb-b7df-60b39e086629", "comment": "Malware payload", "value": "d6584abc1b0cbc739b368916b703ee21c33571a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023344, "uuid": "4e98bb46-e6d9-480c-9005-d4d0f999edb8", "comment": "Malware payload", "value": "58e5d0f871dd048f1efeebd6d2295a5bdd9956d57d8bb5736aaeee91a619bdfd470eb8257c2801b8ba664e2d1cb8cea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023344, "uuid": "36ade8f8-a4d6-4474-8bc0-76244ffc23fd", "value": "T1AD85EE252390CD61F36FC07683E56E79B9B329213733D8866E4855312BF2E2FE781196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023344, "uuid": "f3ea2a61-30cb-4e51-a9c1-36399361ee21", "value": "60fbd35de1521df68e303d54b2c1b0c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023344, "uuid": "c9d40a50-a2b3-44d4-ae81-982d2dca894d", "value": "24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNA:mbTChxKCnFnQXBbrtgb/iQvu0UHOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699023344, "uuid": "2503466f-e73b-4db2-82b9-d9e4ccfa71c6", "value": 1811758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699023344, "uuid": "7bb04995-4b0d-4b91-9874-087da1ec5a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023344, "uuid": "dcedbd29-7bb0-4e66-8fbd-0a7d32124f1a", "value": "d8a2f79ef593016b61a3bb8d0cf87312c162f5abc26cc44eb8653545c25d5808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28851bdf-7a41-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699013076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013076, "uuid": "6d2ad2d2-1d5c-41e4-a539-d074480dc51a", "comment": "Malware payload (Mirai)", "value": "eda373ac42af75ea8430dc542e77f78a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013076, "uuid": "10081c00-73a8-437e-965a-1a68e8086df8", "comment": "Malware payload (Mirai)", "value": "d8a560647a6646d67b7551ba8e5b4e9667a920463b148b26a37e02b34113a95e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013076, "uuid": "99ef7ba0-3b1c-48e9-906b-1683ad5fe52d", "comment": "Malware payload (Mirai)", "value": "bf357a9d9adb46a7de73b3af227fd22be85e5af2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699013076, "uuid": "1cd1949d-2936-4c9d-997d-81c163882e25", "comment": "Malware payload (Mirai)", "value": "1395c243524776d64fd35e60f0beb4c97914285c078e6232050e05095a349b2c92b316a52750f1308bcfad227bbd47ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013076, "uuid": "4f1ee2ec-6d59-4837-b891-56228c370897", "value": "T1C1C2E124A3420927CB750C7786DA459A36F1DF35F3EE3023EC598A768DD294B6478A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013076, "uuid": "6cda18e9-b18a-4a8e-882c-c1fae2b20931", "value": "768:PAWAJbvb9pBOKSI/bsV/LkjVx2I3dV0XWs3Uoz+:AZvb93DSIwBQVx2Isrz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699013076, "uuid": "b75cc7f5-f35e-449b-bfc7-2277c474d886", "value": 27560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699013076, "uuid": "fbf09064-affd-4844-831f-14b35e858491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699013076, "uuid": "b485cb0a-e53b-476c-b9aa-a9027527126d", "value": "eda373ac42af75ea8430dc542e77f78a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6293a0f2-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699032930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032930, "uuid": "ee5de7fc-bf5c-4f82-b2fc-3cb793873e8d", "comment": "Malware payload (RedLineStealer)", "value": "9015c9cf29a83e0022df723323d70afc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032930, "uuid": "e3a95037-1d53-4555-bf23-c34e129bb8ce", "comment": "Malware payload (RedLineStealer)", "value": "d8b1deaf8eea26368ac53d865e0f236bd3e5f0e89a44dcc85f01820c7d90539e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032930, "uuid": "086764ad-fe66-4d8c-b7a6-9d52e2464a7c", "comment": "Malware payload (RedLineStealer)", "value": "abfd5ac8465990e320c1c360308baf4dc26f3a04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032930, "uuid": "299d9c7f-cd9a-4ec3-baeb-baac012d28f9", "comment": "Malware payload (RedLineStealer)", "value": "bcd2674d09ff3f2311139dee84d00f05c228526d8e5ec3a28bf222b3c3dd2081c9bcc685113d9ecd5e1bcf9e563057ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032930, "uuid": "8d75724f-c9cd-4e73-8e36-1409b31e2551", "value": "T1C285FA1176F95B59F5F30BB85ABAA616087ABC6ADF11C2DF1251908E0C31BD08970F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032930, "uuid": "377803cd-3806-49e7-89e6-4fa8f19cfe11", "value": "d47242ec56e1a1639468f1233564ee05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032930, "uuid": "43c358b9-3802-4628-b69c-1f453e214972", "value": "24576:Anul0rGPjHIsS8ntwxV+pEH6a9DhvhBPGzzR:AYjHIsS8e++H6a3v2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032930, "uuid": "c90859d2-4da3-4627-82f5-af3c4e110db3", "value": 1743624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032930, "uuid": "bdbd2def-3901-45d0-afe3-cf90ca649ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032930, "uuid": "f874ca37-77a7-4de9-909f-431d9d2046b2", "value": "9015c9cf29a83e0022df723323d70afc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6968585a-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1699028217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028217, "uuid": "3b24ee6a-ec02-4396-88a2-b7f31c4ff0db", "comment": "Malware payload (PureCrypter)", "value": "96b331264750a1ad12ce9f553d57dcfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028217, "uuid": "c831566d-488d-437f-898a-56fb6c6d7483", "comment": "Malware payload (PureCrypter)", "value": "d93a9d617a55b8f02ee32a7eed8c95751482a0d98226dcc8585968e85c4f5721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028217, "uuid": "efb918f1-bf81-4dcf-9c33-31b049404775", "comment": "Malware payload (PureCrypter)", "value": "c86b3a6d0ccf2e8a508ff9b5a8ab4b8be4cc1e00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028217, "uuid": "13004f85-9000-4a8b-93e4-7bed6ea9856b", "comment": "Malware payload (PureCrypter)", "value": "64212b5bf0e3afd5339cfe50833b4e827e35993e2574c16d2511d7edf918c057aba8819c94e90cb7870737740e5d4afa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028217, "uuid": "d7e25636-292f-4869-82a8-3d5ca8446405", "value": "T1E0F1A49533E89336D86203719D739781537DEF60A983DF2FA890654F2D5238A4E22B74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028217, "uuid": "eb94b986-9497-4fcb-b91b-b9e6b2b532d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028217, "uuid": "091e06cf-ca3e-4d03-9135-b4fd450ff774", "value": "96:QwXvgQh+OPx4POPqaHjASJv47EHKB/TVY5zNtJ:Lv+O54P6jHMSuoo/67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028217, "uuid": "7e866056-bbd2-45dd-93ea-874ededbe014", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028217, "uuid": "cc2321ac-d9c5-4b02-9c83-513d7d155ba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028217, "uuid": "e272dce6-b33c-424b-a5c9-e6ef1d63b40b", "value": "Uykndrdm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7bbd65-7a14-11ee-8907-42010a9c0042", "comment": "Malware payload (ItsSoEasy)", "timestamp": 1698993703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698993703, "uuid": "6c0a814a-e40c-48b2-9d0a-22ec0ae29989", "comment": "Malware payload (ItsSoEasy)", "value": "71a3802f52847e83d3bacd011451b595", "object_relation": "md5", "Tag": [ { "name": "educational", "colour": "#BD4D03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698993703, "uuid": "d95e0fe7-b004-4de0-a497-985d0809e036", "comment": "Malware payload (ItsSoEasy)", "value": "da1a6f5a5312ea5776be761f446e3d15d42b785004b967cfc034e8984d1c88ca", "object_relation": "sha256", "Tag": [ { "name": "educational", "colour": "#BD4D03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698993703, "uuid": "10b0732c-e2de-4d01-ad2f-1afc5b5401ad", "comment": "Malware payload (ItsSoEasy)", "value": "3e3f59225ee95442b9ae67d8500ee76bde36bd98", "object_relation": "sha1", "Tag": [ { "name": "educational", "colour": "#BD4D03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698993703, "uuid": "40078f0c-b814-41ac-9950-77fa3fce0f5d", "comment": "Malware payload (ItsSoEasy)", "value": "70e9de76d6af8aa633d6e7513617439dd440379646239e252ec67c896dbf270b8dbd5daebcc8eb6c46995ba86e350a57", "object_relation": "sha3-384", "Tag": [ { "name": "educational", "colour": "#BD4D03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "itssoeasy", "colour": "#6A7C0A", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698993703, "uuid": "adb6700c-199e-47b4-9ae1-b5d7de2d279b", "value": "T105E63318337084AEC26A913741ABC73193B2B8075B10C99F5E5417B51FC3BA2EE779A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698993703, "uuid": "29a6cf94-88ea-4a83-8ff0-738857022b68", "value": "bb2292057634957dfa559b6eef7b52d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698993703, "uuid": "a494bea9-b410-472f-878a-0f8367d99b24", "value": "393216:El9c5hlEOlh2p6/PNuH0p03SB4wryZhq:EvEhBQp6tuH023s4w2Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698993703, "uuid": "ebe8c40f-06df-418e-bef0-1b44e5f36e8a", "value": 14760237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698993703, "uuid": "bed871cd-5be9-4904-8990-98dd3b8c1ed2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698993703, "uuid": "07ee1a66-1279-4313-934f-8c285356bb5e", "value": "itssoeasy_win_py_v1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93251cb-7a1d-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698997964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997964, "uuid": "560696b4-8486-493b-b8ae-3cfe2ac16ff7", "comment": "Malware payload (SnakeKeylogger)", "value": "71c56c7c4b213fe43a0acea6467d58dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997964, "uuid": "04a204e5-d2ee-4999-8450-bf5a9a33a51b", "comment": "Malware payload (SnakeKeylogger)", "value": "da46c2f32055b74582d0ba99db21973c6e011ccbdba451ebf237f10e30401fe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997964, "uuid": "08c58ae3-7b5f-4156-81cc-b65e5c2ffb1c", "comment": "Malware payload (SnakeKeylogger)", "value": "2ea7d1641c51f94de578707f8b0759fb810697d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997964, "uuid": "1dc4ab43-9f31-4f4e-8e10-ac1cd367ba34", "comment": "Malware payload (SnakeKeylogger)", "value": "770feaa183ff2885d4b420934738d12d6f79bd33fc55a7d310e7f4e9d1214f9367a74dfeb635f976627287bbfa789a08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997964, "uuid": "3540eec4-8f69-409b-a963-6f5d78272df9", "value": "T1B0831807B74A95B2C2485B3AC69781208374DEC2BE5FD75B78CAA31618177EFE90434B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997964, "uuid": "4cf5cd9c-04e4-49aa-a523-5d92ef60a1e4", "value": "1536:luTCfkB5q6KWvLB3UfurR960JOnLHqnYXdKk:f86furPD0LHqYXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997964, "uuid": "7b360e04-62cb-439e-a9e2-17fd061e98ea", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997964, "uuid": "03e54211-6147-46ff-84f0-f23a6694e138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997964, "uuid": "adde29f0-929c-4686-b73c-8f27620faf90", "value": "DEKONT_00011123_5600966797pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d98180d-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996898, "uuid": "486d7ae2-5bd5-43d3-acc7-9302b5574b3c", "comment": "Malware payload (GuLoader)", "value": "d1b2325dc1feffea8218cf7c6e1b8253", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996898, "uuid": "2ee336bc-c3ef-4962-b9f2-c9976acc6cde", "comment": "Malware payload (GuLoader)", "value": "da6b79b72faf479793365b15437bed84247be97d20036aba229e8c1aadf2b570", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996898, "uuid": "edc73c69-88e6-4396-abc3-69b1187880d3", "comment": "Malware payload (GuLoader)", "value": "54384e4b9a85841ca4cf5d6f969f2efd4a83fbc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996898, "uuid": "71634225-d017-42e0-96ee-d8b046b3cd2c", "comment": "Malware payload (GuLoader)", "value": "016db1428ba80aaa2a2d31d1d3f7a181fb52efade8f5c967e8da9161833de86249a860a51a8f9101895956f216f9e463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996898, "uuid": "50f4436d-7cbc-4f03-bc6b-b0191775e002", "value": "T1F91523D076F0D8E3C37BA2788199060EEBE4FE26659797CB4701391CFD72B839616294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996898, "uuid": "773d36fb-0dfa-4c88-8a68-171c04df67c6", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996898, "uuid": "6f76a18f-ad75-41a6-bea1-ebb0ff92b0bd", "value": "24576:INPx3TpVHdztdm9C4HQiRz6uc1L9J8xVCT5ATqY2BXY6+g7:mBTd+Swz6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996898, "uuid": "e9b5d788-baf8-40f1-b3ea-084c94c8babf", "value": 894335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996898, "uuid": "863ee9ce-094f-4963-b0ec-1f433b0a0ed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996898, "uuid": "270af314-2dec-4cee-b782-2932b88833b3", "value": "Moskeqs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d4b145-7a25-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699001319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001319, "uuid": "2d465d17-7ccc-4c95-a36b-2efdab894488", "comment": "Malware payload (AgentTesla)", "value": "35b36d0ea52a8a62c6f029b3f0bf0935", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001319, "uuid": "1a28d3b9-d6c8-4ab3-9133-8f775ccaed8d", "comment": "Malware payload (AgentTesla)", "value": "da75778d7ebfe9d20f3f4e0d39691afbbf0aab526d509dae99010c92381c042a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001319, "uuid": "dea519a8-9a8e-423b-a4aa-bc54cda94ac2", "comment": "Malware payload (AgentTesla)", "value": "7c277fef0d5d26676662943368cdf4de5758d439", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699001319, "uuid": "019575b9-46b0-4cb9-a3f4-6c19cba6faac", "comment": "Malware payload (AgentTesla)", "value": "808293b4302fdf7b6fc13b7c901ef7deecb13330258bb5f9ff93340724f17b0373decffe8b0cb821a1a759f42da81895", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001319, "uuid": "280a68e6-4224-4d22-b7be-66f9b2677fb3", "value": "T138C436C0788F5526C5ECF03E90DA6B9B61173FF20612F5775894BE47F21DA830A82A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001319, "uuid": "bd94bdc1-9f86-4acb-99fe-bc8d03116b02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001319, "uuid": "35d6d2e4-f1b2-4c68-bff6-bd36c4f4fc3b", "value": "12288:koWA468sXQx8+92WM+RtCurnVf99v8haK4+:z3useZ9RtVrV918T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699001319, "uuid": "6d6a6633-ac73-43c1-83ca-9b23b0d71217", "value": 574288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699001319, "uuid": "07a51d13-a118-4532-a443-c2c7e7e7afb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699001319, "uuid": "714b5ec1-bd8b-41a0-9ee1-c0a7855c8d48", "value": "HFQ098654567808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b565a9c6-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996992, "uuid": "95c2ba00-8651-44b3-b8a4-15d6cc16f02f", "comment": "Malware payload (GuLoader)", "value": "ac4a099044dc489f01144ee013af5c75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996992, "uuid": "fcdc2a8c-c8d1-4f24-96b7-fa3e5bf21cd2", "comment": "Malware payload (GuLoader)", "value": "dadf45de5944a2828f050a7eb71c84e062244203d6de6514b6ab12ed65b0db66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996992, "uuid": "37fb5cdd-581e-407f-92b5-7cd1525c5a87", "comment": "Malware payload (GuLoader)", "value": "8c226aaa40093cd60edf2e5751de9a6048cde3e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996992, "uuid": "b89f64c6-fd80-4c8b-85ff-8a988054a228", "comment": "Malware payload (GuLoader)", "value": "d60a777cdf91fe87533719932494ef152a7d00a362cb8792d0fee48d0c221338dd9a35bcdfef088fd2f66c80b9e59a5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996992, "uuid": "850cd43b-c642-4bf7-9462-19b7903642cf", "value": "T1990523A07BF0E1EBCB7B52345299671A6EF5EE209267870B4B013E18FD377C24721294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996992, "uuid": "0d00d29f-1fc6-4d2e-a661-245f0a88a7ba", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996992, "uuid": "11c396d6-7390-44cd-9fbe-ccd02435b413", "value": "24576:INPx3TpzkLNup3LRwF0+2XxnJJz6uc1L9J8xVCT5ATqY2BXY6+g7:mBTZKNuBdKyxnz6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996992, "uuid": "24e72423-425d-4afd-bf2f-c00c78cd5697", "value": 837691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996992, "uuid": "bd9c58cf-02be-4e8f-8df0-121ec7d296ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996992, "uuid": "53717c01-9897-4b78-80a0-66ada5164c19", "value": "Slgtsforskning186.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1c2178-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699032923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032923, "uuid": "99027c3b-e8c7-4dad-a34e-a6d11606a086", "comment": "Malware payload (Stealc)", "value": "0eef76e86c0cffcd722e0ebb149f138d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032923, "uuid": "b3fea26e-339b-4bc1-88c9-e07c199d4c3b", "comment": "Malware payload (Stealc)", "value": "dc84380a46e1c26626db797d8e2f9e5e64096c5a79539e048e3ffb395b406e3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032923, "uuid": "ad1a398f-129a-49e4-a1d9-69e31d4b2c87", "comment": "Malware payload (Stealc)", "value": "29676c77cfd57d347c91a986b28c39af8c3fcec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032923, "uuid": "d31aca9c-7077-44bf-8c01-d3b2169ecbb0", "comment": "Malware payload (Stealc)", "value": "62633b148a0ea9dfb7d62806c4735f0f12abd36c1275a0f2ec7ec8830739acc653a624ba060b106a2f3ce5d51139fd86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032923, "uuid": "d66edc65-d60d-4db5-8117-2a4bf6f6428f", "value": "T1E3445C1363906C61F5239B338EDEC6F4E61EFA518F1537AA17586A6F09701F2C272B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032923, "uuid": "37514528-d68f-4c5f-8998-9a942eec6faf", "value": "ce8b02cf0e0e47bfce02667d7460664f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032923, "uuid": "e13bb1e5-f252-4399-9dc0-fd5e88e1f6f9", "value": "3072:7JwwpmOxPN2KkNnaXw9ak+bGOfI5jlhDIqKP4W7vWyXeaU09+Rlu:9vmOxHkNaXw9ECWUJhDIqzCvhXOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032923, "uuid": "430c4ff8-48ea-4bf6-9ba0-f6b3e22ed64d", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032923, "uuid": "ff3470de-51dc-4537-bfda-7177bfc9af08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032923, "uuid": "af1f1d2c-a905-433e-b0ed-cee93f8e6334", "value": "0eef76e86c0cffcd722e0ebb149f138d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13535cd2-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981258, "uuid": "fc630763-bbf7-4050-b8b0-e6f057eb1187", "comment": "Malware payload", "value": "196b70fba0a808716690b4feb92e8a79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981258, "uuid": "86b273ec-081a-4062-899b-1bb4312e894c", "comment": "Malware payload", "value": "dc951060ab2912330e7389f1a1b0a83a96e91288a6c447def242aa49831d7dfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981258, "uuid": "e44e59e8-ac2b-4cc0-be88-d0770005a165", "comment": "Malware payload", "value": "65e69b7c194c1effc03c44fe4b05aead5721143d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981258, "uuid": "88c88627-fd3d-428c-8f1f-9236b7c053d1", "comment": "Malware payload", "value": "96366fe60d81abc76628fdeb8ddf4372fcc6afe37923ea16a01b607d63239846c7fd2ace89250b3b20ca473438aa23fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981258, "uuid": "80c44a43-8190-41ac-b555-17d6e363fdc1", "value": "T1487533EDC660D2A5D24C5E3D9C4ACBB8DD719EA09E09C8078EF57F983D396A47C29403", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981258, "uuid": "f56604b5-7aa9-4877-851e-f0428f80fbe6", "value": "1f8263c9f620bd59fc5e4a1b65baca7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981258, "uuid": "16ae5ca8-b8c4-4806-8b07-ae4adaceb81a", "value": "24576:GeiZSLo0XDk2fyDeUJov6Sdm8dLmBxMwVWH+bmXKigM8ArmvEOYoOdwA4ZGNk+:GXKkayiU26s2xsH+bm6iEkCAv4ZGy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981258, "uuid": "3d48f94d-c2bb-432e-a02b-bc6853857e76", "value": 1575800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981258, "uuid": "8e0eb76b-d3f5-43e2-a44e-e6880316079d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981258, "uuid": "76c9e191-efcd-421f-8d0b-51053d37b911", "value": "SecuriteInfo.com.BScope.Trojan.Downloader.7989.30092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82ef1dc-7a27-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699002258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699002258, "uuid": "f24a7ba7-7bdf-4b03-9d65-a9193c0c8f29", "comment": "Malware payload (RedLineStealer)", "value": "a6b041f5cb6d41da7f62d0457d063305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699002258, "uuid": "d9293b17-8c64-4d68-beb3-39ad1733520b", "comment": "Malware payload (RedLineStealer)", "value": "ddceae3ffeb39f0e52e7e7302557ba38dfebd62bf4117fae9daf4f41c2295f03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699002258, "uuid": "929f64e7-3554-4916-b47e-320f980dff32", "comment": "Malware payload (RedLineStealer)", "value": "d40f1f41811b311e2e014227f9cd217499036b89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699002258, "uuid": "f724119e-812b-4318-a051-43e835252788", "comment": "Malware payload (RedLineStealer)", "value": "298d6a0294764df685490dd724021f39fc54775c66e83e4601a51d56af4cea882f72c5ffadbc9c4359168c7a5a6d8f69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699002258, "uuid": "6abb99f3-3777-4091-bac2-5e3e94c6f56e", "value": "T10E7533FC106BD049E2288F32E1D5C8225D5277B5684C637A61FB3EDB7E7B9A51BC9020", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699002258, "uuid": "71dc0800-1681-42a4-8334-ea244d543327", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699002258, "uuid": "c6f209b0-f323-4d85-b97d-c70fa9450303", "value": "49152:2G50aBYnr9N9XhozCdnU+0fapA7kNLjFb4ns5:HfBGtX2zCdUpfaS7kNhss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699002258, "uuid": "b8189932-66f6-4eac-8584-92d9341a0fbf", "value": 1665024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699002258, "uuid": "454001de-d2b6-4112-8b9b-a1a932ffe929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699002258, "uuid": "002dc323-b0f1-4f22-b073-5c0c60d7f29b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691128c0-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699032941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032941, "uuid": "a397f7ae-4956-4c34-a5de-70203dce1e91", "comment": "Malware payload (RedLineStealer)", "value": "752ec7c2cbe87a760cc00e3e2457f959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032941, "uuid": "2764f70d-3e04-4620-836d-d0b0e92e0b0a", "comment": "Malware payload (RedLineStealer)", "value": "de86ccfa4a355342458fd2cc68f79ca71df2e5d390cf64006d9a2da53c00d111", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032941, "uuid": "5ecc4fa5-0da1-4dfd-9a19-04117712ed85", "comment": "Malware payload (RedLineStealer)", "value": "ba8fc8436c54e1121922d70a5279b504622478b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032941, "uuid": "f324773f-76ad-4dd6-9e6f-db0c1ee5f26b", "comment": "Malware payload (RedLineStealer)", "value": "d7dbfaa12c08158c4db682cb76f1514ce2e30c04dca5b40fe14f6abe3f45e39fab890e5ed9dbed897928ba1e9b21645e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032941, "uuid": "db7125f6-fbe9-4b01-829f-840ead4145a9", "value": "T11585EA1176F95B59F5F30BB85ABAA612097ABC6ADF11C2DF1251908E0C31BD08970F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032941, "uuid": "cc6b3a98-9de6-4640-b438-7fed6dee5881", "value": "d47242ec56e1a1639468f1233564ee05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032941, "uuid": "ed869fc4-2171-4a30-96a7-6ca617e248d7", "value": "24576:pnqQ0rGPjHIsS8nVwxV+pEH6a9Dhvh9EpatzR:pTjHIsS8m++H6a3vMaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032941, "uuid": "02b0bc9d-ccc5-44b1-b8a2-1a6885249de1", "value": 1743624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032941, "uuid": "b8aa8eb0-7f87-45fb-94eb-fa2e1dbf4b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032941, "uuid": "472c5947-2fdd-47ee-b3f2-0e8bfa3ad77b", "value": "752ec7c2cbe87a760cc00e3e2457f959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f8bab1-7a1a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698996649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996649, "uuid": "4567b915-d2dc-435c-b210-aec7bacfbe51", "comment": "Malware payload", "value": "30f0f2d207eabd9d78e7029dc0709f2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996649, "uuid": "0bbc7d69-ee6b-4659-b346-3309250a26e4", "comment": "Malware payload", "value": "dedd6462ff962cff56edfec16029ecfd9b4cb1f26dadbfa29d83ba285f493040", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996649, "uuid": "5ce10f0d-4406-4e93-aeb1-bd3d68280194", "comment": "Malware payload", "value": "7c52d7117d91714df40a73fd2abb4426f85aed27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996649, "uuid": "b5a63e40-f7fe-4ee0-8620-73d47e7dff90", "comment": "Malware payload", "value": "a4de5b26a41edcef8bfb8e436a51b8872f881c2cb26dfcd22022c1a1edc1fd999dca2008dcb62771d29aea6b0c3392e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996649, "uuid": "4bcbc2d2-dc16-4d81-aeec-f5202f3d5f37", "value": "T1B5144B1A2BD5C78BC41F5F380BB2C515D3B6D6085A57C707BE6AAADD4E32AC45E832C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996649, "uuid": "97389f60-846e-494d-9553-6425a73ef4b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996649, "uuid": "651d1417-693e-499b-9d9e-e9ae862d9ba5", "value": "6144:8AcWrwWNuaiRPi0Nh7O0Q+bx9jMd+AcWrwWN:XcW8diahS0Q+b0TcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996649, "uuid": "3da19b03-aefa-4483-8f55-e8965fa32255", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996649, "uuid": "f7a4f86a-bb5a-46c9-9f42-bcd8ba6d58bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996649, "uuid": "fd2771cc-f724-4bba-8bf1-1a4f3bffd6c6", "value": "30f0f2d207eabd9d78e7029dc0709f2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c32f33-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699054697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054697, "uuid": "b8735c49-ebc5-44c4-a6b5-738c78ee44bf", "comment": "Malware payload (Mirai)", "value": "7f9a5a08be3d44c1cfb02078b0eeac54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054697, "uuid": "679c08c2-7252-48b8-b4bf-e657bcb2bb0d", "comment": "Malware payload (Mirai)", "value": "df54ae2e0b31ff253f5a3ac972e7425dfa9f5b252d16ff1669b6dcded4cd455f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054697, "uuid": "cc099acd-566b-423b-a871-a5b20a6a978c", "comment": "Malware payload (Mirai)", "value": "1169c63e0ea334bd8c8b9112eb871975df47d63a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699054697, "uuid": "5d14c427-96d2-4cd5-9451-d6078cd1f909", "comment": "Malware payload (Mirai)", "value": "bce504b10ae946b005478e301ddccbb5e56d2797272602edd7db7d4f023f91c7fd92e34eb9f54345abfafdf613aa7d1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054697, "uuid": "3f531a8f-d944-4f3d-b06a-7283390d2ae4", "value": "T1CC933911BC392D27C0D4A23F11B78656F6F9331E24B08A6D7DB51F8EBF546C4A8062B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054697, "uuid": "3c86512b-5caf-4609-a2fa-b76254889361", "value": "1536:q7V5milFQKh1vUcprFXWj4pHpLkXsDL9wOP/ZfiV0deSu:qPdnVsj4xVkXCL9H/oki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699054697, "uuid": "bd00deb6-49eb-46a5-830e-7a3b4ee6c1bf", "value": 96416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699054697, "uuid": "1f64b9bc-98d3-47e0-aac4-2d308861b135", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699054697, "uuid": "b0088b83-fdaa-4259-9440-420660035a0c", "value": "7f9a5a08be3d44c1cfb02078b0eeac54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92cce326-7a85-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699042460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042460, "uuid": "19a487cc-496b-41b1-bc10-d7fb844301f7", "comment": "Malware payload", "value": "fe9e5fe5f346caa35bed17f44ae01aae", "object_relation": "md5", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042460, "uuid": "6eed1852-8b5d-43a7-905c-cb03cd08e019", "comment": "Malware payload", "value": "dff942a5e4e09480637208b09ee7ff4c6c4531981dc4f122baa29a63dd6fba66", "object_relation": "sha256", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042460, "uuid": "d3efa5f3-abfc-476c-9907-8b4be2a5f40f", "comment": "Malware payload", "value": "aa5229f252f7a27ab39838dcea732c5a622ccfe7", "object_relation": "sha1", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699042460, "uuid": "944a515e-36bb-401c-b589-317635fbbc36", "comment": "Malware payload", "value": "b92aae6d67ab093cc8e954939ca4e5d1b5c947db44f3bd77e2bb8170f0471ee642c5d620d6203ec2521009a519ce46a3", "object_relation": "sha3-384", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042460, "uuid": "b4be70e4-ec7b-433b-8dbc-4983fb5d43ae", "value": "T1F7B4D0239D5949FF4F6470EE2B6B8FC528EC0980457DF67EE0C290089E8D5D5226A4FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042460, "uuid": "6c2ae9a6-86de-46a5-bdd9-7447db87bde0", "value": "12288:YAkzAtbQvrIKI5GFLU2r8odtJroLU7qmxZX9Qba31w/40L:IA9Qi5GFrbtJGlYZt6NL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699042460, "uuid": "aa6ad573-4b39-4895-ac81-d02b9825794c", "value": 512548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699042460, "uuid": "77a60d3c-eae5-47d6-bbde-22bd5f0e57d3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699042460, "uuid": "77683304-70e9-4d27-b49e-c31a121c1a12", "value": "yfjjdsnw.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005b45be-7a19-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698995829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995829, "uuid": "ff9984a0-2341-4c09-ae9f-169c5a146fb1", "comment": "Malware payload (AgentTesla)", "value": "00dd61e46445637de51c6a31423bad7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995829, "uuid": "6530df7d-8382-4101-a089-76446e062bf5", "comment": "Malware payload (AgentTesla)", "value": "e0335f642eb4b7deec9f038c09a6be39cfdac7fa609aef2bbb45c771ba25c1d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995829, "uuid": "0eb86f81-0096-4b48-8cce-eacff0815bbb", "comment": "Malware payload (AgentTesla)", "value": "51440eea0e807d8e1caa646deb5d08bdc552630a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995829, "uuid": "59b4ec1a-db9b-43b3-8216-fd99d75ff7ad", "comment": "Malware payload (AgentTesla)", "value": "dc5ed384bda66e6df73aec5386c77d957c6b4696d54dfb45a75482810f2c7fab05b891a8202e7a7f5c55040b9ae359bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995829, "uuid": "062b8135-089a-4d2d-b0c7-014b2097805c", "value": "T12AD4239BA9A46E9F994FF929D4BA13D812905CF5AC70D1E31D4C08B8054FBFB06217CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995829, "uuid": "cf5ab31b-2754-4b55-a6ea-3eb331738e9b", "value": "12288:4t8kuXXcryObxkEDgyhriqVMWTohBBnyo+gq+vosMZx7MKptdyZZfiLc1:ZZFOby8zwBnJ+fBfZnRyZZfkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698995829, "uuid": "6a705e8e-bb32-497b-96a8-57dd99a42456", "value": 607145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698995829, "uuid": "bbf71fc8-36af-4d3a-ad05-a39c197b48a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995829, "uuid": "f0776a1d-05f8-4de1-97a7-056995deb818", "value": "RFQ MT-764439977.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3b68f5-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1699032943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032943, "uuid": "e7c20e35-ba27-4548-b45f-291271f86d67", "comment": "Malware payload (Amadey)", "value": "0d9fb5a45c39be5842c2326fd4749336", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032943, "uuid": "f4cff61c-1088-4640-86a1-6c56487e2638", "comment": "Malware payload (Amadey)", "value": "e0b75924efdbf33c08617b211fdc00194f043bf0c2bdb45f74c3f3d7adef5323", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032943, "uuid": "95909e94-ac08-4629-aab9-c3754cb80e54", "comment": "Malware payload (Amadey)", "value": "b75cdc492f258531c4f97224f925247ace657edb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032943, "uuid": "9a928643-d043-42a1-ad9b-022d00303609", "comment": "Malware payload (Amadey)", "value": "70e8e718406a56a06af9d797b1be484f738919dc28372a6b4e96c90c8853051bd7ab5b5650d7636bb23fb10286b61069", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032943, "uuid": "cd791669-b664-4e21-a03c-22f0383edc93", "value": "T1FE85FA1176F95B59F5F30BB85ABAA612087ABC6ADF11C2DF1251908E0C31BD08971F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032943, "uuid": "e4d00107-1d24-4e5e-a62f-d90ae80bc287", "value": "d47242ec56e1a1639468f1233564ee05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032943, "uuid": "9d65fa1f-5058-4ede-a2c8-3636c58ffaef", "value": "24576:RnRI0rGPjHIsS8ntwxV+pEH6a9Dhvhgt0zR:RwjHIsS8e++H6a3vx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032943, "uuid": "69eb8edf-d473-4ca4-bf41-e240cfaa9a21", "value": 1743624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032943, "uuid": "6264535b-d6d4-49de-83ac-52be2b871540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032943, "uuid": "a553c27a-d299-4e59-a2d1-620db0b0f966", "value": "0d9fb5a45c39be5842c2326fd4749336.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccae502-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1699032948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032948, "uuid": "1d8b8e52-9cca-47be-82b4-b308a130c98f", "comment": "Malware payload (Formbook)", "value": "0ecfd27f7c9abfac64f27e35c057db96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032948, "uuid": "9e8e7cf5-3243-422a-b053-b44782b67b9c", "comment": "Malware payload (Formbook)", "value": "e0fa9c62364826149547d32728d06d155bdc6a54e90554695f8039bd7b73d036", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032948, "uuid": "e006f947-f741-41d3-855b-f67bef49f2e8", "comment": "Malware payload (Formbook)", "value": "0269c713a2b572b7765af4f99775a35c49a6b339", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032948, "uuid": "15f2a90b-e5ab-4616-88d3-7db5b56de3f0", "comment": "Malware payload (Formbook)", "value": "961f84386dfb9d00315b650be3be80c56c363ad9208f0c44a1bf1aa69ed0ffb1f90921cc1b5303ca014a12e52d2edc06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032948, "uuid": "932dc597-a040-45b5-973f-e395a164df11", "value": "T1F9E4E9342EEA5429F1BBAF7DC6E07596D76EB6633707954E04A102CA0713B42DDC0A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032948, "uuid": "c9b4df85-729b-4b87-98e5-2235c11ddb24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032948, "uuid": "3de22ff5-ef0a-4400-9ff3-ad546b3407a8", "value": "12288:QqnOW4zKT/LKvAo/QkEs5sht1MzuFdoZohLdivXRHEEU7/8+AK7U:Q+OFzK3KooYcKqzufsB3o7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032948, "uuid": "03a550cf-6e43-495c-9ef4-89995a344238", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032948, "uuid": "4951a9e4-d310-4058-9ed0-f929d11d9a44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032948, "uuid": "e502a4d4-c6da-4115-94e9-59478e0eced4", "value": "HEUR-Backdoor.MSIL.LightStone.gen-e0fa9c62364.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20c412a-7a47-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699015964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015964, "uuid": "d19f6339-d9a2-41ae-95d7-8c93893a43d5", "comment": "Malware payload (AgentTesla)", "value": "62bc6b3f021d4914ad9df5b1bb33f6ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015964, "uuid": "1e0d3857-3ef4-4004-865d-3afaf8e38d40", "comment": "Malware payload (AgentTesla)", "value": "e116957e9e143c090645d0e04b6b9c586a499b488e6012d4dc2a7519097bda3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015964, "uuid": "00057b45-b4b2-4e77-abc7-e66ad9b5d297", "comment": "Malware payload (AgentTesla)", "value": "3de4304b3707ab3292ba0476517231f927bcd879", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699015964, "uuid": "59e3e2de-6187-47b2-9351-0c46b3589695", "comment": "Malware payload (AgentTesla)", "value": "6acb1250b4ed8e02335c1e35ce74c542b74a04e712ddb34f6094326dd03497dff7b0c6ade43153eb88508834286250f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015964, "uuid": "d1f1d51f-3609-48ae-ba59-ee3d84c28574", "value": "T11012FA009BD9DA33DD7F077DF873A7420770E2466882DE6E69CC309A2D97B0415763A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015964, "uuid": "95701f30-fd67-4f94-9bd7-0677636bc3f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015964, "uuid": "81144af1-eda3-4b9e-9236-ea452aa867d4", "value": "192:BIJzS8xqp8amjfz6j4VW/JSztWTHvtNo:BIVy8amjfz6EQ/sxWTHvtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699015964, "uuid": "c8687fc8-17db-4a95-9f38-fb0f4302256e", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699015964, "uuid": "ec4503b1-6e84-4248-bf95-05e644cd42c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699015964, "uuid": "bc95b76d-2ecb-4583-9047-080c072a0715", "value": "e116957e9e143c090645d0e04b6b9c586a499b488e6012d4dc2a7519097bda3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb0ee8c-7a3f-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1699012551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012551, "uuid": "47037a59-9e41-49bb-ba7a-33a59c148e0a", "comment": "Malware payload (IRATA)", "value": "692fcafd124e57b9c1b9035c0a108aa1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012551, "uuid": "8f474ae7-0a25-47c7-91e6-872013da5bca", "comment": "Malware payload (IRATA)", "value": "e1346ae88753a44d85451566789a5b8c3b3423e2868d41a89378415aad04d688", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012551, "uuid": "07e10c56-a700-42c7-a05d-bbefc3731d4e", "comment": "Malware payload (IRATA)", "value": "10dadd7b5e8ddfd8c6ffe0f31129a27d01a54783", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699012551, "uuid": "42471dab-e0c6-4b46-967d-b767ad5885b2", "comment": "Malware payload (IRATA)", "value": "dce2f8ccb9ea02722ee3f5431ea9f3e3cdd141bbb7c5546733148c285476cd664b0a8f09c96c1b4b996fa6727eb46a73", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012551, "uuid": "0aa0d687-aa58-499f-b4c2-7555979d10d2", "value": "T1A7D52253F266A46BCCF6C3322275163510764D19DB43B78A292877FA34FBEE80B816D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012551, "uuid": "e7ef014a-3bef-4937-a075-7e9adc9e1375", "value": "49152:+/6EtL4/LrDlfe18926e+52dr5z039Tmfu0gExL33ZOENpPd1PaVEFM:0624jZf325z039TmfufExD0ENZdsuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699012551, "uuid": "37b96464-d458-4521-9fbc-22999e23bcd2", "value": 2838658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699012551, "uuid": "e6c451bb-0025-4fe8-aee6-4bef1bda7068", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699012551, "uuid": "995f4092-d26b-4ea8-a7f4-1c9971f5ed7b", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a62bc7-7aa2-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699055004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055004, "uuid": "8decb744-4ed6-425b-b061-977489f6858b", "comment": "Malware payload (Mirai)", "value": "bf0f5bcd5adadd4a01ffe22154c3e00c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055004, "uuid": "eadb7a05-ceae-41f2-bb3e-cd0714b285a9", "comment": "Malware payload (Mirai)", "value": "e2cb54df2f3f7c6760c64c8af177568f2c40890f82cd3b2659c0cebd9a348ae2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055004, "uuid": "476ede65-bd79-4027-b55b-d28c1a3f7ea5", "comment": "Malware payload (Mirai)", "value": "0379f210e7ea3db0c558b7f3f210dc17ceddaa17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055004, "uuid": "fff03985-0866-436c-a016-993ab830ad06", "comment": "Malware payload (Mirai)", "value": "2d1129bfd50445861268565e6437a99d5944a6b87c63db6e4eb21b4082cb4f6f3cdbea67855e19a05efefbc10f355b2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055004, "uuid": "09b15ce2-2c6d-4122-a303-2a4bf26a15c1", "value": "T10ED2E1EFE4B26A08EBFD087B809D1FF44D5DF19632551F063B128D4CE87A59BA80D068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055004, "uuid": "087723a3-fd6a-422f-870e-f93cdb5f5a28", "value": "384:ANpTqrBMyz2ZpRcZbsZGBdHIwFrs1PY1a910Jxc5s3ArKKLYF14Bo0Mp7RWGVCzB:ANFqrG9zcZe2HI0rA/9Gxd/14fKlW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055004, "uuid": "08461e0d-9eec-4b6e-8c70-4a7b3dbe16bc", "value": 28556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055004, "uuid": "92af9c5e-1b61-46ce-a45e-0d8cdb89fdc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055004, "uuid": "1fa0bfb0-da45-4217-8ebb-959c2c081900", "value": "bf0f5bcd5adadd4a01ffe22154c3e00c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab25d54-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996839, "uuid": "61f0508a-3b85-41da-aba7-27638bf75e09", "comment": "Malware payload (GuLoader)", "value": "d1d90618dab6b2024590784317fb9ea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996839, "uuid": "1774693d-28ed-49db-b8db-c0be56b0385a", "comment": "Malware payload (GuLoader)", "value": "e4d64fc5d68290bf11cbfb681ea35eb60f9aec646d9ab7dfa7221660c6c2b433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996839, "uuid": "fa2c3ded-cd6c-4933-9c43-943535babf17", "comment": "Malware payload (GuLoader)", "value": "da008566c94733024ec97bbe8a0e2f6d2a7ccc36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996839, "uuid": "9c098cf6-339f-4c78-ad41-fa9a93840103", "comment": "Malware payload (GuLoader)", "value": "680752b406cef4058ae3df580c78f13854e02800b17428af112f18c409cd0ee60ea26e68bc09e01d7324af8898811c36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996839, "uuid": "f5143939-d6b5-478e-a2f1-09857641dac3", "value": "T1C16512D37E144CF3E8295130641B49A3AB716FBFE681193A31D9FE2B487226B460E53D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996839, "uuid": "0872a48b-9aeb-4dca-9c98-33aaaf5d5347", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996839, "uuid": "e53b3a76-ecb5-4367-a1ce-28250af67d18", "value": "24576:eZmBzEZpUodceDqCI33nFWKq8WucI+9vrc6NlrBe7pyIvR5V1e:6mA5uCI33ndcI+9vrcode1yWRP1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996839, "uuid": "674f9077-24f2-469d-888d-b5d5df95e55c", "value": 1469996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996839, "uuid": "579fa4c5-599c-496c-a3e0-7f4d476fadfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996839, "uuid": "6a1cd9ff-1d6e-43c2-a8ae-fee6806ad4c2", "value": "Fra.0024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f866178c-7a63-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1699028028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028028, "uuid": "640cea14-e1e8-4245-aa89-854e0beeb805", "comment": "Malware payload (SnakeKeylogger)", "value": "0efb9fa85f31cf712388fcc55484bb96", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028028, "uuid": "54c9d525-1023-4384-a5b3-a4fdac8c4baf", "comment": "Malware payload (SnakeKeylogger)", "value": "e54a0d1fb979d19bf7cbf681df38b284bb5b1b9a5848e220bda941e0417bc7fc", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028028, "uuid": "bf281355-32ec-4aad-bbcb-82ab1953664e", "comment": "Malware payload (SnakeKeylogger)", "value": "e7f209e7b91a6429c0d2ee24a869751d201f4e65", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028028, "uuid": "53cedb7a-e733-4cb8-a2aa-8d5bbd26f0f5", "comment": "Malware payload (SnakeKeylogger)", "value": "bfcdc8c98eca0e20f55bb0ce61740144095e5fce2e1663bf6cbaf4a4f2d40a2a5ca9f21bceed46e7996ba14ecd860138", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028028, "uuid": "2b72529c-93d3-41da-8f84-7d50b74188de", "value": "T134352A0C77A4E818E17E47BD54926154A2796309BF42F74E67D058EC0E7EF238E1A2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028028, "uuid": "9ba9de90-f40d-4b38-b867-d3217fbed680", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028028, "uuid": "a3a52b1f-aa0f-4de6-9f6a-169e431a4424", "value": "24576:UZfxjLZisWPsuLkB/YAuseX7KvO1YAuJMi+sPV3GykDfMNVzCOgKIQtKoColK5da:0xjIPsMpAuserKvpAuJMi+sPV3GykDf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028028, "uuid": "7a93057f-b56c-4fe2-9940-8a8e85ee9c69", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028028, "uuid": "b6017068-a21f-44c4-a8e0-c96d0ae4c43c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028028, "uuid": "e96c8b17-a1ac-4dc7-b4e3-3724feb0c9b2", "value": "KFQH Blank Booking Form.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5e98b6-7a3c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699011200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011200, "uuid": "97c39fe5-76df-4929-81c0-32ca8d51280b", "comment": "Malware payload", "value": "ae671ec288d7e60755ddd9bebd44fa6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011200, "uuid": "b0beae43-3757-4bbc-bd5c-37772561d31d", "comment": "Malware payload", "value": "e5e47731a20bd455d7196d9fa37a6243cbe7f8e1f0042c571d9a4c3e01cd6f66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011200, "uuid": "87e2e932-4028-4138-9693-47474f090fd0", "comment": "Malware payload", "value": "3910e8ed01e7917af02cfd5cd2fd594bc3b3f1be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699011200, "uuid": "f2463709-d44d-43fc-bc34-b21a7eaad91f", "comment": "Malware payload", "value": "5936aed02f100b87c3fec8e57128a02d146960f1d4af4a82c6d237aaf34cd87cd16fb1fe7645df358852c486baba2dfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011200, "uuid": "3179f042-35f5-4a90-9165-9683cc881950", "value": "T1EBC41C03A6CEE9F2E22E03B6CC56B2188691DD41926BDD057E05F6D75332355EAF302E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011200, "uuid": "eca866c8-67bf-4db3-9766-3721ddbb3956", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011200, "uuid": "efce7f3d-e5b4-4482-8bd9-15b37b1e7ac8", "value": "3072:gJdDqIqC8KQFbvpaQT1guYIJ1GYpQIgXmW+/rUfuFQbsXKlBz7vUt9pgaP:gnOtC8NDUQ5CQBQIjLrUfeQYXKlBn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699011200, "uuid": "6e103fc0-bb0f-4fd7-90bb-0dd92a4bb6eb", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699011200, "uuid": "0af0bb1f-5705-4a7f-b5f5-72ae210c7ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699011200, "uuid": "a2283bab-898b-4aa3-a6d6-5ca661e2e373", "value": "e5e47731a20bd455d7196d9fa37a6243cbe7f8e1f0042c571d9a4c3e01cd6f66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a972b23a-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998260, "uuid": "581d8b83-6f76-4d3d-a350-cdaa5260c43f", "comment": "Malware payload", "value": "60a0eb0d94f0e11e8518e0626d2cae2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998260, "uuid": "60e49214-a4cb-4680-a89b-030a68565df1", "comment": "Malware payload", "value": "e681dd2dbeea2b8f3e0d9ab8966db7cf35e0c919decd23c24b8388b38b2b5d24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998260, "uuid": "e69d3cab-01ee-451d-9c89-8083248eae41", "comment": "Malware payload", "value": "5b516525f0c0c2e460acba0449fc9a4f44924cf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998260, "uuid": "30868cec-946c-4aad-839f-1c2a35d12d99", "comment": "Malware payload", "value": "5004c81e948d05063310c9d2205a7083e7deef21a339e879b8a8e3ec60fc355fee0411ae98f54991c71dc034ea697299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998260, "uuid": "51d854e3-1ab5-48d3-9cd2-701182f30064", "value": "T103F26D1633547533C6340BB2D8E392B01679DC956424C3EB4CC4B99F6FFA71799222EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998260, "uuid": "69246791-8423-4c20-8533-afd4d79fcbbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998260, "uuid": "ddef13fe-0173-496d-98d9-6c5806d4a92e", "value": "384:qffff/LtL+LfLgLnGlLHKYGBOhrOWpfNBgi0tvGBloaeK/+9Zkm1BkvxlRdHj7Y3:AR6TknKTK+LItviFD+9BvOdD7Ypt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998260, "uuid": "e3dd888a-73d0-4296-865f-61d52c9c3b4d", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998260, "uuid": "c8dd1232-e645-45ec-9c38-c80b56b59df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998260, "uuid": "6f78634e-908f-4a36-ac39-eb65e510cbd3", "value": "Ithojli.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0cb01d-7a22-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698999845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999845, "uuid": "87023d00-7792-47da-8dbd-85f3296e8040", "comment": "Malware payload", "value": "b5edb6519b5034e811f65118267efb29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999845, "uuid": "952723ba-b5fa-468d-8eb4-4594b8989df4", "comment": "Malware payload", "value": "e6aa1556d72c70fac86957047b787c474e8ee47f3c47f4fd7326d90628068be2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999845, "uuid": "649a466b-1704-471e-93a6-b381a780452b", "comment": "Malware payload", "value": "a1eea1171e85f99df956308573d210199a183845", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698999845, "uuid": "68948468-19cb-4026-8b59-6427b7739038", "comment": "Malware payload", "value": "f81f9e4659906d036fc81d5e708704cbda08ec97103d8f98e696d8f463444f26365af47bbb94c6df2c691b93545faa22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999845, "uuid": "eb17e987-b37c-42cb-b430-39b98f4b1e07", "value": "T10BC417136ADCBCB5E1B256702B7783E097BEFC212930C91F23C0491D597D992B921BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999845, "uuid": "7ebf6016-b841-4cf2-bafe-e808283b0f74", "value": "424c3ace0397058dbe22bab9e22b8c58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999845, "uuid": "43c7de4a-0178-4ed4-83d4-d239f2438553", "value": "12288:BFNIbiTShdX/O3lvK9Xbg21oseMb01JQntLOCgOieWh7X:BPuiTShJ/O3v2Gsemgdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698999845, "uuid": "a3bc3a67-8ab9-48ed-b91f-40fda42a98df", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698999845, "uuid": "ba5a6e61-a877-4ab5-b582-d7c5ca7ef8ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698999845, "uuid": "856c62b8-f6db-47a0-8bde-dad15b7bf690", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9a1e60-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698997057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997057, "uuid": "ea797378-d27c-473e-90bf-8bf05e948af9", "comment": "Malware payload (AgentTesla)", "value": "4eb89f9a55099138b9f14348bf4a9ed0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997057, "uuid": "c6d68afa-516c-4cfa-b3f0-465ab11c1bdc", "comment": "Malware payload (AgentTesla)", "value": "e7e92ae4a132c707e85840e90b4e6b1220a6b9c56dcf2d5b5d9698943112d0e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997057, "uuid": "272ac627-224e-4acb-886a-83a775c30782", "comment": "Malware payload (AgentTesla)", "value": "b4a50889a22b1756aafcc1086ee0356c16f7c24a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997057, "uuid": "b2d2c4aa-2558-400f-96c4-cf5e413908f2", "comment": "Malware payload (AgentTesla)", "value": "534e90f701b66fb8225918b873aadb88a1a8a58143c27dbee8e87b7283537f68971e4f8616835e9bbfaa724d0c8922cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997057, "uuid": "87f72ea3-1c17-46a5-8c97-be97e7f079bc", "value": "T1C125F101FE818616E84847754DF38AAA1366FC50AF9B460F328DF71F3DB46A06D33A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997057, "uuid": "a198c8eb-6e89-4741-8423-6914b873f905", "value": "24576:+2Biw6/13bVYw6/o3bV/br6JXWywcynBiLuQdhwJJ:R6/13bVT6/o3bV//IXWyQBiS6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997057, "uuid": "6d42c3f6-54ba-4548-9bb5-b87fdc6ee625", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997057, "uuid": "a129220e-da43-47ee-83cd-fcebe8b8f050", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997057, "uuid": "cd4cb981-c8e9-4709-a540-2648ec9d32f9", "value": "REQ-102.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dff5561-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998080, "uuid": "e2caa22d-0d2f-4957-ace5-4dbd9a04e687", "comment": "Malware payload", "value": "fb7815259647ade16a0d237c26f7a11c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998080, "uuid": "1132b26e-a102-405e-85e8-5672022d80d1", "comment": "Malware payload", "value": "e82a7d1c9f4ad88d913bb35eeac7a55cebef53ee0a6263a162b00fbd4f9b092e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998080, "uuid": "3b4ef91e-b653-4ed5-8df5-bfd14403abae", "comment": "Malware payload", "value": "f4d002219c8377d86eff7d729955ca9cbd115760", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998080, "uuid": "3e3ac131-e758-49f8-93ff-5e9cad18f7c1", "comment": "Malware payload", "value": "f81df397ceaa88b24b259cf20cf4fe5a07544bea109b028969368c261f15afdcb359708cfe883a46f266ab73950ac845", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998080, "uuid": "52a3272c-b6ac-4ef6-a530-ed662505f1f3", "value": "T128F4232F97D749A6FEFA753680921136EC931824013B1E183C6360472C6E71D95BDFE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998080, "uuid": "88d4c2ff-b7f1-4016-9587-2d125c5d5b8d", "value": "12288:E0y8mdsUxcZ3bDtE9GXDucZzccCy1OKiEcvUAu5E3uId5lo6obDKE8VMghYZpKVa:W8kY/tThZ4cCy1OVEITdbFoPR8VMgrbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998080, "uuid": "393fe8a5-2691-49ba-b3c5-44524e7a3689", "value": 730874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998080, "uuid": "f7e08c69-7269-46f2-975e-4414eafe096f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998080, "uuid": "8a895a38-8620-46c9-a4d3-ce603f1d9321", "value": "Payment.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e056ec-7a17-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698995087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995087, "uuid": "d4bb99e5-ea70-4a55-b53f-e3b3fdc66c7d", "comment": "Malware payload (Formbook)", "value": "4f64ed2d92f8cf783e3da668424e8eea", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995087, "uuid": "006bbcbe-6a4d-43e5-9570-6085b2c7d936", "comment": "Malware payload (Formbook)", "value": "e8e81093cd010071c77404527269918ccc4cd59c23713cba8954c91abde4ee28", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995087, "uuid": "6f04260f-49f6-46ba-95d1-15de689a7efd", "comment": "Malware payload (Formbook)", "value": "5a2beb11fc3bd5b88557603245a5c32263ff208e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698995087, "uuid": "9e66ca0f-29b3-434e-b988-193110ff51e7", "comment": "Malware payload (Formbook)", "value": "526813e5968c8c072f18a616f315caf231f7af55e82f89917b61b2b634c5720e86c8fa7ac7cf0f698d8b12a267ff772b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995087, "uuid": "fec65bac-1fbc-4512-84af-e357a527f20c", "value": "T1A9C423FC20920FAFC196DEC7FBEF5CE4E084617A3A68A64175C498E15036FDA5106CDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995087, "uuid": "dfe46413-3c7a-463e-9bb4-7194b811a4e9", "value": "12288:EXVsHM0+gOmGp3xcEQHtuzaIoekVUFZquFuC2f/Jfawl:EXVsHM0VRGRxcEGuzaIoekVoZACgxCwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698995087, "uuid": "9f048d86-96b2-4c7f-81e2-8a010751a9c3", "value": 581211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698995087, "uuid": "b1879858-20a6-4496-a3a7-9d1e9baaa44d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698995087, "uuid": "6b946499-730f-4251-b460-4c1c90e400f6", "value": "PO 876-1057.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50607cb2-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996822, "uuid": "e0a82d89-1c76-40f9-aacc-0efd23767a31", "comment": "Malware payload (GuLoader)", "value": "5dc1cbc32c9a2ad7b7e1c40c40b9b68a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996822, "uuid": "3b172d8c-7555-457a-ab39-c569ac845c6f", "comment": "Malware payload (GuLoader)", "value": "e8f95c359540621339b8d12ac34789fba13df96a5d801addc3f9a56ccfbb1195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996822, "uuid": "b2348de5-37a2-4ac4-839d-0ece8ccdb461", "comment": "Malware payload (GuLoader)", "value": "18c79d81e1ed85fdef071947dcb8bfb726a68909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996822, "uuid": "ebf87cb5-67e7-4a9c-88e5-bb0672f6c6c3", "comment": "Malware payload (GuLoader)", "value": "ed38f99b5f5d33b45c50bbf2660c1fea5b07304af75f5819ac9961f2f9150b3d5ea3556129e0d02e11a70f996d97cdde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996822, "uuid": "24e79fa1-4b2b-4592-87a5-914a25135d2b", "value": "T1A96502D37E044DF7EC295130641B48A3AB746FBFD681193A3199FE2B48722AB460E53D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996822, "uuid": "5cf784bc-20d6-491b-a69a-2d1a03a96bb2", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996822, "uuid": "3f994cf9-512b-4103-afd4-0c08088361f1", "value": "24576:eZmBzExVfz/Mmv0x9xFqfISba33nFWKq8WucI+9vrc6NlrBe7pyIvR5V1e:6muVfz020xcIGa33ndcI+9vrcode1yW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996822, "uuid": "86f2826e-423f-486d-963d-b68a4241b679", "value": 1447453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996822, "uuid": "c0b1be5a-503f-4bda-95c8-aa5f242c850c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996822, "uuid": "f47ee08e-cdce-43db-adfb-3e28132de323", "value": "droopingness.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c64146-7a33-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1699007350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007350, "uuid": "1a8de635-ee7e-4036-ab7c-d4443584080d", "comment": "Malware payload (AgentTesla)", "value": "4e9e73864aab423f3ffc1c03c01b50fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007350, "uuid": "4ccc5a76-3f03-446a-81bf-5961d345ab86", "comment": "Malware payload (AgentTesla)", "value": "e906e2afb0ada6f36cfed5bb9de846f9561b6c6885bb151b0b1d266563e16bab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007350, "uuid": "7aebd62d-81eb-42fe-b6c0-0698ad54cf69", "comment": "Malware payload (AgentTesla)", "value": "1b4970fc703361db5d8513c33f56c23eecc2493e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699007350, "uuid": "464af519-e602-408e-af47-ca26f0baba4c", "comment": "Malware payload (AgentTesla)", "value": "2c0c0978f25095ddfa1ccee8cb2be7b129e6888312f2f3a7c58e06c7aab54116340a751782109be3e446fac9a452d1cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007350, "uuid": "06205e01-8311-4809-a351-2322502599c6", "value": "T1AE052308DBDDE847C17D4BB506A260B193F0C0DB7A43C77A6CC552B8A6221C6D35BAE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007350, "uuid": "1ea9baa7-b897-4185-b7d3-30b9eecd7503", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007350, "uuid": "6013bb4e-1c2a-4006-ab22-1f5fbb5ecd56", "value": "12288:DvR0jRi5CgvffXrlWDQc7M9wB31RNQdaBNqdDBXKGbFtom0YY:DvYMLHvpzcvB3ktDNKq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699007350, "uuid": "8852e59d-d6f1-4c4b-9f5b-ddd3fd22c12b", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699007350, "uuid": "419821bd-5698-4a28-a3e3-87f589071c5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699007350, "uuid": "0ec437e4-11d3-4cf1-89da-ba3b287e2ce4", "value": "ZAM\u00d3WIENIE_N.231003119.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba168ad-7a59-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1699023389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023389, "uuid": "414b00eb-d22f-486a-b835-13f6dda0c57c", "comment": "Malware payload (Pikabot)", "value": "b8aa0620fc6d6baaf8b5d88e6ca8f75b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023389, "uuid": "09ce946c-38c8-4e31-b556-7f7a1e472ac9", "comment": "Malware payload (Pikabot)", "value": "e9cb779be98c0f46dfb4c7480533531ec88cc06d1738b68f1aebfaa0077cca83", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023389, "uuid": "89f7fb35-07b6-4651-b5aa-48cf896a8bfa", "comment": "Malware payload (Pikabot)", "value": "0dd27a3e30b3cbacf337c6ac0e460bded7162415", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699023389, "uuid": "08f0cad4-9be0-4dce-911f-7ac465803095", "comment": "Malware payload (Pikabot)", "value": "71d16396f6c93925618bd423cbc22e9d26fd30c409b8f0972c3b8615dc4f80101b1ba1b42df114d78d30472d63539983", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023389, "uuid": "04ddc291-f8d0-42d0-b958-a6d14f19c2a5", "value": "T1010501A262BD0C74F5B72E783CA91B76813DFE704028D55EAB607E8F89302C99D56713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023389, "uuid": "cf948aff-3f77-4ab8-a2f5-7ca584cb7150", "value": "96999842154a016eed27ed8f2e2b7c35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023389, "uuid": "5e579324-2ad8-4a4b-a495-28f38213cc6e", "value": "24576:+2fL65KMWk0HDs1B8P26jJcDfi0uNEYJkdV4KN:+24YDs1e0uGYJIV4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699023389, "uuid": "f9b7dafc-0032-4380-b11f-ff0ebbf60fd5", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699023389, "uuid": "91459a5d-eee9-4ccc-8110-5a874c934804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699023389, "uuid": "c471f1bb-a438-48bc-8b3e-7bccda5d0915", "value": "pika-unpacked.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6733c82-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998336, "uuid": "f05212a3-a966-43e5-b496-4845711f86c9", "comment": "Malware payload", "value": "8dc82ca6d04645c115c4d761e2a778c3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998336, "uuid": "338d641d-2ebe-4322-9668-fb936ad2421b", "comment": "Malware payload", "value": "eb7f37ab64c9ba8ad40f4d6dda86f0e51a757f2f429cfae77d5b31725ba1085e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998336, "uuid": "7df1f33f-ec83-403f-88ea-920e8b6c5d46", "comment": "Malware payload", "value": "6483e8f755906a253b1e11cfe341480848acf3cb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998336, "uuid": "2bf9164e-9bc5-42d6-b337-6f7017f21ac0", "comment": "Malware payload", "value": "3eb9b496fde71238718dff686e38a5711ad21e8b20f06e4437e886626a12eeafc06247294ca04934e6e3d6042e37bb7f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998336, "uuid": "acff3bfd-a11d-4ce9-9852-8271cf8f6d16", "value": "T13F2507567BF8CE23D0AE2B77E8A13A105FFCEC45A262F74B164876A51C727005C9436B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998336, "uuid": "2d3a838d-6a52-4248-aeb5-4982a2bdd3d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998336, "uuid": "d5133ecd-af37-4cd1-bbad-ff3e7cec2637", "value": "12288:twM60FVyOcwk0PstyToWTmjpjWjxySmSygSys+JCHLTZISOmSCiliSSmaOBnMAYk:t6Wmt4oWTmjR0dllS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998336, "uuid": "a17a5afd-60fb-49ba-8e9d-269ec8cb5a64", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998336, "uuid": "f76801a7-8561-4c41-b882-de86bcb43aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998336, "uuid": "1947efaf-d060-44f1-8cfb-e73a14431c8a", "value": "PO-QTM11-039837637890BMJJF-0987636789398736.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53d614c-7a52-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699020641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020641, "uuid": "045ef2d5-677f-4b1d-b057-1009c645a8da", "comment": "Malware payload (RedLineStealer)", "value": "cfed673418e36cbef218eb95224afdba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020641, "uuid": "965e1553-02cf-4c52-aa8a-7adf55dad303", "comment": "Malware payload (RedLineStealer)", "value": "eba4766b6e31c7176ca556adaa1e6803d3ffba4e6801dcd4e9b1926393c1faf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020641, "uuid": "6c84f872-c602-4d21-b934-cb9bb7dd4160", "comment": "Malware payload (RedLineStealer)", "value": "13ecaa6041d26882c7f71a326ce2765cfa5b6127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699020641, "uuid": "be8694a9-e18d-4abc-a888-29afb7028d34", "comment": "Malware payload (RedLineStealer)", "value": "5f5236ba85d600fc32fc1dbacb7e66821d950d525955c7cf7cbf71ff3747a1dfcabee44b6dbb79e2435811ddffe5f342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020641, "uuid": "42590f5c-1b06-4834-9edb-d3ae13d656e1", "value": "T1647406C6338494DECC4F9DF1A1210D7586B4CA52A2CBBB537C8EACF6385A3596B051F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020641, "uuid": "1ec4a07b-6c50-4aa6-b3f9-2b76a7366eba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020641, "uuid": "defea5e1-1c65-48d4-9144-64d80e369c6b", "value": "6144:+5Jb0UMqg8IpJ9W1F8tMpSIIuOJ7bTEu8N1KITi:Iiq8WvIT7bTEuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699020641, "uuid": "9de4a488-6812-4196-ae79-df11b0d7de16", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699020641, "uuid": "c9fbf33e-09e2-4e8d-a193-4777f5a8e013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699020641, "uuid": "a6013fe2-08d3-4649-ad60-b05185a8e433", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c054bdd1-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698997010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997010, "uuid": "0d2a032d-d42e-493e-84a2-9e5f7d32bcb7", "comment": "Malware payload (RemcosRAT)", "value": "a2bce81148720a83009071fce680d958", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997010, "uuid": "540f9751-8de6-41ae-9169-032f383dc8cc", "comment": "Malware payload (RemcosRAT)", "value": "ec604e744a669546187f8460fa7f28a4deccefb8ec1bdd2115d593351b609d93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997010, "uuid": "c6c92d36-4454-4c42-8f7d-5960fd4240e5", "comment": "Malware payload (RemcosRAT)", "value": "0f95c5297f58aaeec10e70aa017e72ca1ddf5d5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997010, "uuid": "b03c90f9-c214-415c-ab5c-125946ffd22f", "comment": "Malware payload (RemcosRAT)", "value": "713e77fe5e85772517dfc30eeabd3971ad1aae93b57e12ecfcd764e2bbc23ad58d45cb37feeda01a8f7bd1fa5834c0aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997010, "uuid": "2e693fbd-628f-40ec-9b1b-00ae094e9ddc", "value": "T1D954128237F9D467D21A5BF41BBB67F06BD6B6140096AB0F6380DB54BE321C14E0F25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997010, "uuid": "b848bb0e-2ae4-4e40-9cfc-27f4122ea949", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997010, "uuid": "b8a7b548-4e36-4fc4-9285-1850d042486d", "value": "6144:KWhUjtvFeKRr+YpUR1EWyLUA8JKZiIPLU0tIB5xQTDzEs1/uaB1T:JGvYq/papI58s3LUew3QTDzXdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997010, "uuid": "350e6b15-8f0e-42bf-8b76-45f517a2f959", "value": 281996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997010, "uuid": "d3c41d66-dd5a-4290-b4fe-d41411c7e521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997010, "uuid": "bfcf2cf3-e2d9-4f75-b558-586705337876", "value": "NOV_RFQ#456372_SOFW_600SB_Rr_TIANJIN_INTERNATIONAL_CO_MATERIALS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe613ba-7a96-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699049891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049891, "uuid": "d155e9cb-779e-4a0e-8e6f-8eb75392994c", "comment": "Malware payload", "value": "e75c90beff284934d174bf60b9805fe7", "object_relation": "md5", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049891, "uuid": "68ca9f30-0374-4318-9cc6-23787e8a5d23", "comment": "Malware payload", "value": "ec83f0fd66a64bb96edab995b0732521a91346f107e3114f61d1d1b26f3fb571", "object_relation": "sha256", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049891, "uuid": "c5b12183-a496-4e6d-a639-ecf93722441e", "comment": "Malware payload", "value": "f79de15709567aecb81ed609ca9152405347a23c", "object_relation": "sha1", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699049891, "uuid": "e33ec888-e606-4c06-99b8-6096fefb5a7c", "comment": "Malware payload", "value": "e918d72f50bbc9509998440dbe926497ca5b2f27ce1e18777aaa0132f91d5e045c4150041651b4701e04b6ebf364af76", "object_relation": "sha3-384", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049891, "uuid": "88115c19-ce53-4453-9e59-d614bc6c0b31", "value": "T195169E237681753AC05B0B3A5537A671893EBF91BA12CD57A7F4384C9F31680793A38B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049891, "uuid": "7126b1bf-c72d-404e-b7dd-59bbb91a2fa4", "value": "49152:disfnzE2NCnMCb918EzI+n+RcwPIW5+S6SWvONKVwbcst:PnJNoMCb91LBn+RceYmbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699049891, "uuid": "c3c9e11e-c09b-4348-86e8-dfe56278c719", "value": 4147536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699049891, "uuid": "eb31ac3f-a23d-47e0-92c4-079ae1bc57ee", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699049891, "uuid": "d7f30cd3-4ddc-46f4-a752-d9c64c6dcfa6", "value": "DE0A0.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3cbd670-7a1a-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1698996533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996533, "uuid": "b2b180b8-266b-42ec-ad7b-1678237c33c8", "comment": "Malware payload (MysticStealer)", "value": "286aba392f51f92a8ed50499f25a03df", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996533, "uuid": "8b35408a-8408-46b9-8bbe-4ab2b52ac11f", "comment": "Malware payload (MysticStealer)", "value": "ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996533, "uuid": "b6a0430d-5e32-43a2-8976-9155a54c65c2", "comment": "Malware payload (MysticStealer)", "value": "ee11fb0150309ec2923ce3ab2faa4e118c960d46", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996533, "uuid": "9069f83f-f540-4807-bc9b-6d89d8c7903d", "comment": "Malware payload (MysticStealer)", "value": "610007c69f3536b33f9c8917ea87508452cd8f6c88ab400b58dbfd8391bcfcbc080ee0596cb0bb14a20eb482f776899d", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996533, "uuid": "afb2ef49-b76d-40bc-bdc4-1958b3c30f80", "value": "T113048E05B1DD40B1C9BA18380AF0E373EEBEB8544AD94DDF5BD40BBE5A2147CD22196A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996533, "uuid": "7ee30c20-3695-4fc3-b019-c55c5a57164a", "value": "120fcd59b8cf88c88d1af5610e72d569", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996533, "uuid": "dd3e33cb-3850-471e-a9fe-0a83488d22a1", "value": "3072:BlQdL3eS0Fsz1ENTA4Ub1ZVzrKrg8Y951Sm8hSaYwWP5Cer2cN2j+mjXS2XSPyrf:S3e9qbtrKct9TjViPcNwX2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996533, "uuid": "d64a02ab-5cb8-4a69-9087-d0975bfa711c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996533, "uuid": "59a0f18e-fe13-4add-9470-89561f9dc74f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996533, "uuid": "4f426d39-a560-4858-bd68-da6a1b91736b", "value": "286aba392f51f92a8ed50499f25a03df.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53826489-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699032905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032905, "uuid": "ee8bc77b-d093-45da-8538-818b843960da", "comment": "Malware payload (RedLineStealer)", "value": "b7ad0e8e45c4bceaeb2e0ab119a1fa47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032905, "uuid": "a9f540fa-b066-4059-b998-716cbba39800", "comment": "Malware payload (RedLineStealer)", "value": "ed20d15d7b6b5a70f1e0c3a5a9d9f300e1b26af696669f01d04f830ba62b5c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032905, "uuid": "9b113898-4557-4bc4-a3e3-01621b036a86", "comment": "Malware payload (RedLineStealer)", "value": "cbbb65216233325c8340e6fca0c247d41ba95cdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032905, "uuid": "a87c7ee4-ce99-4d24-bd55-5d77e3057a44", "comment": "Malware payload (RedLineStealer)", "value": "fecd0f657fb61d6e82381acf7f6f44224e169023eb126844060156dedfd6640e169c58a6208e89640664f6862913eed3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032905, "uuid": "ba35a9f7-41a3-4cb4-a54b-53a33b5622c4", "value": "T184F40211FFC188B2E67129751EF2AA705A3C783107B68EDF4794471D6E205C09A36FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032905, "uuid": "be3ce58d-90f7-447b-bfd8-517e9e7a1040", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032905, "uuid": "f5efa29c-4c28-465f-a5a6-0a311dead96e", "value": "12288:K6ErxJMTtEultk8MB/fRRCLIvheLzjATa69Sdg0oSHqKuL4ifSWTuNew:KJr8tE+284RR6Iv+z0TajCVJuNew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032905, "uuid": "51e8784d-4fdd-4baa-8a56-28e903270999", "value": 731224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032905, "uuid": "8ddf6114-29ca-4932-b3a2-7c9acc35d7c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032905, "uuid": "0109a13a-3bad-4f34-8002-b7a8c735766b", "value": "B7AD0E8E45C4BCEAEB2E0AB119A1FA47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e068760-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698996711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996711, "uuid": "f0f6aa06-0210-4628-8e41-3f26ee9df30b", "comment": "Malware payload", "value": "09185550875462590bdf5a88ddb62b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996711, "uuid": "6630a355-4a86-47ee-a1c5-f8925f501ea3", "comment": "Malware payload", "value": "ed89f0f68d4144988f61d163f97595a89b43dd56617ae3af728a070407fabf39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996711, "uuid": "a31c0a8e-b848-431e-b3b9-dca86edf06c0", "comment": "Malware payload", "value": "87edf56574bf927c08f036948d154f2499b0ac91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996711, "uuid": "058da3a1-72c1-4cfc-a1a2-aaeddb382426", "comment": "Malware payload", "value": "7a08990de4e0372a34a69a138772d3add2ce5b223694ee84f0053e2a3bfbc0c805ec2df1b24d2a5ac28468fcf83adece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996711, "uuid": "2c1b5892-08ac-44af-8060-e38b33007cfd", "value": "T1ADD58D21DF094135F5E205B2C92CAB5F990C96340365E4E3F2D88A5A39F87F37639A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996711, "uuid": "baa0f94f-9201-49fd-bdf0-7e48fa0db87b", "value": "89b531beddc86df0685aab06577d3422", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996711, "uuid": "6778a704-9ce5-40c9-b431-80018c71e8ab", "value": "49152:i8lNSlrqfNG035AjxM/V48vkD6pA560hKbkNBuadn4+1Iyr/i9KMXF6B6tR52VI/:isl35Ajx0kz9+I7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996711, "uuid": "6e23e81d-1eef-4d0e-ad37-11e8bad3d968", "value": 2819584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996711, "uuid": "054442f2-5e73-43b0-bc55-28ab0d173c51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996711, "uuid": "7102da4d-2b8a-4fc4-8e92-d23acc0082b1", "value": "09185550875462590bdf5a88ddb62b6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c2fcbe-7aa3-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1699055350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055350, "uuid": "e0cb4f6f-5872-48bb-83da-4dc7de8d87d6", "comment": "Malware payload (Mirai)", "value": "5fe93f97a6f76f392f814998b44420e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055350, "uuid": "cfd2d85e-7eef-4f81-b74e-7ce557d84768", "comment": "Malware payload (Mirai)", "value": "efb57c143e135ddcfacc143d63101a1cd1139fa7c1b20f3b370f71449256e203", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055350, "uuid": "d5120bcf-0d5e-40e6-92b9-ee7ae597ddfd", "comment": "Malware payload (Mirai)", "value": "ae0ec317cd6ed3ce93a9421c9ffffce3e6c43d76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055350, "uuid": "0055be1b-f871-4220-81cf-4dfe71183c8e", "comment": "Malware payload (Mirai)", "value": "217ad24b00f88c8c1a4a93decf8844e1c0d7e8e779221899b8af65f53452cc067066b8227776adb887197da3480c550b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055350, "uuid": "86197fb7-2dba-402c-a6a6-4147b0a3d76a", "value": "T16BB3720D2E259F7DFBED423997B78B259608339936A1C5C8C29CED021E7024A742FB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055350, "uuid": "cb6c4475-f278-4280-b6bc-ea4ecd4179d3", "value": "3072:576QbzpoGWqKf2CZsrbMJJk7guLGLXvmI3a/Up8:MQbzaGWhfJmguLGLXvm08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055350, "uuid": "b5e96d4b-d949-4a44-8985-c8aa531e9003", "value": 117108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055350, "uuid": "9aedcd0f-b57f-42ed-b7b6-23ebd2db8198", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055350, "uuid": "40f12dad-16ba-4e24-8704-92e6499fb9ce", "value": "5fe93f97a6f76f392f814998b44420e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7265f1ef-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698996879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996879, "uuid": "1e24f60f-2ef5-4932-a965-11fca89dc6e4", "comment": "Malware payload (GuLoader)", "value": "5636f4b8c08c581779cb69b203ae3de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996879, "uuid": "ed9136ea-1b92-4fd2-ba89-ee83df0d62e5", "comment": "Malware payload (GuLoader)", "value": "f081ea541447267eca51b28b37cdcffceb7248be75cf9cb7c96d87341305039d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996879, "uuid": "671840da-76d6-40e3-958f-4dbad38fd9e9", "comment": "Malware payload (GuLoader)", "value": "c671c0bdefa48791a64f2c595b442077b6918704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996879, "uuid": "ce43c3f1-46d4-48ac-81a2-71026da52388", "comment": "Malware payload (GuLoader)", "value": "949b1d58e02045069e1199d987691c47985fabd2fd6964c6e4f607a6ba51ea6f58152a582f38d0577f7e70e29986e3f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996879, "uuid": "1e2a0785-e74e-41ad-b99d-889a0967e764", "value": "T1951523505AE0C59BC7BB527444A6571DEFF8FD20B16B9707DB003A88FE269C34B2A25C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996879, "uuid": "91ccfdcb-632f-43e5-8abe-304c991a8001", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996879, "uuid": "b1829c5e-1540-4694-9603-2fd429766dbd", "value": "24576:INPx3TpIf6e4CNOqDRGHZErz6uc1L9J8xVCT5ATqY2BXY6+g7:mBTXTCNOq1Kqz6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996879, "uuid": "964ed581-7e3c-4199-898a-2f97f2a64475", "value": 887189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996879, "uuid": "685f25ad-7f4f-4935-9c95-463612966381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996879, "uuid": "c4a1e080-cfa6-4610-8ad7-113a407b51d2", "value": "Samtid.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf35f13d-7a50-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699019771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699019771, "uuid": "e176a2a2-bc95-4381-823a-865a82e7959f", "comment": "Malware payload (RedLineStealer)", "value": "3b54404c9e29b1848ba7baae8ba88c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699019771, "uuid": "f4282c90-4dd3-44b0-98cb-59e7fb1f35ce", "comment": "Malware payload (RedLineStealer)", "value": "f12ecffd21520fbc12c7537d269532299b2ba86bc9249117c84ff1bc25fe05c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699019771, "uuid": "61fc4534-b2db-48a9-b1b1-6a3992bd2dd1", "comment": "Malware payload (RedLineStealer)", "value": "100b87cf690b61a746db43a23b0987a017b3f167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699019771, "uuid": "4f930481-d4c8-4329-ae07-c463eda19ec3", "comment": "Malware payload (RedLineStealer)", "value": "2a0f589e47e4443d3b92429028f96ccfc77b9403b7a3711f6da8db38a5b4db197b66de3f18ba324882f7471da9858979", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699019771, "uuid": "60581596-acf9-47d0-bf1b-f3b80efe5ab7", "value": "T1546523247ADC15B3D8B517B218FB13A31665BD92ADA0D3533B06BC9A19B1E80F837317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699019771, "uuid": "76f20fbe-e54d-4a3d-9edc-8314f14325d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699019771, "uuid": "735fd57e-b04a-4879-885d-3b83bfcb4eee", "value": "24576:zynYbki5a8ZdN2HlmZkH+h7F6U3Eb8IUBSO0KxcYJhkSLuL8ciIXp9fYS0gqUJTv:GWki5aAN2F9+r6USU70KxcYJhkQuLriO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699019771, "uuid": "3f020a55-5dd2-4de2-8447-58d30936157f", "value": 1529344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699019771, "uuid": "cd0fb037-0fc0-4408-8cb2-0300853aec13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699019771, "uuid": "2e11ee25-dfa8-4ffd-937b-46fa9c388113", "value": "f12ecffd21520fbc12c7537d269532299b2ba86bc9249117c84ff1bc25fe05c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3e5929-7a1a-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698996577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996577, "uuid": "9b9af4fa-cae4-4d07-8ac2-a45c89716351", "comment": "Malware payload (PureCrypter)", "value": "b475dd1f999fbba5798ce177f7549280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996577, "uuid": "addf54ea-fdfa-42ba-93f2-e9645c97bbef", "comment": "Malware payload (PureCrypter)", "value": "f13b1d3990ddca3a987b5124e420f6581ed8cac776a31d055f1749ad207cc612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996577, "uuid": "d67c880f-c436-4b86-95cb-c543746dff83", "comment": "Malware payload (PureCrypter)", "value": "5377c4f9708c0996629199c3bbaef3e88a32517a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996577, "uuid": "25b0855a-813a-43c2-bc28-669d512ba4c6", "comment": "Malware payload (PureCrypter)", "value": "8bd4b8e8bba7abd7a3ab255d48252ff28990885ee96ca0ddd1ba630e593333845af6eb0f0016134bdc34478d3a268d0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996577, "uuid": "026ea0ba-fd5d-46c7-bf69-e76d3912b89d", "value": "T127934990FE8C9763E6AE27BD617203505BB5EE86B501F74F6C9C35C82C533881C166AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996577, "uuid": "c870c455-782f-4f43-b9a5-9d37726ccd54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996577, "uuid": "74023426-a5b8-4633-83b8-b8fb7be03db1", "value": "1536:nMKC46IUSRJS09f3BshlnSaqa6MJGNDidRLWmMQhkbiIhkQxsX3GgtAccysBc+QG:nMXlAxsjnTFnUERimMQhkbiIhkQm3GgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996577, "uuid": "677965b0-435a-4876-be48-6dacbaed9c3a", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996577, "uuid": "3ce2441b-f3d3-444c-a486-c3e8e74b75fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996577, "uuid": "e4b0cca9-75f1-4668-af26-dbd0cc92fe0b", "value": "b475dd1f999fbba5798ce177f7549280.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fe4213-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698997080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997080, "uuid": "bb73bd63-ce9b-452e-86b1-9a6a8e66ef45", "comment": "Malware payload (AgentTesla)", "value": "32bf7811478da89d1257f02c1adcf81b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997080, "uuid": "d214c5d8-35ed-4c2d-ae13-b9f35f982bdb", "comment": "Malware payload (AgentTesla)", "value": "f13fe7c53a790d33a00e6bd4e5763b1a333a6613311daf6c54cc85420335f383", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997080, "uuid": "a498e433-5b32-480f-92b0-c5c3d592836d", "comment": "Malware payload (AgentTesla)", "value": "7d54bee154efda04776b40cdfabe14500f15eed1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997080, "uuid": "a645c4a2-331c-4777-afb7-3d10fd96dca5", "comment": "Malware payload (AgentTesla)", "value": "5a8875c4349aeecc027fb78c026d9657bbc82dcfc15fbc45b41f36ee8b95a378c24063692d7de1e5cfbd5d2651b773fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997080, "uuid": "8ec2b9b6-398e-4395-9f3b-917f34def57e", "value": "T1F3623A4493BC8733ED4F1BBD99B603530BB1F7106426EA4F64CC20477E026522A6A3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997080, "uuid": "2146a2c5-a6ac-4bef-af1b-b01b8797c62f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997080, "uuid": "81e76516-99c2-46fc-b39e-da24e529c94e", "value": "192:lBFRb9VrPAjvUdQQE8KgHoTvcN4xWEepev5Ez9X7lj92SHxtoNiVOt8/Psc4tV4J:fPsbU88DHoTPcj7DZ/Ct8/ExsF2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997080, "uuid": "3378e752-5662-4891-b54b-9dd7dab158d1", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997080, "uuid": "9d76607d-0acf-48b8-ba22-174451d5d3e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997080, "uuid": "717d094e-fa17-4987-8d4d-3cb24bc21288", "value": "NOV.RFQ#94567890_MATERIALS_TIANJIN_INTERNATIONAL_CO_LTD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb82917-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698998346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998346, "uuid": "4debe53c-3b5e-479f-b4ad-0763e3994299", "comment": "Malware payload", "value": "d245aec620d4184c28b4aaf8fd3d9a21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998346, "uuid": "46501b45-454b-4a17-a796-22bb23783899", "comment": "Malware payload", "value": "f1523295527359ff93b3952396bdc5c20bccac031f1b244258eeb611ec9c3cc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998346, "uuid": "b7d6ed6e-2957-4312-9c5a-079fdc50c031", "comment": "Malware payload", "value": "1a006b37ac52ef9564e43f1b4770e9f32cad4291", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998346, "uuid": "8d801da3-1074-4fb8-869e-97d97af413fc", "comment": "Malware payload", "value": "584dfdb98e101406e82a7615ee9bb22f7cc1ff2ea6cde3f3ade0c9cbca3cd96df6a43cc5fa1de7aa2f1cc02ab3d0b2d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998346, "uuid": "7296d1a9-e4f8-4d3f-9af0-e1eab2466179", "value": "T1EC757403B977CDA1C948173BE2963C242FADDD816213F60A754A33551C737AE6A4AF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998346, "uuid": "5697a505-b221-4b35-8d64-8b104890e9ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998346, "uuid": "685187fe-d76f-49ae-ab87-f9b247cfb0e3", "value": "24576:0TbJQD4tVxPp0VU3P6jeyee3s/wkoB9LC2IaudJstxzxz2p2y4tS3eTjCTX4+Cr4:stVxPpjsoU5MtKpe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998346, "uuid": "def2c3cb-241e-4675-94f7-27deb07aaf98", "value": 1646080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998346, "uuid": "97f607c4-fb20-4c34-a1a9-5c8c9bd3e8b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998346, "uuid": "775868ac-f9f4-41fd-adf2-f978392582ee", "value": "swift_message_039876354536783987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199f4600-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981268, "uuid": "e7daae92-129a-446d-a995-6d4d43a1c4b4", "comment": "Malware payload", "value": "6953319c4af8ff9cba3875d7282d7117", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981268, "uuid": "1a3ded31-6057-4deb-95a0-848f758db3b8", "comment": "Malware payload", "value": "f1573f3604d2665b7bee0b9725ae03b50572446447d8c017d67295123546afd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981268, "uuid": "554d966c-3479-4607-9efa-d4e54e509ebd", "comment": "Malware payload", "value": "900e8359273446f2fdb2456364bc97965fe974f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981268, "uuid": "6237b57e-91a9-439e-bcc8-95663c8bdd8e", "comment": "Malware payload", "value": "f15e5aa9cfc807e7091313094a43d61b9f76472cf1b528c16a9380fa3ce4d0313f69426390a1d2181254d9fb5b8edf14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981268, "uuid": "c0e4d662-f433-4fb0-bc99-bc58524f2e8b", "value": "T110559D32F4E74095D204127019A79738AA75ED840A39DFD365B8FDBA1E33345AB3B2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981268, "uuid": "f1293909-3983-479c-95ae-ddc05e27007e", "value": "24576:zDqrfBNklfpbqfQ9lsqR9Ai8AtKEJ3xYTG3:zcfBNklfsqsWAiUE1xYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981268, "uuid": "eafbb8b4-b6ad-40c3-b81c-632fb5ef0305", "value": 1384448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981268, "uuid": "5ea86dc9-bdea-4524-ad2f-6957c5663bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981268, "uuid": "7eb56f30-c1e2-4e6f-97a0-47ea32cfa3a5", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1S437JY.10775.20146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795ae1be-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699028244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028244, "uuid": "5753483d-bf4f-4ea2-ade6-7b41639b91fd", "comment": "Malware payload", "value": "44ce180e523e03cb533e58837b6424c5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028244, "uuid": "fd19f412-5aa5-4b61-8868-ca2cc7f88e48", "comment": "Malware payload", "value": "f19dd5eafa96e3568e1350067cc3ae4007dbfc0fa133f4d041bf2d1a9060244f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028244, "uuid": "c8ecc30d-d699-4d60-922d-927050b5e9be", "comment": "Malware payload", "value": "2e60cf29038a3e0f2d4522449cf2700414555b62", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028244, "uuid": "342c3143-cda5-4adc-9362-f109cdfd1e41", "comment": "Malware payload", "value": "20f1678a24d3ac31aabcb40b9b2f8ddb5ff11032450b551074ac18d2918ec02c5a3aa173eba200d036c233bb06bc9c09", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028244, "uuid": "7a080830-3d19-49a5-8579-01ec5ef82f4e", "value": "T137F433CE403A44A0EABDC43566A95465BA1F3CBAF85038156CE302FF49519D6B0CF7AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028244, "uuid": "b24830ba-1b24-4e59-8062-700be886555c", "value": "12288:7Cmw66w0EQOOhyupNVPz8UIaa2ccCDqjMPJR1KYPNvEJVXNHgX8DA7KGahGp71Ru:74Fw0E7OhyAPNIaa2s7KSczANvVp7+Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028244, "uuid": "b13a938a-dd4f-4d83-955e-96bdc66784f0", "value": 764393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028244, "uuid": "7b2fd9b9-ee67-441a-8200-5ffc37de35a3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028244, "uuid": "5518b205-3bce-494e-bbf2-bde63a0bc96e", "value": "PURCHASE ORDER .xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1cb745-7aa3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699055362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055362, "uuid": "9eeac2f3-7de2-4f45-a8ce-992cce34b344", "comment": "Malware payload", "value": "679d2a1af3af8dad12b0bc433a059eb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055362, "uuid": "c04fde69-1ac6-4349-864d-ee9d11563f76", "comment": "Malware payload", "value": "f36cb53b0b0e00397fd4fcf1a1f7b6fb522c3bbe03c3046afe2e4c888bc5ad85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055362, "uuid": "f329e875-096e-4e01-9507-8c53156cc181", "comment": "Malware payload", "value": "48aee8f91b63bfca5cf85a1c248879d7396e7ecd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699055362, "uuid": "77686ff1-0f2e-4b5e-bd5c-388ed970bf0c", "comment": "Malware payload", "value": "940fc9d28b82321a11f689c3d9986284c6193c6ea3484b50a7db426ddf6bfb9e0d8a4250e8907c159fd4d83d57b27886", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055362, "uuid": "80288f77-b57e-4aa4-9fc9-0df9fe39eec3", "value": "T178B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055362, "uuid": "bc5c41fa-35f6-43e3-9ccc-a6d68c5beb7a", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg17/LWy:c9sSyzz36YaWWgg17q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699055362, "uuid": "93693d08-36a9-46fd-a306-9462103da73b", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699055362, "uuid": "58d1538b-f916-444d-b6bc-ced3b3ee6082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699055362, "uuid": "73b8dcfc-1610-47d6-a77a-518a0ffdea97", "value": "679d2a1af3af8dad12b0bc433a059eb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27b51b0-7a1a-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698996611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996611, "uuid": "86db2629-979c-4067-b49b-fe39af2cc2f8", "comment": "Malware payload (SnakeKeylogger)", "value": "0d3fb2793a8dae5660c775ec3753a97c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996611, "uuid": "c0ee8fcd-404e-454e-9b43-bd3942a4c214", "comment": "Malware payload (SnakeKeylogger)", "value": "f48443d246e98241791ae19cd0232b898a6f2a72b5c9418b5c56fb099c613ac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996611, "uuid": "674194bd-da76-46e5-a29e-919575d7e60e", "comment": "Malware payload (SnakeKeylogger)", "value": "6c586d5a717a76c5932fb90efc75c15eb576506d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698996611, "uuid": "5bd1b2e1-c0f0-475a-b459-703763744cc5", "comment": "Malware payload (SnakeKeylogger)", "value": "369b19820bfe7672954932a4860e5d2e9366844f5218f2e564dde32b8ee83011b78a006f1f49fc2ecf1c0177825573db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996611, "uuid": "78bdf45b-3739-4d3f-a5b6-ec43551d8ef1", "value": "T1F265850BB64789B2C16C1737C5DB841443ACD7A93213E60B758F23EA5943FBA5A4932F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996611, "uuid": "f553c315-085e-47ab-9f62-ad8d3ed57d9c", "value": "24576:gWX4qrSxkIWAqqH33nZTd51YzIPGKblKSKkqEJswMK4Qav6:dxrRMXFr1MIOKRJlMK4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698996611, "uuid": "fa8f1df9-3466-462a-899e-407c0cbc6a97", "value": 1524224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698996611, "uuid": "2fc6c8b7-b9ce-4f6f-9684-634a1fd4451f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698996611, "uuid": "fced835d-9d50-4959-b59c-9bd405fce1ef", "value": "Tvbifivhc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6154d05e-7a6f-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1699032928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032928, "uuid": "f58cf4e0-469a-42f6-860e-c82fef1890a1", "comment": "Malware payload (DCRat)", "value": "41f28ff8d5e2ba9c79fa62e830038734", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032928, "uuid": "14504b06-1f04-4a1a-97a1-5fa285c6c091", "comment": "Malware payload (DCRat)", "value": "f50bc6ea15a41f1aff50a177befad85a312fbd93418e683bf0eb9a28f523bdfe", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032928, "uuid": "a83df824-e310-4ba6-8759-2b6f894111b7", "comment": "Malware payload (DCRat)", "value": "3251d577356b19164b32098e012b12ca65f60b47", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699032928, "uuid": "966364df-2ef7-4733-9560-4994bc3b7b60", "comment": "Malware payload (DCRat)", "value": "91405f16d1c732327a852e384f57ddc82f8c1859c93b21259984c7f83bf54077da3823e28225e8a5026ee7eaf6b53c63", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032928, "uuid": "2249d7fe-3868-4cb8-b022-325b724540cc", "value": "T13F1506127B44ED02E269163BC9EF405447BCAD017A62DB1E7EAF339D2111BA74E4E1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032928, "uuid": "b007ddf6-6bd2-46cc-9097-097d31b4f130", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032928, "uuid": "cdc07150-5c41-4503-8782-323dc1806e2e", "value": "12288:r2QZNl/AaYlzXBpKBEIKEFSxtxFNdSNfwQyXMJK6TCFpqn4:r2QrZAa6mEIKaSxtxF6zhPTCFp+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699032928, "uuid": "d199c757-0cb7-4d96-bf58-1374a0c7536c", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699032928, "uuid": "99b2f07e-09ee-446f-85d5-e78c8d01b6d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699032928, "uuid": "5b55a718-cd7d-47b1-90e4-a7619ec7ab28", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-f50bc6ea15a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12082be-7a1e-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698998273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998273, "uuid": "3b9ddd1f-0f8b-4707-a45b-9d007b21209a", "comment": "Malware payload (SnakeKeylogger)", "value": "18419d01eada47b885541f7b9d969e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo.TUR", "colour": "#252271", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998273, "uuid": "a7bfb935-e6d4-45cd-b0ef-4e919da5dfe4", "comment": "Malware payload (SnakeKeylogger)", "value": "f628e27a84dbc19429086451a325881429a530b7f8e67089e1759cdbf03ffcf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo.TUR", "colour": "#252271", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998273, "uuid": "0c82807f-2705-4f4b-8256-6af12c391697", "comment": "Malware payload (SnakeKeylogger)", "value": "e77dffa96c3ed590d4de7a2475a446b3ba444ee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo.TUR", "colour": "#252271", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698998273, "uuid": "c00ef858-f070-473d-91c8-405c9bb49621", "comment": "Malware payload (SnakeKeylogger)", "value": "4707b7785015943dddeda4ed9594582ad2c2a80a26491f763f616209552670e5babf0d6b332c4af6e3f3bdb596b2aeef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo.TUR", "colour": "#252271", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998273, "uuid": "ce5e1bc4-8f06-4aa9-b3a8-e32697772d6f", "value": "T1CCC4124970CAAF7AF83CCBFD64E1A93517F5ED265822E6585DFA23F15931B420A80D03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998273, "uuid": "c58e02a4-dc3c-4375-b15a-b9dea29f7a16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998273, "uuid": "efc2ed2d-da70-4ae8-8fe1-1fb5b501ce90", "value": "12288:e+12YQvjOqfmMnFfIDSQ5rjAtjU4oQ0k56nQbndw03kX:e+1EO5ycujUxVmz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698998273, "uuid": "4e38b325-bc88-4dbd-addb-50d3f4bcaf4b", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698998273, "uuid": "801a2c57-4419-4c25-aa29-5c4f71327213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698998273, "uuid": "3f1d9015-fce7-475b-a7f3-e1d1037d69c3", "value": "AKAY LOJ\u0130ST\u0130K & DEN\u0130Z TA\u015eIMACILI\u011eI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8810c5-7a84-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1699041915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699041915, "uuid": "50b4accf-1e29-4c7e-b886-8dbe95e31194", "comment": "Malware payload (RedLineStealer)", "value": "49d4bd8ce9db08a1ffe20a13b29c7420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699041915, "uuid": "1cb315eb-276d-451a-a928-da6ee6b5367f", "comment": "Malware payload (RedLineStealer)", "value": "f636d54bf66339ab983cf31e259c8af64bdbb6ef81d8189cb4377557a534ebdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699041915, "uuid": "bb79032b-c3ba-458b-9aaf-0b36a8c93f9c", "comment": "Malware payload (RedLineStealer)", "value": "49b0cee27949785e5e33eacfb4484320f2ef142d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699041915, "uuid": "f475ec9b-3ba3-4ea9-a7f4-b63d2e191e38", "comment": "Malware payload (RedLineStealer)", "value": "42b7f259e6176404c4dc4592a7c81624e0f3447d9b80d84170a1405cbdd3e53a48f1c846783f9d22b148823070079489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699041915, "uuid": "05e3ba23-700d-43ab-a77a-4580172eb90e", "value": "T11285FA1176F95B59F5F30BB85ABAA612487ABC6ADF11C2DF1251908E0C31BD08970F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699041915, "uuid": "78c57ccd-694f-4166-a83a-a5ed5448b71f", "value": "d47242ec56e1a1639468f1233564ee05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699041915, "uuid": "6c1cf6d9-b4bc-4a0d-ae98-757bb1760cb1", "value": "24576:JPCn0rGPjHIsS83dwxNmpxx6a9Dhvh6qozo:JejHIsS82mXx6a3vH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699041915, "uuid": "bc2ed5ed-4c00-413e-ab88-3f7aa1ec7693", "value": 1743624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699041915, "uuid": "1917daca-94ed-4573-bb98-889f21e0e222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699041915, "uuid": "8e23b761-eb6e-46c7-b569-eff7ec7bfadd", "value": "49d4bd8ce9db08a1ffe20a13b29c7420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e75f07d-7a78-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699036682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699036682, "uuid": "c5d072e7-2555-4802-8789-69e68a5bd146", "comment": "Malware payload", "value": "fa7927e0453a5d7480aec5bb9700ff48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699036682, "uuid": "46c25567-3dd3-4f6f-9674-680355210d5b", "comment": "Malware payload", "value": "f66eb98f8f26ca18564ae8c17d1bccc40c59ea9d243825f89d59f7486ea6c1bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699036682, "uuid": "62fdc065-ecd4-4d5a-8d29-5f4d1be86f51", "comment": "Malware payload", "value": "c3c174846b45d12910a52523181874f641430285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699036682, "uuid": "104233e5-d57d-46a7-b633-b447650e914a", "comment": "Malware payload", "value": "5abbbe50933c16b50e5181be7b5603e4f56bf5092a7c5ced627b2307055b6ce6ca8bab5cabf4308fa42193e599425f79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699036682, "uuid": "33c4d2c9-95dc-4eb2-9f80-0388fc752af3", "value": "T1C3D41204BABD1B16D6BE87F155A0151C03BA79EBA08AE74C1CC180EF16B2F848F91F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699036682, "uuid": "94be908a-2b10-45dd-b924-6a45837fc69b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699036682, "uuid": "2f0ddb4f-1f89-430d-8dd7-c825fe716ab3", "value": "12288:f481bjyye9vJSqzpvUhAGYKln9hnQym+NQ957RIomc9BJg58FOgOIHyrWw9k:f481bWyNGvK55l9pPm+Nyrd9BJbZ9Srb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699036682, "uuid": "c86c7528-164c-4e2a-b537-bae9527dbc53", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699036682, "uuid": "b3ae1d3f-45c9-4bd2-a25f-24ec7b3466d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699036682, "uuid": "e256b033-f578-44fe-861b-2485aaf476dc", "value": "BLNVAIST-30-10-2023-008876678992-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273e8f12-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981291, "uuid": "bf09b630-521f-4eea-9fb3-26020025bc11", "comment": "Malware payload", "value": "cc7627d6d5dfd9403af832f96aa10d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981291, "uuid": "14fca7fa-cf4b-4448-89b5-5a0b96031810", "comment": "Malware payload", "value": "f6efae341bdc1239dcecc5a1899f6d5c59b02f408bb725d6b900c9aae619232f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981291, "uuid": "2815730b-d93b-4b0b-845c-4109917cc5d0", "comment": "Malware payload", "value": "61078fd2441429aa2cb05724c412fcb3a744741a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981291, "uuid": "89ae2392-e469-4f9a-a98f-8fd2fe670f43", "comment": "Malware payload", "value": "ed8ed16633d2b1918bd7d71e48c3360fde00a07af9b9bd7ab38d05974d9817de80b846a76243d4096cc33a15c2a4d684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981291, "uuid": "e56a2644-aeff-4401-8e4f-a52d43d7b6c8", "value": "T1EF85F11FD674B5F6C4C1ACB25A817A76E3336DB252195A32A1D0FF2A413375C23C928B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981291, "uuid": "9f8a4a54-f38f-467a-bc2e-f3b10195cbcc", "value": "24b12021a2ef6c884a72544c258398e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981291, "uuid": "8789cf8e-1c81-4a0c-a35c-c9dd62b785c7", "value": "49152:yGB0GDjaUjfkpg+lkr/SsQa0dJn+e/B9u:/pDtQpBlIAr+e6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981291, "uuid": "7aec1d8c-3b48-47a4-a8cf-87607f484182", "value": 1855016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981291, "uuid": "c2460aba-faea-4b5b-8039-1127e0f15d2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981291, "uuid": "4a9113e2-bafb-49d6-86c5-aec21a8f8511", "value": "SecuriteInfo.com.Riskware.0040eff71.16247.2540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f9c4e7-7a84-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1699041907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699041907, "uuid": "756137e4-0697-4dfd-9aed-490895883630", "comment": "Malware payload (Stealc)", "value": "0375d999bd03ed2cfade075073fe6c12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699041907, "uuid": "22a0a0a7-e2a5-4dac-a13f-dd37d3a99223", "comment": "Malware payload (Stealc)", "value": "f7ba95f0e91ac4ca37c1615a5e09c3da8b9e2a495e52a5e1db142fc85f8b9a8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699041907, "uuid": "088c0809-8865-4659-a79a-47ac91482a7b", "comment": "Malware payload (Stealc)", "value": "d2744fbf36e174a828d55bc72c6fa157ea722227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699041907, "uuid": "644eb9d1-5b94-4b75-8939-6c0b01d2eadb", "comment": "Malware payload (Stealc)", "value": "5fc4cf23e636a87c2f4e7de53c6e8a5f6f236dafe5171b462a130835a212cd1631b3b769cdb4c7c75a18989c6480c2b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699041907, "uuid": "d4870708-2e76-4a28-bad3-ad4fda842ee4", "value": "T17A444B1392D16C61F5279B328EDEC6E8F61EF9618F55379E22587A2F09701F2C272702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699041907, "uuid": "f23844b8-d744-4c02-bcea-0501f1429adc", "value": "ce8b02cf0e0e47bfce02667d7460664f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699041907, "uuid": "9bd60da1-0b6f-4fb9-b217-56b6c6182c07", "value": "3072:qcgfwoRxsdrkN3K92AuKx/umukBsW6QIvqPSpsDN0pUpTUd9+lu:JoRxOkNa92lQGlkuWuOSKDXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699041907, "uuid": "439158a7-d4b8-42ed-988e-a5a0e3d76abd", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699041907, "uuid": "1881984d-3c30-4393-b47c-b6921310effa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699041907, "uuid": "66536c43-dc35-43cb-ba2e-efe132b829f7", "value": "0375d999bd03ed2cfade075073fe6c12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c666304-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981273, "uuid": "b362ece8-daf0-4217-925c-9d6848fa00af", "comment": "Malware payload", "value": "bca4565b023a22ec5e9d727ed9c912ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981273, "uuid": "f24f3e4e-4d5f-45e1-8139-e0654e37562c", "comment": "Malware payload", "value": "f8780e2fd9ea9c9ba54bb7fa337dc579b941b0d8b13c9ca90b55b9342e289647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981273, "uuid": "ccd46117-bfa7-4228-af32-3ea626906b2e", "comment": "Malware payload", "value": "3634e71b728a1b8edf23249060a6a7292d53de5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981273, "uuid": "0fc176f2-0f47-47b3-a87b-bce061f82458", "comment": "Malware payload", "value": "b3b4228db01a7a53f402126eec5df0c0ac2f0983c687d28450e6d42ca9443c7063a7eede42dca1a3cf202c248f31835c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981273, "uuid": "4ad5bd6f-17ff-4b47-8f5d-0ab2ee75cca6", "value": "T1D8357C0732915033E6B279364A1B429DC926FE261D78345A6BF9AC483D35643FA72FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981273, "uuid": "db58e567-c6c6-472f-b694-e77255e4310d", "value": "12288:XGB+OVpf2HcuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rT3m/aw3/:XKvzcrnyaLO+3Yb/wQeAh/7Rdx/tf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981273, "uuid": "06fd27c1-1f11-498a-9dca-f993c5297859", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981273, "uuid": "ae066ca8-0583-4fde-8eef-3bd0ccad440f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981273, "uuid": "d6b2b709-f363-4e8e-8b3c-d5283cf57d70", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.6840.8402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b31497-7a70-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1699033575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699033575, "uuid": "dc365dc1-452e-4cbd-afb2-4a857c398ff8", "comment": "Malware payload", "value": "9d39de7ebf5682c21074240ff4058e61", "object_relation": "md5", "Tag": [ { "name": "BrookRAT", "colour": "#27552B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699033575, "uuid": "353e39be-0cd5-48ad-9b03-e5c12d49d90c", "comment": "Malware payload", "value": "f93faf0aef75fd22d3d5358389b6c2857b9129ba009478596e7bb214e0549f5d", "object_relation": "sha256", "Tag": [ { "name": "BrookRAT", "colour": "#27552B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699033575, "uuid": "92c77a84-5d47-4d4e-b317-495db012b116", "comment": "Malware payload", "value": "d55b2ea89ad72092a1c60b1f534e838ba3282bb5", "object_relation": "sha1", "Tag": [ { "name": "BrookRAT", "colour": "#27552B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699033575, "uuid": "ac231135-3dd2-42a2-9180-f719935e763c", "comment": "Malware payload", "value": "ef52e2e5a33922004bc2d256ebc3e88e76d35e26be7a6aff1ea4cfde6c46dbbbb11db57bc094df55aa76a7c93ed764a2", "object_relation": "sha3-384", "Tag": [ { "name": "BrookRAT", "colour": "#27552B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699033575, "uuid": "7427dc2b-0392-4153-80e1-6cab3c2a4f14", "value": "T13A967C47EC9545A9C1A9D730C9B29253BA71BC881B3123D72B50F7392F77BD0AA7A304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699033575, "uuid": "4024b752-20dc-491f-b2d9-169acd376619", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699033575, "uuid": "a562b925-a98d-4c32-9371-c65da31d0d17", "value": "98304:RXZNdlWsJbuuSOrUhENL4QejRv3mxMqnhlQhrqUZzIoKRC:ZXrWsJbuuStiNLuRmnjQHpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699033575, "uuid": "6497adc8-7be3-4385-9349-375c63d38f2a", "value": 8735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699033575, "uuid": "981e24da-756d-4aed-9fe0-a8a4d57ccef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699033575, "uuid": "9541c5fc-b1a2-4694-8c9e-1774b83da1d5", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ae28eb-7a32-11ee-8907-42010a9c0042", "comment": "Malware payload (RustyStealer)", "timestamp": 1699006684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699006684, "uuid": "909cd47b-5293-4cdb-95fd-936b31e1e9c8", "comment": "Malware payload (RustyStealer)", "value": "aab9abec81f255e7f73d3ac2b393b82f", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699006684, "uuid": "c02f5f59-004a-4d39-967a-39df9fc2ee6f", "comment": "Malware payload (RustyStealer)", "value": "fcdb330d3323935ce117f9a457282b7d7aa6a13e7bdbfaca5b82d310f0f6ee59", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699006684, "uuid": "ca7ba50a-8a16-4a9a-96e7-c1128aa2b82a", "comment": "Malware payload (RustyStealer)", "value": "66294e12d96a95dfecd59dd07bf1a7d77827a17d", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699006684, "uuid": "3fff81f3-0c37-417b-998a-ba059f8525f1", "comment": "Malware payload (RustyStealer)", "value": "372f11fd138e2267be194c764611c06fdef2bf5ee8d5433d9c3efa75030caf779334c76d450202842039667b8d4ffe22", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699006684, "uuid": "2b230357-70e8-472a-b1f0-7b7845f0dea6", "value": "T1E317336D9B3ECE23CD0401309486D5F32A558E9B5A03E3731BD9BDB37883395A74939A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699006684, "uuid": "d6e7b90d-28dd-46ad-af3f-7e29aeeac0c3", "value": "393216:FeeErqRTbb2awJ9ry9izxOLzdZZn2rSDnBlnNn+Wv+yegR0XS1TxJsqN/IMzTzJH:FeeErqRTbb2awJ9ry9izxOLzdZZn2rSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699006684, "uuid": "ebab35ee-f2f3-4c59-9f40-512f35569aea", "value": 19450256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699006684, "uuid": "e2ced64d-0821-44d3-95d3-b6b6dbc1fe13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699006684, "uuid": "d46dfb56-43d0-45da-8290-eb25d737343b", "value": "Chr\u043em\u0435S\u0435tu\u0440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df5b164-7a64-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1699028225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028225, "uuid": "7f2ca3ae-6244-474e-8184-89520bfa57ed", "comment": "Malware payload (SnakeKeylogger)", "value": "7c680b856965144ada69a5afcb031813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028225, "uuid": "ec60c63c-1c13-4273-a740-290267724803", "comment": "Malware payload (SnakeKeylogger)", "value": "fddb5c07d9ae4295bec096fe40d29b14c27be92760e586ec99ca43a43fe16244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028225, "uuid": "643c5dbb-f615-43b9-9db3-d4425cb838d4", "comment": "Malware payload (SnakeKeylogger)", "value": "01967f1e2da8cdf027d42f4fa6f8d2214c7e0a49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1699028225, "uuid": "c84e9483-78f4-4e09-911b-a9bfbeceb465", "comment": "Malware payload (SnakeKeylogger)", "value": "798d4e66e53a14cea456f98003b36c64de8dbd80453433e7478e1c21b658c8d9d7eb454b7d1e9a526e8abdfad5df8c19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028225, "uuid": "60768560-79cd-4fb5-b6fe-6d3f5242faf5", "value": "T162A218189A5DD127CEAC467E84A34A9643B6DB2BB042F34F9D8CA1E67D533D008D07E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028225, "uuid": "c283c3ef-8735-4ced-a422-88f8ced28976", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028225, "uuid": "400f794b-99a9-4505-90b7-c53db76d5a92", "value": "384:Is8eRdyRZZFFYPd8yx3IQGrhowkp48fNZ1RzWkET7AsbRO3gCR/1:j8id3T265p48fN/EbUQCRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1699028225, "uuid": "60b51438-fd07-41b4-9805-c2adbad32c42", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1699028225, "uuid": "12d6ce75-75c6-4fd7-9fec-099fa0cb0d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1699028225, "uuid": "5f7d33d6-b5e8-4f6d-9c9f-5fe81f0f0726", "value": "VakifBankKrediKartiHesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb19664-79f7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698981272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981272, "uuid": "e68fd079-9baa-48db-a741-6532eceac3e2", "comment": "Malware payload", "value": "dbed10830b377c7e10f8ad810ed4d7c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981272, "uuid": "1a4920dd-572d-45cf-b14e-5f035e68fc3a", "comment": "Malware payload", "value": "feafd1ded1637299629547e8451d963b3c5b1abbfc49ddda07d5eb7cd674462d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981272, "uuid": "3808799b-1874-40e4-95ae-872f33673f3a", "comment": "Malware payload", "value": "fa903aee6bcd7a62a5c97da49349718cd0f783e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698981272, "uuid": "1c5a8687-190a-4eb5-a2d1-f7ee732b3c1b", "comment": "Malware payload", "value": "3deaf327eef408b1c326deca80c23ee663ed270f882256c389193497fcac4c1cf5f30a007524ea1aa1133e08d141bbd4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981272, "uuid": "913a4c7e-196b-4c23-9a62-15b9dda86902", "value": "T1733523604A05CFF3C71264BB3B71287C1326D2B5AA5F82F9A996551D282A40CF3653FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981272, "uuid": "65f0340b-57d0-4ed2-b8b2-6f80d1f9402c", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981272, "uuid": "0eb963df-ea32-483a-89ab-bb8a54ead362", "value": "24576:lxWZ0RO+bdjgbdQTcpjmxWoci4shshciNu8t/VlRE3tB32FWZN:VObQTm0Fci4iWNuUbEd8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698981272, "uuid": "21110093-f851-42ae-9e62-7e6ffe633fa8", "value": 1162240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698981272, "uuid": "20938672-0040-4ff5-a35e-e18cf27ce57a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698981272, "uuid": "3fba6e48-cb40-42db-ab51-8f4ce66cacaf", "value": "SecuriteInfo.com.Trojan.Win32.Spy2.5861.28015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe35815b-7a1b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698997114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997114, "uuid": "e7e4b45a-af8d-4458-9143-82bec19892ba", "comment": "Malware payload (AgentTesla)", "value": "3bcb572e3a3a003a9fb807c0404ebe67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997114, "uuid": "499210c5-1bf8-4c7d-90d3-bb747b4c92e3", "comment": "Malware payload (AgentTesla)", "value": "ffe761c74414bcf4070d58056379399fbb6d0ffef4dde400fa4013260cd8bb9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997114, "uuid": "87a107b2-dd9c-494b-8c6a-12846b77b6af", "comment": "Malware payload (AgentTesla)", "value": "9bcdd992b08ca92776f5e822329c4316ea1c73c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698997114, "uuid": "9810f7f1-1120-483d-9266-cadbbf007970", "comment": "Malware payload (AgentTesla)", "value": "b29ac8f08d6f4a0ff94f69be249f9b74ca1e9c227da61007aac23ae133ebc0ca199d200aa14a819e2c67424fd78327d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997114, "uuid": "e5604e2d-47f0-4b00-8210-b1284e8b29ac", "value": "T1E324452CD34F02A98F6253769B271D5442BCBA6EF34065B1306C837933EAC3CA5251BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997114, "uuid": "6559c5b4-7eff-4cc4-b897-629279dff258", "value": "768:cwAbZSibMX9gRWjYVyduICSM8AGmgMZCJ22Fq5Vd:cwAlRXWupJgMMJ2oq5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698997114, "uuid": "96e1a12f-3e6b-496e-95b0-663779d2430b", "value": 218669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698997114, "uuid": "5d067970-34bd-472f-be47-1bbf51a11e80", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698997114, "uuid": "2c876350-bae7-438a-bca5-4a21ef878408", "value": "SWIFT 2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }